Android is the world’s most widely used mobile OS, and its customisable nature means that default privacy configurations vary significantly between manufacturers and versions. Samsung One UI, Google Pixel stock Android, Xiaomi MIUI, and OnePlus OxygenOS ship with different defaults, different pre-installed apps, and different settings locations. But the underlying Android privacy settings cover the same categories across all versions: location, permissions, ad tracking, diagnostics, and Google account data. If you want the full context, see our Complete Guide to Security and Privacy.
Working through the privacy settings systematically takes about 30 minutes and produces a meaningfully more private phone. The settings are distributed across multiple menus — the main Privacy menu is the primary hub, but important controls also exist in Google account settings, individual app settings, and manufacturer-specific menus.
Start here — the highest-impact changes
If you do nothing else from this guide, do these three:
- Delete the Advertising ID: Settings → Privacy → Ads → Delete advertising ID (Android 12+) or “Opt out of Ads Personalisation” (older Android). This unique identifier is used by advertising networks to track behaviour across apps for targeting. Deleting it prevents cross-app advertising tracking without affecting any app functionality — the only cost is slightly less-relevant ads in apps that display them.
- Audit app permissions: Settings → Privacy → Permission manager. Review Location, Camera, Microphone, and Contacts. Change every app set to “Allow all the time” to “Allow only while using the app” unless background access is genuinely needed. Revoke permissions from apps where you cannot identify a clear functional need.
- Turn off Google account activity logging: Settings → Google → Manage your Google Account → Data & Privacy → Web & App Activity → Off. Repeat for Location History and YouTube History. This is the change with the broadest impact — it applies across all devices linked to the Google account, not just the current phone, and stops a detailed activity record from accumulating across all Google services.
Location settings — the most sensitive category
Location data reveals patterns of behaviour — home address, workplace, medical visits, religious attendance, and political activity — from the places the phone goes. Settings → Location provides the controls:
- Master toggle: keep on if you use maps or weather apps, but audit per-app settings rather than leaving everything at default
- App permissions (Settings → Location → App permissions): shows every app that requested location access and at what level. Set everything to “Allow only while using the app” unless background location is genuinely needed (navigation during active navigation, certain fitness trackers). Most apps that have location access don’t need it.
- Google Location History: disable this in Location Services or at timeline.google.com. Delete existing history at timeline.google.com → Settings icon → Delete all Location History. This stops Google from building a timeline of your physical movements and removes the accumulated historical record.
- Google Location Accuracy: uses WiFi and mobile networks to improve GPS accuracy but shares network data with Google. Safe to keep on for apps that need accurate location; turn off if precision location isn’t needed.
Permission manager — the comprehensive audit tool
Settings → Privacy → Permission Manager provides a category-by-category view of every app’s permissions. Review these in order of sensitivity:
| Permission category | Apps that need it | Apps that typically don’t |
| Location | Maps, navigation, weather, delivery tracking | Social media, games, shopping apps, most utilities |
| Camera | Camera app, video calling apps, QR scanner | Banking apps, games, news apps, productivity apps |
| Microphone | Phone calls, video calling, voice recording apps | Social media apps (usually), games, most utilities |
| Contacts | Phone dialler, messaging apps, email clients | Games, shopping apps, any app that requests it “for recommendations” |
| Call logs | Phone dialler app only | Almost everything else |
| Body sensors / Physical activity | Fitness apps, health monitors | Almost everything else |
| Nearby devices | Bluetooth speakers, smart home control apps | Most other apps |
The Privacy Dashboard (Settings → Privacy → Privacy Dashboard, Android 12+) shows which apps accessed location, camera, and microphone in the last 24 hours. Any unfamiliar app appearing there deserves investigation through the Permission Manager.
The step-by-step review sequence
- Open the Privacy Dashboard and review the 24-hour access history — note any unexpected apps that accessed location, camera, or microphone. These are priority targets for the permission audit.
- Permission Manager audit: work through each category, changing “Allow all the time” to “Allow only while using” and revoking from apps with no clear need.
- Delete the Advertising ID (Settings → Privacy → Ads).
- Turn off Google account activity logging (Settings → Google → Manage your Google Account → Data & Privacy).
- Review diagnostic data: Settings → Privacy → Usage & diagnostics → Off. Also check manufacturer-specific diagnostic settings — Samsung: Settings → Privacy → Samsung Privacy → Customisation Service; Xiaomi: Settings → Privacy → Diagnostics & usage data. Disable all.
- Check notification access: Settings → Apps → Special app access → Notification access. Apps with notification access can read every notification from every other app — including OTP codes and banking alerts. Revoke from any app that’s not actively used for notification management.
- Review the installed apps list: Settings → Apps → see all apps. Identify and uninstall any app you don’t recognise or no longer use. Every installed app retains whatever permissions were granted and may run background processes.
Google Play and sideloading
Google Play Play Protect (Play → Profile → Play Protect) scans installed apps for malware and should be set to “Scan apps with Play Protect” — on. Certified device status (Play → Profile → Settings → General → Account and device certification) confirms full Play Protect coverage.
Sideloading — installing apps from outside the Play Store — is an Android privacy settings risk. The “Install unknown apps” permission (Settings → Apps → Special app access → Install unknown apps) should be enabled only temporarily for a specific trusted source, then disabled immediately after installation. Leaving it permanently enabled allows any downloaded file from any source to attempt installation — a significant malware entry point that undermines all other privacy settings protections.
Manufacturer-specific privacy controls
Android privacy settings beyond the Google baseline vary by manufacturer:
- Samsung: Settings → Privacy → Samsung Privacy has controls for Samsung’s own data collection — diagnostics, Customisation Service, Samsung account activity — independent of Google’s controls. Disable Customisation Service to stop Samsung from using usage data to personalise Samsung apps.
- Xiaomi/MIUI: Settings → Privacy → Diagnostics & usage data — disable. Also review Settings → Passwords & Security → Authorization & revocation for apps with special permissions.
- Google Pixel (stock Android): Settings → Privacy → Android System Intelligence controls on-device AI features (smart replies, app predictions, live captions). These process data on-device rather than sending it to Google’s servers — worth knowing when evaluating the privacy/convenience trade-off.
Pre-installed manufacturer apps — “bloatware” — often collect data independently of apps you actually choose to use. On most Android devices, apps that can’t be fully uninstalled can be disabled: long-press the app → App info → Disable. This removes it from the app drawer and stops background processes without full removal.
Our guide on keeping your phone secure covers the security-oriented Android settings that complement these privacy controls. For the iPhone equivalent of this guide, our iPhone privacy settings guide follows the same category structure. For managing the Google account data that accumulates across all Android use, account.google.com/data-and-privacy provides a single-page access to all Google account data management controls — including auto-delete settings for Web & App Activity, Location History, and YouTube History that provide ongoing data minimisation without manual clearing.
All Android privacy settings — quick reference
| Setting | Where to find it | Recommended action |
| Advertising ID | Settings → Privacy → Ads | Delete advertising ID (Android 12+) |
| Location (per-app) | Settings → Privacy → Permission Manager → Location | Set most apps to “While using” or “Never” |
| Google Location History | Settings → Location → Location services or timeline.google.com | Disable and delete existing history |
| Camera access (per-app) | Settings → Privacy → Permission Manager → Camera | Revoke from all non-camera apps |
| Microphone access (per-app) | Settings → Privacy → Permission Manager → Microphone | Revoke from all non-communication apps |
| Contacts access (per-app) | Settings → Privacy → Permission Manager → Contacts | Grant only to messaging and email apps |
| Notification access | Settings → Apps → Special app access → Notification access | Revoke from all but notification manager apps |
| Usage & diagnostics | Settings → Privacy → Usage & diagnostics | Off |
| Web & App Activity (Google) | Settings → Google → Manage Account → Data & Privacy | Off (or set auto-delete to 3 months) |
| Google Location History (account) | Same as above → Location History | Off (or set auto-delete) |
| Install unknown apps | Settings → Apps → Special app access | Off (enable only temporarily for specific trusted sources) |
| Play Protect | Google Play → Profile → Play Protect | Scan apps with Play Protect → On |
| Personalise using app data | Settings → Privacy → Personalise using app data | Off |
| Samsung Customisation Service | Settings → Privacy → Samsung Privacy (Samsung only) | Off |
The combination of Advertising ID deletion, permission audit, and Google account activity disabling covers the most impactful Android privacy improvements — all free, all requiring only settings changes, and together significantly reducing the data collection profile across advertising, app tracking, and account-level behavioural monitoring. The 30-minute initial investment followed by a quarterly permission re-audit maintains the privacy posture as new apps are installed and updates change default settings.
Google account auto-delete — the set-and-forget privacy improvement
Managing the Google account data accumulated across all Android use at account.google.com/data-and-privacy is worth a separate visit after completing the device-level review. The most valuable configuration: setting auto-delete for activity data so it manages itself without manual clearing.
- Web & App Activity: account.google.com/data-and-privacy → Web & App Activity → Auto-delete → choose 3 months or 18 months. Activity older than the chosen period is automatically and continuously deleted from the Google account.
- Location History: same page → Location History → Auto-delete → choose 3 months or 18 months.
- YouTube History: same page → YouTube History → Auto-delete → choose 3 months or 18 months.
Auto-delete converts ongoing data minimisation from a manual task requiring periodic attention to an automatic process that maintains a rolling data retention window. After setting it once, you don’t need to remember to clear activity history — it clears itself. The 3-month window provides recent personalisation while limiting the historical record; the 18-month window provides better personalisation at the cost of a longer retention period. For users whose primary concern is advertising profiling: 3 months. For users who value personalisation from Google’s services: 18 months.
Inactive Account Manager
The Inactive Account Manager (account.google.com → Data & Privacy → More options → About you → Make a plan for your digital legacy → Inactive Account Manager) determines what happens to Google account data after a period of inactivity — typically 3–18 months without login.
This is one of the most overlooked Android privacy and data management settings. Options include: notifying designated contacts if the account becomes inactive, sharing data with specific people, or deleting the account data entirely after an inactivity period. For users who store significant personal data in Google services — photos, drive files, Gmail — configuring this ensures that data doesn’t persist indefinitely after death or incapacitation, or that trusted people can access it when needed.
It’s not a setting most users think about, but it determines the ultimate fate of years of accumulated data from Android device use. Setting it once provides clarity about what happens in edge cases, which is more planning than most people have done for their digital legacy. Our guide on iPhone Privacy Settings covers an adjacent issue.
Android privacy settings, configured thoughtfully, produce a phone that is substantially more private than the factory defaults allow. The manufacturer diversity that makes Android settings locations variable also makes Android more configurable than iOS in many ways — the same settings that require third-party tools on iOS are often directly accessible in Android’s built-in Settings app. That configurability, applied systematically, is the advantage Android offers for users willing to spend 30 minutes with the Privacy menu. See also macOS Security Settings for a related case.
