Android Security and Privacy Settings: What to Check

Android phones come with strong protection built in, but much of it is switched off, set loosely by default, or spread across Settings, the Play Store and your Google Account where few people ever look. This guide walks through the Android security and privacy settings that matter most, one by one: screen lock and your Google Account, app permissions and special app access, Google Play Protect and installing apps from outside the Play Store, theft protection and Find Hub, the privacy dashboard and camera and microphone indicators, Private Space, and Advanced Protection. For each it says where to find it, what it does and what to watch out for. It is written in plain English for anyone with an Android phone, and for the family member who sets phones up for everyone else. Menus differ between phone makers and Android versions, so if a setting is not exactly where we say, search for its name at the top of the Settings app. For the basic phone safety routine see the Securing Your Smartphone Guide; this page goes deeper on Android itself.

This is an independent guide from NHI Mgmt Group, based on Google's public documentation as of November 2026. It is not sponsored or reviewed by Google. Product features change, so confirm settings against Google's current documentation.

Key takeaways

Your screen lock and Google Account are the front door. Theft protection, Find Hub and encryption all depend on a screen lock, and your Google Account can reset almost everything else, so protect it with a passkey or two-step verification.
Review app permissions, not just apps. Android lets you allow location, camera and microphone only while an app is in use, or ask every time; very few apps need "All the time".
Keep Play Protect on and installing from unknown sources off. Play Protect scans apps at install and periodically, including apps from outside Play; most Android malware arrives through apps installed from links.
Turn on theft protection before the phone goes missing. Theft Detection Lock, Offline Device Lock and Identity Check only help if they were already on.
Advanced Protection is the strongest single switch. It turns on a bundle of protections at once and stops key ones, such as Play Protect, being turned off; it suits people at higher risk and anyone who wants the tightest settings.

How identity and access work on Android

Two things decide who can get into your phone and your data: the screen lock on the device, and the Google Account signed in to it. A thief who knows your PIN can often reach your Google Account; an attacker who takes over your Google Account can see your synced photos, passwords and location, and can erase the phone remotely.

Screen lock

Lock type	How strong	Notes
None or swipe	No protection	Theft protection, Remote Lock and Find Hub lock features need a screen lock, so they cannot work
Pattern	Weak	Easy to watch over a shoulder and smudge trails can give it away
PIN of 6 or more digits	Good	The US Federal Trade Commission recommends at least six digits; avoid birthdays and repeats
Alphanumeric password	Strongest	Slower to type; pair with fingerprint or face unlock for daily use
Fingerprint or face unlock	Convenience layer	Always sits on top of a PIN, pattern or password, which remains the fallback

Choosing the lock is under Settings, Security and privacy (on some phones Security, or Lock screen). Set the screen to lock automatically after a short timeout, and hide sensitive notification content on the lock screen so message previews, including one-time codes, are not readable on a locked phone.

Your Google Account

Security Checkup: Google's Security Checkup (Settings, Google, Manage your Google Account, Security) shows your recovery phone and email, sign-in methods, signed-in devices and third-party apps with account access. Google says it never asks for your password by email or text.
Passkeys and two-step verification: add a passkey and turn on 2-Step Verification. Prefer Google prompts or a security key over text message codes, and keep backup codes, which come in sets of ten single-use codes. See the Securing Your Apple ID and Google Account Guide.
Identity Check: on supported phones this theft protection setting requires your fingerprint or face, not just the PIN, for sensitive actions such as changing the screen lock, turning off Find Hub or changing Google Account settings when you are away from trusted places. A thief who watched you type your PIN still cannot take over the account from the phone.

Admin roles and privileged access: app permissions and special access

On a phone there is no administrator account in the usual sense. The powerful "roles" are the permissions you grant apps. Android splits them into install-time permissions that are granted automatically, runtime permissions such as location, camera and microphone that you are asked about, and special app access for the most powerful abilities, which are switched on in a separate settings page.

Runtime permissions

Open Settings, Apps, choose the app, then Permissions. To see every app that has a given permission, use the Permission manager (Settings, Security and privacy, Privacy, Permission manager, on Pixel phones).

Choice	What it means	Use it for
Allow all the time	The app can use the permission in the background (offered for location)	Only apps that genuinely need it, such as a family locator you chose deliberately
Allow only while using the app	Access only while the app is open on screen	Maps, ride hailing, camera apps
Ask every time / Only this time	A one-time grant; Android 11 added one-time permissions for location, camera and microphone	Apps you use rarely
Don't allow	No access; denying twice stops the app asking again	Anything that does not obviously need it

Approximate location: since Android 12, apps that ask for location can be given approximate rather than precise location. Weather and shopping apps rarely need precise.
Photos and videos: since Android 14, you can let an app see only the photos you select instead of your whole library.
Notifications: since Android 13, apps must ask before sending notifications. Refusing them for apps you do not need to hear from also cuts down on scam-style alerts.
Unused apps: Android removes runtime permissions from apps you have not used for a few months. Leave "Pause app activity if unused" on in each app's settings.

Special app access and powerful abilities

Settings, Apps, Special app access lists abilities that are not ordinary permissions. Check these carefully, because banking malware relies on them:

Install unknown apps: since Android 8, permission to install apps from outside the Play Store is given per app (for example to a browser or a messaging app), not phone-wide. Every entry here should normally say "Not allowed".
Accessibility: accessibility services can read the screen and tap on your behalf. Only genuine accessibility tools you installed on purpose should be turned on. A request from a newly installed app to turn on accessibility is a classic sign of a banking trojan. See the Android Banking Trojans Guide.
Display over other apps: lets an app draw on top of others, which overlays use to fake login screens.
Device admin apps: lets an app lock or wipe the phone. Usually only Find Hub and, on work phones, your employer's management app.
Notification access: lets an app read every notification, including one-time codes.

Integrations, apps and connected accounts

Google Play Protect

Play Protect checks apps when you install them from the Play Store and scans the phone periodically, including apps from other sources. It can warn you, disable a harmful app or remove it automatically, and send privacy alerts about apps that access personal information. Check it in the Play Store app: tap your profile icon, then Play Protect, then Settings, and confirm "Scan apps with Play Protect" is on. Google says it is on by default and recommends keeping it on. "Improve harmful app detection" sends unknown apps to Google for a code-level check.

Apps from outside the Play Store

Installing an APK file from a link, text message or website ("sideloading") skips the Play Store's checks. Scammers send links to fake delivery, banking or parcel-tracking apps for exactly this reason. Install from the Play Store or your phone maker's own store, keep "Install unknown apps" off for every app, and be suspicious of anyone who asks you to change it.

Connected apps and accounts

Third-party access: apps and websites you signed in to with Google, or gave access to Gmail, Drive or Contacts, are listed under your Google Account's Security page. Remove those you no longer use.
Chrome: Chrome's Safety Check looks for compromised, reused and weak saved passwords and reviews site permissions. Site settings (Chrome, Settings, Privacy and security, Site settings) control which websites can use your location, camera, microphone and notifications; remove notification permission from any site that sends spam alerts.

Private Space

From Android 15, Private Space is a separate, lockable profile for apps you want to keep out of sight, with its own lock. It is a privacy feature: Google notes that apps in Private Space bypass the phone's VPN, and the space can still be detected in some ways. Use it to keep apps away from people who borrow your phone, not as protection against malware. See the Android Private Space guide.

Logging and detection: seeing what your phone is doing

Privacy dashboard: since Android 12, the privacy dashboard (search Settings for "Privacy dashboard") shows which apps used location, camera and microphone and when. Check it for apps you did not expect.
Camera and microphone indicators: since Android 12, a green dot or icon appears at the top of the screen whenever an app uses the camera or microphone. Settings, Security and privacy, Privacy, Privacy controls has Camera access and Microphone access switches that turn them off for every app at once.
Play Protect alerts: act on them. If Play Protect has disabled an app, uninstall it.
Google Account alerts: Google sends a security alert when a new device signs in. Treat an unexpected one as a reason to check the account immediately.
Intrusion Logging: with Advanced Protection on, Android can keep end-to-end encrypted logs in your Google Account that help an investigator if the phone is ever compromised.

Signs worth investigating: new apps you did not install, an app asking for accessibility or device admin after install, the camera or microphone indicator appearing when no app is open, sudden battery drain or data use, or Google security alerts you did not trigger. The Mobile Spyware Response Playbook covers what to do next.

Theft protection and Find Hub

Theft protection lives under Settings, Google, All services, Theft protection. It needs a screen lock, some features need Android 10 or later and others Android 15 or later, and support varies by phone model (Google says it is not available on Android Go phones and tablets).

Feature	What it does	Things to know
Theft Detection Lock	Uses motion sensors, Wi-Fi and Bluetooth to spot a snatch-and-run and locks the screen	Does nothing if the screen is already locked; greyed out on phone models that do not offer it
Offline Device Lock	Locks the screen if the phone is taken offline while unlocked	Can trigger up to twice in 24 hours
Remote Lock	Lock the phone from android.com/lock using just your phone number	Needs an active SIM, Find Hub on and an internet connection; undone only with your screen lock
Identity Check	Requires biometrics for sensitive changes outside trusted places	Not on all devices; needs biometrics and trusted places set up
Failed Authentication Lock	Locks the phone after repeated failed unlock attempts	On by default

Find Hub (formerly Find My Device) lets you locate the phone at google.com/android/find, play a sound, mark it as lost or erase it. It only works if Find Hub was on, the phone has power and a connection, and you are signed in to your Google Account. Erasing is permanent, and afterwards the phone can no longer be located. See the Stolen or Lost Phone guide for what to do in what order.

Hardening baseline

Updates

Check Settings, Security and privacy (or System), for both the Android security update and the Google Play system update, and install any that are waiting. Before buying a phone, check how many years of security updates the maker promises; once updates stop, known holes stay open.

Advanced Protection

Advanced Protection (Settings, Security and privacy, Other settings, Advanced Protection, or Settings, Google, All services, Personal and device safety) turns on Device protection, a group of protections enabled in one go. It needs a screen lock and may need a reboot. Google lists, among others: Play Protect kept on and unable to be turned off; installs from unknown sources blocked; accessibility services limited to verified tools; Memory Tagging Extension for supported apps; Theft Detection Lock, Offline Device Lock and Failed Authentication Lock; Inactivity Reboot after 72 hours locked; USB Protection while locked; 2G connections blocked on supported devices; spam, scam and unknown-link warnings in Google Messages; Safe Browsing and HTTPS enforcement in Chrome, with Chrome's JavaScript optimiser and WebGPU turned off; and optional Intrusion Logging. Some of these change how the phone behaves (blocking 2G can mean no signal where only 2G exists, and Memory Tagging may slow the phone), so turn it on, use the phone for a week and note what changes. Google presents it as an option for anyone who wants strong security, and it is especially worth it for people at higher risk such as journalists, campaigners and public figures. Account Protection for your Google Account is a separate enrolment on the same page. See the Android Advanced Protection guide.

Baseline settings

Setting	Where	Recommended
Screen lock	Settings, Security and privacy	PIN of 6+ digits or password, plus fingerprint or face
Lock screen notifications	Settings, Notifications	Hide sensitive content
Theft protection	Settings, Google, All services, Theft protection	Theft Detection Lock, Offline Device Lock, Remote Lock and Identity Check on
Find Hub	Settings, Google, All services, Find Hub	On
Play Protect	Play Store, profile, Play Protect, Settings	Scan apps on
Install unknown apps	Settings, Apps, Special app access	Not allowed for every app
Location, camera, microphone	Permission manager	Only while using, or ask every time; approximate location where possible
Accessibility and notification access	Settings, Accessibility; Special app access	Only tools you deliberately installed
Updates	Settings, Security and privacy, or System	Install security and Google Play system updates promptly
Google Account	Manage your Google Account, Security	Passkey or 2-Step Verification, recovery details current
Advanced Protection	Settings, Security and privacy, Other settings	On for higher-risk users; consider for everyone

For a family, set these once on each phone and repeat the check every few months. For children's phones, Google Family Link adds app approvals and screen time limits; see the Parental Controls Guide. Work phones managed by an employer may lock some of these settings; that is covered in the Android Enterprise Security Guide.

Common misconfigurations

No screen lock, or a pattern: without a lock none of the theft features work, and patterns are easy to observe.
"Install unknown apps" left on for a browser or messaging app: often switched on once to install something and never turned off, which leaves the door open for the next malicious link.
Accessibility granted to an app that is not an accessibility tool: the single most important thing to check if you think something is wrong.
Location set to "All the time" for many apps: builds a detailed record of your movements for no benefit.
Theft protection never turned on: Theft Detection Lock and Identity Check are off on many phones until you enable them, and they cannot be turned on after the phone is gone.
Running a phone past its last security update: the phone keeps working, but newly found flaws are never fixed.

Practitioner checklist

Set a PIN of at least six digits or a password, add fingerprint or face unlock, and hide sensitive content on the lock screen.
Run Google Security Checkup: add a passkey, turn on 2-Step Verification, update recovery details and remove unused third-party access.
Turn on Theft Detection Lock, Offline Device Lock, Remote Lock and Identity Check, and confirm Find Hub is on.
Confirm "Scan apps with Play Protect" is on and every entry under Install unknown apps says "Not allowed".
In Permission manager, cut location, camera and microphone to "only while using" or "ask every time", and use approximate location where precise is not needed.
Review Accessibility, Device admin apps, Display over other apps and Notification access; remove anything you do not recognise.
Look at the privacy dashboard for unexpected camera, microphone or location use.
Install waiting security and Google Play system updates, and note when your phone's updates end.
Consider turning on Advanced Protection, and turn it on if you are at higher risk.

Android Security and Privacy Settings Guide: Every Setting Worth Checking on Your Phone