Android Privacy: 9 Settings to Change

Your phone is on the table between us, and the loan app you installed still has Contacts switched on. You found out the day it messaged your address book before it messaged you. I ran this sweep on my own my phone this week, and I am dictating it while you do yours, tap by tap.

Ten minutes. No money. No data burned.

Ads: delete the advertising ID

Every Android phone carries an advertising ID. Apps use it to stitch what you do across apps into one profile.

1. Delete the advertising ID

Who it is for: you, if the same loan ad follows you from Instagram into your banking app.

What it does: since late 2021 the control is Delete advertising ID. Google swapped it in during the Android 12 era, and apps now see zeros. EFF's Android 12 guide, published 11 May 2022, names the control, read on 12 November 2026.

What it costs: one minute. Nothing breaks, and you can delete again any time.

One trap. A September 2025 privacyinternational.org guide still printed "Opt out of Ads Personalisation", read on 30 September 2026. That screenshot is old, and the page itself is gone now. The honesty note below has the story.

The route: Settings, search "advertising ID", tap Delete, confirm. The documented route is Settings, Privacy, Ads, Delete advertising ID. HiOS may file it under Google.

After the delete, apps see zeros.

Google saves: pause the account histories

Your Google account keeps two diaries. Web & App Activity logs searches, commands and sites, lives account-side. Location History logs where you go; its entries now live on your phone.

2. Pause Web & App Activity

Who it is for: you, if Google does not need a running list of everything you search and say.

What it does: at myaccount.google.com, open Data & privacy, then History settings. PCMag's June 2026 explainer, read on 12 November 2026, draws the distinction that matters. Off stops saving. Delete wipes what is stored. They are two different taps.

What it costs: nothing, and Settings search reaches the same screens.

Set auto-delete to 3, 18 or 36 months and Google wipes older entries itself. YouTube history can be wiped alone.

Timeline: the history that moved house

The 2018 and 2021 guides describe a cloud Timeline. That screen is gone.

3. Pause Timeline

Who it is for: you, if you want the map memory to stop, without Maps forgetting where you are standing.

What it does: since 1 December 2024, Timeline lives on the device. The Verge and The Hacker News reported the move in June 2024. A rolling 90 days migrated to the first signed-in device. Older cloud data was deleted.

Controls now sit inside Maps. Tap your profile picture, then Your Timeline. Pause, export, or delete from there.

What it costs: nothing. Proton's July 2026 guide draws the line cleanly. Pausing stops the written diary, not location services.

One more thing. Pausing leaves the old diary sitting on the phone. Delete device-side from the same Maps screen.

The green dot: read it, don't remove it

4. Read the green dot

Who it is for: you, if a green dot just appeared at the top of your screen and you froze.

What it does: a green dot means the camera or mic is live. Tap it, and Android names the app. Privacy Dashboard lists every app that touched camera, mic or location, with times. Search "privacy dashboard". Android Police and Samsung's Africa support site walk it.

What it costs: two seconds of looking. No switch removes the dot; it is non-disableable by design. Killing camera access to hide it is security self-harm.

Two things people confuse here. Orange is Apple's microphone colour. Green is both sensors on Android. An Android clip teaching "orange means mic" answers the wrong OS.

If the app on the dot surprises you, deny its permission.

Permissions: the while-in-use sweep

Android splits permissions into levels, and the target is While using the app. Ask every time fits the mic. Allow once covers one-offs. Never means deny.

5. Sweep the permissions

Who it is for: you, if you tap Allow without reading, like the rest of us used to.

What it does: search "permission manager". Work this table the way I just worked mine:

Permission	Keep it at	Who gets it
Location	While using; approximate if offered	Maps, cabs, delivery
Camera	While using the app	Camera only
Microphone	While using, or Ask every time	Calls, recorder, voice
Contacts	Deny	Phone and mail
SMS	Deny	Bank apps
Accessibility	Deny	Assistive tools only
Display over other apps	Deny	Nobody honest needs it
Install unknown apps	Deny	Play Store only

What it costs: five minutes and a little nerve. Some apps will ask again. Some will behave.

Pick approximate unless the app truly navigates. Auto-reset strips unused-app permissions; search "unused apps".

BGR's May 2026 listicle of never-grants names accessibility, unknown sources, overlays and contacts. Ask for any of those and you already know the app.

ZDNet's June 2026 guide recommends a review every few months. Contacts plus SMS plus accessibility is the scammer's profile, the same logic as our malware warning signs.

Private DNS: one quiet line on the network

Private DNS encrypts your lookups, so café Wi-Fi cannot see which sites you dial. Free, and it installs nothing.

6. Set the private DNS line

Who it is for: you, if the café's Wi-Fi should not get a seat at your table.

What it does: search "private dns", choose Private DNS provider hostname, enter dns.adguard-dns.com. AdGuard's public DNS doc prints the steps and hosts. Its words for the default server: AdGuard DNS will block ads and trackers.

What it costs: nothing. Know the limits. It is not a VPN, it helps nothing inside apps that ignore DNS, and it does nothing for what reaches the sites. Chrome's menu carries a Safety Check. Blocker picks are a separate comparison.

Theft: the five-minute lock

The theft trio arrived in October 2024. Search "theft protection"; the three toggles sit on one screen.

Feature	What it does	Where
Theft Detection Lock	Sensors and AI spot a snatch, locks screen	Theft menu
Offline Device Lock	Locks the phone when offline	Theft menu
Remote Lock	Locks from the web with your number	Theft menu

7. Theft Detection Lock

Who it is for: you, if one bad bus ride could make your phone someone else's.

What it does: sensors and AI spot a snatch and lock the screen before the thief finishes the turn.

What it costs: one toggle and nothing else.

8. Offline Device Lock

Who it is for: you, if the thief who grabs your phone will kill the network first.

What it does: locks the phone once it goes offline, which is the first thing every snatcher tries.

What it costs: one toggle.

9. Remote Lock

Who it is for: you, once the phone is gone and your heart is going.

What it does: locks the phone from the web with your number.

What it costs: a browser and your number.

Computerworld's December 2025 run-through documents the theft toggles inside Security & Privacy, under Device unlock. Find Hub, formerly Find My Device, should be on by default, Computerworld says. Google's May 2026 security post adds Mark-as-lost locks on Android 17.

Identity Check asks for a biometric for your passwords and primary PIN, only away from trusted places, Computerworld says. It guards the thief who has your PIN.

Computerworld also flags Android 16's Advanced Protection: one toggle for Google's strongest scam and fraud defences. A lot, not all nine. Do both.

Google switches on Theft Detection Lock and Remote Lock by default on new Android 17 devices. It does the same on phones freshly reset or upgraded to Android 17. For Android 10 and newer, Google names Argentina, Chile, Colombia, Mexico, Peru and the UK. Nigeria is not named. Flip them yourself.

Nigeria: the loan apps and your contacts

In May 2023 Google barred Play Store loan apps from your contacts and photos. The Federal Government pushed the policy. Voice of Nigeria reported it on 10 April 2023, starting 31 May 2023. The store door holds. Installed apps kept what you gave them.

Contacts already granted? Revoke, don't uninstall. Search "permission manager", open Contacts, find the app, tap Don't allow. SMS, camera and accessibility the same way. Arm auto-reset under "unused apps".

• Installed, contacts granted? Revoke Contacts, then SMS and accessibility. Where: Permission manager.
• Harassing you after a loan? Report to the FCCPC and warn your contacts. Where: FCCPC complaint channels.
• Unused loan app? Let auto-reset strip its permissions. Where: Unused apps setting.
• Brand-new loan app? Play Store only; read permissions first. Where: Play Store listing.

The 2023 ban stopped new access, not the grants already sitting on your phone. The revoke is the half most guides skip.

metronub's June 2026 guide runs the response in order. Revoke, report to the FCCPC, warn the people it messaged. Give the FCCPC the lender's name and screenshots. The FCCPC is the Federal Competition and Consumer Protection Commission. It is faster than arguing with a loan app at midnight.

BlueCredit's April 2026 explainer shows what lenders can and cannot reach. A compliant lender verifies you, it does not hoover your address book.

The antivirus question for these apps is its own piece.

What I could not verify on the house phone

Honesty time. On my phone in my hand, no menu was opened and no screenshot exists. The paths print as Google documents them, as a vendor documents them, or as a search string you type into Settings. The search approach stands until a full sweep with screenshots runs on the house phone.

HiOS moves labels between builds. Search the words, not the path: "advertising ID", "permission manager", "private dns", "theft protection".

The theft toggles are version-gated. Auto-enable varies by version and market. Identity Check varies by build. Re-verify anything that differs after updates.

PCMag answers a bare request with a 403 bot check; it loads in a real browser. The privacyinternational.org page that printed the retired toggle answers page-not-found now. What it printed on 30 September 2026 is quoted above.

The bottom line

Delete the ad ID, pause the histories, sweep permissions, read the dot, arm the theft lock, revoke the loan apps. Ten minutes, nine settings, nothing spent. The faults live in our Android problems hub.