How to Secure an Android Phone: Privacy and Security Settings That Still Matter

Android ships with stronger defaults than it did a few years ago — storage encryption is on by default, permissions are tighter, and Google accounts lean harder on 2-Step Verification. The gaps that still get people are boring: a weak lock screen, Install unknown apps left on, Play Protect ignored, and apps that keep microphone or location access forever.

These are the privacy and security settings that still matter on Android 12 through 14+ (Pixel and most OEM skins). Menu names drift by manufacturer; use Settings search when a path looks different.

Lock screen and biometrics

Swipe-to-unlock is not security. Use a PIN (prefer six digits or more), a strong password, or a pattern you do not draw in public — then add fingerprint or face unlock for convenience, not as the only factor.

1. Open Settings → Security & privacy (or Lock screen / Biometrics and security on Samsung).
2. Set Screen lock to PIN, password, or pattern.
3. Enroll fingerprint/face under the biometrics section.
4. Shorten Screen timeout and turn on lock after screen off if your skin offers it.

Skip showing sensitive notification content on the lock screen for banking and mail apps if you regularly leave the phone face-up on a desk.

Harden the Google account behind the phone

Compromising the Google account often means owning the phone’s backups, Find My Device, and Play purchases. Turn on 2-Step Verification, prefer an authenticator app or passkey over SMS when you can, and keep recovery email/phone current.

1. On the phone or a browser, open myaccount.google.com/security.
2. Run Security Checkup; remove old devices and unknown third-party access.
3. Enable 2-Step Verification; add a backup method you control.
4. Review Your devices and sign out anything you do not recognize.

If you still use SMS codes, that is better than nothing — but SIM-swap risk is real for high-value accounts. Move those to an authenticator or passkey when the provider allows it. For email-specific hygiene (app passwords, phishing), see how to protect email from hackers.

Privacy dashboard and Permission manager

Android 12+ shows which apps recently used location, camera, and microphone. That timeline is the fastest way to catch a flashlight app that should never see your mic.

1. Open Settings → Security & privacy → Privacy (or Settings → Privacy).
2. Open Privacy dashboard and tap a permission to see recent access.
3. Open Permission manager and audit Location, Camera, Microphone, Contacts, and SMS.
4. Set unused apps to Don’t allow or Ask every time / Allow only while using the app.

Also check Settings → Apps → Special app access for Display over other apps, Accessibility, Device admin, and Usage access — malware loves those.

Play Protect and Install unknown apps

Keep Google Play Protect scanning on (Play Store → profile → Play Protect). Prefer Play for installs. When you must sideload, allow only the specific source and turn it off afterward — details in our APK install guide.

Avoid “cleaner,” “battery booster,” and random antivirus APKs from search ads. Stock Android already handles most of that job; third-party cleaners are a common malware vector.

Find My Device and theft settings

1. Open Settings → Security & privacy → Find My Device (path varies).
2. Turn Use Find My Device on; keep Location available when you need remote ring/lock/erase.
3. On newer Pixels and many 2024–2026 OEM builds, enable theft-related options such as Theft Detection Lock / remote lock features when offered.
4. Practice once: from another device, open android.com/find and confirm your phone appears.

Find My Device needs the phone powered on, signed into that Google account, and able to reach the network. It is not magic after a full factory wipe by a thief — but remote lock and locate still matter in the first hours.

Private DNS, updates, and notifications

Private DNS encrypts DNS lookups on networks that support it. Leave it on Automatic, or set a provider hostname such as dns.google or one.one.one.one under Settings → Network & internet → Private DNS.

Install system and security updates when they appear (Settings → System → System update or the OEM equivalent). App updates through Play matter too — abandoned apps with old WebViews are a quiet risk.

On public Wi‑Fi, avoid sensitive logins without a trusted VPN if your threat model includes hostile networks. HTTPS helps; it does not fix a malicious captive portal that tricks you into installing a profile or APK.

Quick monthly checklist

• Security Checkup on the Google account; remove stale devices.
• Privacy dashboard skim for camera/mic/location surprises.
• Confirm Install unknown apps is off for browsers and file managers.
• Apply pending OS/security updates; uninstall apps you no longer open.
• Verify Find My Device still lists the phone.

FAQs