Your phone is a tracking device that also makes calls — that's the honest framing. But "tracking" covers a wide spectrum, from your precise GPS location being sold to data brokers, to first-party analytics that improve an app you genuinely use. Not all tracking is equally harmful, and stopping all of it is neither practical nor always desirable. This guide focuses on the high-impact changes that meaningfully reduce your data exposure without making your phone unusable.
What changed in 2026
- iOS 18 introduced "Contact Access Limited" — apps can now request access to specific contacts rather than your entire contacts list, a major privacy improvement.
- Android 15 added "Health Connect" as a unified health data permission layer, meaning fitness apps no longer need direct access to all health sensors — they access a sandboxed data store.
- Google's Privacy Sandbox replaced third-party cookies on Android Chrome, changing (but not eliminating) ad tracking in the browser.
- App tracking transparency (ATT) on iOS became the de facto standard — apps must request permission to track you across other companies' apps, and ~70% of users deny it.
- Data brokers became addressable — several states and the EU now require brokers to honor deletion requests; automated services exist to send these at scale.
The tracking landscape (what's actually happening)
| Tracking type |
Who does it |
What they get |
How to limit |
| Location history |
Apps, OS, carrier |
Where you go, dwell time |
Revoke location permissions; use "While using" not "Always" |
| Advertising ID |
Ad networks |
Cross-app behavior profile |
Reset or opt out in settings |
| Carrier data |
Your ISP/carrier |
All sites, DNS queries |
VPN + DNS-over-HTTPS |
| App analytics |
Most apps |
Usage patterns, crashes |
Opt out in app settings where available |
| Browser tracking |
Websites, Google |
Browsing history |
DNS blocking, browser privacy settings |
| Wi-Fi probe requests |
Anyone nearby |
Your MAC address, presence |
iOS/Android random MAC (on by default since iOS 14/Android 10) |
iOS privacy settings (step by step)
Location:
Settings → Privacy & Security → Location Services → review every app. Set to "While Using" for navigation apps; "Never" for anything that doesn't need location; remove "Always" from all but essential apps (Find My, health apps if desired).
Advertising ID:
Settings → Privacy & Security → Tracking → off (deny all tracking requests)
Settings → Privacy & Security → Apple Advertising → Personalized Ads: off
App permissions audit:
Settings → Privacy & Security → review each category (Microphone, Camera, Contacts, Photos). Revoke anything you don't actively use.
Safari:
Settings → Safari → Privacy & Security: enable "Prevent Cross-Site Tracking," "Hide IP Address" (set to "Trackers and Websites" with iCloud Private Relay if you have iCloud+).
Private DNS:
Settings → Wi-Fi → tap your network → Configure DNS → Manual → add 1.1.1.1 (Cloudflare) or 9.9.9.9 (Quad9 — blocks malicious domains). Repeat for cellular in Settings → General → VPN & Device Management.
Android privacy settings (step by step)
Advertising ID:
Settings → Privacy → Ads → Delete advertising ID (Android 12+) or opt out. This prevents cross-app tracking based on a persistent identifier.
Location:
Settings → Location → App permissions → review each app. Set to "Only while using" or "Ask every time"; remove "All the time" except for essential apps.
Permissions manager:
Settings → Privacy → Permission manager → review Microphone, Camera, Contacts, Body Sensors — revoke unused permissions.
Private DNS:
Settings → Network & Internet → Private DNS → set to "Private DNS provider hostname" → enter dns.quad9.net or 1dot1dot1dot1.cloudflare-dns.com.
Google data collection:
Settings → Google → Manage your Google Account → Data & Privacy → turn off "Web & App Activity," "Location History," "YouTube History" if you don't use personalization.
VPNs: what they actually do (and don't do)
A VPN encrypts traffic between your phone and the VPN server, hiding it from your carrier and public Wi-Fi networks. It does not:
- Hide your activity from the apps themselves
- Protect you from Apple or Google collecting first-party data
- Stop trackers embedded in websites (use browser tracking protection for that)
When a VPN is genuinely useful:
- Public Wi-Fi (coffee shops, airports, hotels)
- Hiding browsing from your ISP
- Accessing region-locked content
Choosing a VPN: Look for a no-logs policy that has been independently audited (Mullvad, ProtonVPN are well-regarded). Free VPNs are often monetized by selling the data you're trying to protect.
Common mistakes
Thinking airplane mode stops all tracking. Airplane mode prevents cellular and network-based tracking but not local sensors (gyroscope, accelerometer, Bluetooth when re-enabled). Apps can store location queries to upload later.
Trusting "private browsing" mode to hide location. Incognito/private mode doesn't hide your IP address, carrier data, or device fingerprint from websites. It only prevents local browser history storage.
Installing every "privacy" or "security" app you find. Many Android "security apps" are themselves data collectors. Stick to the built-in OS privacy controls and well-reviewed tools from established companies.
Revoking location from maps apps. Navigation apps need your precise location. Revoke location from weather apps, games, social apps — not maps.
What to skip
- Hardware modifications (SIM card removal, Faraday pouches for daily use) — disproportionate for most threat models and break legitimate functionality.
- Deactivating your Google or Apple account to "stop tracking" — you lose meaningful functionality; address the specific permissions instead.
- "Burner phone" strategies for everyday tracking concerns — appropriate for very specific threat models, not practical advice for the average user concerned about ad targeting.
FAQ
Does iOS track less than Android?
iOS has stronger defaults and a more restrictive app review process. Android offers more granular controls in settings but varies by manufacturer skin. Both track significantly less than their 2020 versions with default privacy settings properly configured.
Can apps use the microphone to listen to conversations for ads?
In practice, this requires explicit microphone permission and active use. The more mundane explanation for "eerily relevant ads" is location data, browsing history, and demographic modeling — which is more accurate than audio listening at scale. Revoke microphone from apps that have no voice feature.
Is a VPN worth paying for?
If you regularly use public Wi-Fi or your ISP data practices concern you: yes, ~$5–$10/month from a reputable provider is reasonable. For general app tracking, the OS privacy settings above are more impactful than a VPN.
What about my smart home devices tracking me?
Separate concern — smart speakers, cameras, and IoT devices have their own data practices. Review device privacy settings, consider putting them on a guest Wi-Fi network isolated from your main devices, and regularly review connected account permissions.
Where to go next