The iPhone's privacy defaults are better than most, but they still lean toward convenience. Out of the box, apps are allowed to ask permission to track you across other companies' apps, notifications spell out private messages on the lock screen, every photo you take records exactly where you were standing, and diagnostic data flows quietly to servers in the background. None of this is hidden. It is all opt-out, and most people never opt out.
This guide walks through the settings that make a real difference, in the order we would change them. Everything lives in the Settings app, takes a few taps, and can be reversed if a change does not suit you. Nothing here breaks an app or a feature you rely on.
One note on paths: on recent versions of iOS, individual apps are listed under Settings, then Apps. On older versions, each app sits at the bottom of the main Settings screen. The toggles are the same either way.
Refuse app tracking once, for every app
Every iPhone carries an advertising identifier, a random ID that ad companies use to connect what you do in one app with what you do in another. It is how a product you browsed in one app follows you into the ad banners of another. Apps must ask before they can use it, which is why the tracking pop-ups keep appearing. You can answer once, for everything.
Go to Settings, then Privacy & Security, then Tracking, and turn off Allow Apps to Request to Track. From then on, every request is refused automatically and the pop-ups stop appearing. Apps work exactly as before; they simply cannot stitch your identity together across companies.
While you are in Privacy & Security, scroll down to Apple Advertising and turn off Personalized Ads. This covers the ads Apple itself shows in the App Store and its other built-in apps. You will see the same number of ads either way.
Tighten Location Services app by app
Do not switch Location Services off entirely. Maps, ride hailing, and Find My all depend on it, and a lost phone with location disabled is simply lost. The goal is control, one app at a time.
Go to Settings, then Privacy & Security, then Location Services. You will see every app that has ever asked where you are and the answer you gave. For each app, pick the weakest option that still lets it do its job:
- Never for anything with no obvious reason to know your location. A photo editor or a puzzle game does not need it.
- Ask Next Time Or When I Share for apps that use location only occasionally.
- While Using the App for navigation and anything that genuinely guides you somewhere. Almost nothing deserves Always.
Inside each app's location page there is also a Precise Location toggle. With it off, the app receives your approximate area instead of your exact position. Weather, news, and shopping apps work perfectly well on approximate.
Finally, scroll to the bottom of Location Services, open System Services, then Significant Locations. This is a running log of places your phone has decided matter to you, usually including your home and workplace. You can clear the history and turn the feature off. The main cost is slightly less tailored traffic predictions.
Audit what apps can already reach
Permission requests arrive one at a time, so it is easy to lose track of what you have agreed to. The Privacy & Security screen shows the full picture by category. Tap Camera, Microphone, Photos, and Contacts in turn, and revoke access from any app whose reason for having it you cannot state in one sentence.
Photos deserves special attention. Instead of full library access, most apps can be set to Limited Access, which means they see only the specific pictures you hand them. A messaging app does not need your entire camera roll to send one photo. For a deeper walkthrough of which permissions matter and why, see our guide to app permissions on your phone.
Then turn on the receipts. At the bottom of Privacy & Security, open App Privacy Report and enable it. After a few days of normal use, it shows which apps used your camera, microphone, and location, and which internet domains each app contacted. An app that touches the microphone at odd hours, or a flashlight utility talking to a dozen ad servers, tends to stand out quickly.
Make your lock screen say less
Left on a desk, a default iPhone will happily display the opening lines of your texts and emails to anyone who glances at it. Go to Settings, then Notifications, then Show Previews, and choose the option that hides previews until Face ID or your passcode confirms it is you. Notifications still arrive; the contents stay private until the phone knows who is holding it.
Next, go to Settings, then Face ID & Passcode, enter your passcode, and scroll to the Allow Access When Locked section. We recommend turning off Control Center and USB Accessories, and considering the same for Reply with Message. Control Center is the one that matters most: if it is reachable from the lock screen, a thief can flip your phone into Airplane Mode before you have any chance to trace it.
On the same screen, turn on Stolen Device Protection. When your phone is away from familiar places like home or work, it requires Face ID, with no passcode fallback, before anyone can change your Apple account password or read saved passwords. It exists to blunt a specific crime: someone watches you type your passcode in a bar, then takes the phone.
While you are there, upgrade a short passcode. Choose Change Passcode, tap Passcode Options, and pick six digits or an alphanumeric code. Face ID handles daily use, so a longer code costs little.
Stop email and web trackers from reporting back
Much of the marketing email you receive contains a tiny invisible image that reports back the moment you open the message, along with your rough location. To shut that down, find Mail in your app list in Settings, choose Privacy Protection, and turn on Protect Mail Activity. Remote content then loads through relay servers, so senders cannot see your IP address or learn when you read their message.
In the settings for Safari, the built-in browser, confirm that Prevent Cross-Site Tracking and Fraudulent Website Warning are on, and set Hide IP Address to apply to trackers. Together these make it much harder for ad networks to follow you from site to site.
Wi-Fi has its own small leak. Open Settings, then Wi-Fi, tap the information button beside your network's name, and check that Private Wi-Fi Address and Limit IP Address Tracking are both on. The private address means your phone presents a different hardware identifier to each network, so stores and public hotspots cannot recognize your device every time it returns.
Plug the quieter leaks
A few smaller settings round out the job:
- Photo location data. Every photo stores the exact spot where it was taken. When you share a photo, tap Options at the top of the share sheet and turn off Location. A picture of your living room posted online does not need to carry your street address inside it.
- Analytics. In Privacy & Security, open Analytics & Improvements and turn off Share iPhone Analytics. This is diagnostic data about how you use the device. Apple anonymizes it, but data that never leaves your phone is safer than data that does.
- Journaling Suggestions. If it appears in your Privacy & Security list, review it. It assembles your outings and activity into summaries that other installed apps can request.
Protect the account behind the phone
Every setting above sits behind your Apple account, so the account deserves the same care as the device. Tap your name at the top of Settings, then Sign-In & Security, and confirm that two-factor authentication is on. Our guide to two-factor authentication explains why that one control matters so much. The password on that account should be long, unique, and not reused anywhere else, and you can run the email address behind it through our free email breach checker to see whether it already circulates in known leaks.
Then run Safety Check, found in Privacy & Security. It reviews, in one place, every person you share your location and photos with, every app with meaningful permissions, and every device signed into your account, and it lets you cut any of them off. It was built for difficult situations, such as leaving an abusive relationship, but it doubles as the best periodic audit the phone offers.
A fifteen-minute first pass
If you only have time for one session with the Settings app, do these in order. Each takes about a minute:
- Turn off Allow Apps to Request to Track under Privacy & Security, then Tracking.
- Turn off Personalized Ads under Apple Advertising.
- Set every app in Location Services to Never or While Using the App, and switch off Precise Location where exact position is not needed.
- Set Show Previews so notification contents appear only after Face ID or your passcode confirms it is you.
- Turn off Control Center and USB Accessories under Allow Access When Locked, and enable Stolen Device Protection.
- Turn on Protect Mail Activity in the Mail settings.
- Enable App Privacy Report, then check it again in a week to see which apps earned your trust and which did not.
