You have an ordinary Android phone – Samsung, Xiaomi, Pixel & co. – and don't want to (or can't) switch to GrapheneOS? Understandable. With the right settings you can squeeze a lot more privacy out of even a factory-shipped Android. Here's the compact checklist to work through – sorted by area.
The biggest source of data isn't the phone, it's your Google account. This is where most of the effort pays off – and much of it applies across all your devices. Work through it at your own pace.
Settings → Google → Data & privacy (or myactivity.google.com).Data & privacy → Personalized ads).Settings → Accounts).Every app gets only what it really needs – nothing more. Thankfully, Android makes this fairly convenient these days.
Settings → Security & privacy → Privacy → Permission manager. Check camera, microphone, location, contacts & co. for each app.Two quick toggles with a big impact against cross-app tracking.
Settings → Security & privacy → Privacy → Ads → "Delete advertising ID". After that, apps no longer get a device-wide tracking identifier.Settings → Google → … → Usage & diagnostics).You don't have to sacrifice location entirely – usually it's enough to decide deliberately.
Location → Location services) – prevents location estimation via radio networks in the background.Encrypted DNS is the simplest lever with the biggest effect – it blocks ads and trackers system-wide, across all apps.
Settings → Network & internet → Private DNS → "Hostname" → dnsforge.de. Details & variants on the Recommendations page.The foundation: a well-secured, up-to-date device that holds up against unfamiliar hands.
Besides Google, the manufacturer collects data too. Depending on the brand there are dedicated toggles – here are the most important ones.
Where your apps come from is part of what determines your privacy.
You can wall off sensitive or "nosy" apps from the rest – the strongest tool on stock Android.
A separately encrypted, PIN-protected space inside the phone. The apps installed there disappear from the app list, "Recent apps," notifications and settings as soon as the space is locked – its very existence can even be hidden. Ideal for banking, health or Google-heavy apps.
Settings → Security & privacy → Private Space (devices with Android 15 and enough RAM).
With apps like Shelter or Insular (via the Android work profile) you can lock apps into a separate container – including a clone of your own and "freezing" them when not in use. Good for fencing in Google or social apps.
For people with a particular need for protection, Android bundles its strongest features in one place.
A device-wide switch that enforces several protective features: always-on malware scanning, blocking sideloading, protection against insecure networks/links, theft detection, offline device lock and encrypted "Intrusion Logging" (rolling out since the Android update at the end of 2025).
Settings → Security & privacy → Advanced Protection → enable device protection.
Google's account-based high-security program: sign in with a passkey or hardware security key (e.g. YubiKey) – a physical key has no longer been mandatory since 2024 – plus stricter phishing and app checks. Worthwhile for journalists, activists and exposed individuals.
Hardening stock Android is a big, worthwhile step – but it's no substitute for a consistently de-Googled, hardened system.