Android’s privacy settings are spread across four different places that all look similar: the phone’s own Settings app, the Google account page, the Play Store, and Chrome. That is why most “privacy checkup” advice turns into a scroll through menus without a clear result. The order below gets the biggest reductions first, and every step names the exact path so you can find it on a Pixel, a Samsung or a Motorola without guessing.
Read the privacy dashboard before you touch anything
Since Android 12, Settings > Security & privacy > Privacy dashboard shows which apps used the camera, microphone and location in the last 24 hours, ranked by minutes of access. On Samsung’s One UI 5 and later the same screen sits at Settings > Security and privacy > Privacy dashboard. Open it once a day for a week and you will find the real offender — usually a shopping app holding location for 40 minutes a day, or a game that has been on the microphone.
Tap a category, then an app, then switch access to “Don’t allow”. Android 13 and newer adds “Privacy controls” on the same screen, collecting camera, microphone, clipboard and location toggles in one list.
If a permission looks wrong but you still want the app, downgrade it rather than removing it. Location can be set to Approximate instead of Precise — a weather app needs your city, not your building — and camera or microphone access can be limited to “Only while using the app”. Google documents the model at support.google.com/android if an app’s request does not match what the screen says.
Delete the advertising ID instead of just resetting it
Resetting the advertising ID was always weak advice: apps lost their old profile and started a new one within a day. Since late 2021, Android lets you delete it outright, and every app that asks for the ID afterwards receives a string of zeros.
The path varies by manufacturer, so use the search box at the top of the Settings app and type Ads. On Pixel and most stock builds it lands under Settings > Privacy > Ads; Samsung puts it at Settings > Privacy > Ads as well, sometimes nested one level deeper under “Google”. Tap Delete advertising ID and confirm. The page also carries a “Reset advertising ID” button — ignore it once deletion is available.
Deleting the ID stops cross-app profiling, but Google account-level ad personalisation is a separate switch on the web: open myaccount.google.com/data-and-privacy, then Ad settings, and turn off personalised ads for the signed-in account. Do it for each Google account on the phone, because the toggle is per-account and the phone usually carries two.
Three permissions worth auditing by hand
Usage access (Settings > Apps > Special app access > Usage access) lets an app see which other apps you open and for how long. Digital wellbeing and some launchers need it; a flashlight app does not. Revoke everything you cannot justify in one sentence.
Display over other apps, on the same Special app access list, is how overlay scams draw a fake login screen on top of your banking app. Fewer than five apps on a normal phone genuinely need it.
Notification access lets an app read every notification, including bank one-time codes — the quietest way to lose a 2FA code.
Then deal with the apps you have forgotten. In Settings > Apps, open any app you have not launched in months and switch on Pause app activity if unused; a fuller walkthrough of that list is in the 15-minute Android permissions audit. Android 11 and later does this automatically after a few months, but the manual switch also clears the app’s temporary files and revokes its permissions immediately.
Turn off the background reporting you never see
Location is tracked even with GPS off. Under Settings > Location > Location services, switch off Wi-Fi scanning and Bluetooth scanning; both let the phone map your position from nearby networks and beacons. Keep Wi-Fi scanning on only if you rely on Google’s Find My Device to locate a lost phone indoors.
Next, Private DNS. Settings > Network > Private DNS (Pixel) or Settings > Connections > More connection settings > Private DNS (Samsung), then choose “Private DNS provider hostname” and enter one.one.one.one or dns.google. This encrypts DNS lookups so your mobile operator cannot log every domain you visit. It is a five-second change with no app to install.
In Chrome, open the three-dot menu > Settings > Privacy and security, block third-party cookies, and turn on “Always use secure connections”. Chrome’s ad topics and site-suggested ads toggles live on the same page.
A ten-minute review every three months
Privacy settings drift as apps request new things. Once a quarter, open the privacy dashboard, sort by location, and remove access from anything with more than an hour of background use. Then set Web & App Activity at myaccount.google.com/activitycontrols to auto-delete after three months rather than 18 — it sits beside the on/off switch and almost nobody turns it on.
Two more items to add to the list while you are there: on Android 15, Settings > Notifications > Sensitive notifications hides one-time codes and message previews on the lock screen, and Play Store > profile icon > Play Protect should show “Scanning apps” rather than an error. Neither is about anonymity; both stop a stranger holding your unlocked phone from reading a banking code. If the phone is likely to leave your hands, pair this with Android theft protection settings.
