Key Takeaways
Why Default Settings Are a Privacy Problem
When you set up a new phone, install an app, or open a browser for the first time, the default configuration is rarely optimized for your privacy. Manufacturers, developers, and platforms tend to ship products with settings that maximize data collection, personalization features, and sharing — because that data has value to them. For everyday consumers, this means that doing nothing is actually an active choice that exposes more than most people intend.
You don't need a cybersecurity background to address this. The settings listed below are accessible to anyone and don't require disabling features you actually use. Think of it as a 30-minute audit that pays ongoing dividends. For a broader foundation, see our introduction to digital privacy — it explains what data is collected and how it travels before you start making changes.
Location services set to 'Always On' for apps that don't need it
Both iOS and Android allow apps to request location access continuously — even when the app isn't open. Many apps request this level of access during setup, and most users tap 'Allow' without a second thought. The result: apps for weather, shopping, or social media may be logging your movements around the clock.
What to do: Go to your phone's location settings and review each app individually. For most apps, change the permission to 'While Using the App' or 'Never.' Reserve 'Always' only for navigation or apps where continuous location is genuinely necessary, such as a fitness tracker you've consciously enabled.
Many apps log your location continuously — even when you haven't opened them in days.
Ad tracking identifiers left enabled
Every smartphone has an advertising identifier — called the IDFA on iPhone and GAID on Android — that allows advertisers to track your behavior across apps and build a profile over time. By default, these identifiers are active and accessible.
What to do: On iPhone, go to Settings > Privacy & Security > Tracking and turn off 'Allow Apps to Request to Track.' On Android, go to Settings > Privacy > Ads and select 'Delete advertising ID.' Neither change breaks app functionality — it simply limits cross-app behavioral tracking.
Disabling your ad tracking ID limits cross-app behavioral profiling without breaking any core feature.
Browser set to save passwords and autofill payment details
Browser autofill is convenient, but storing payment card details and passwords directly in a browser — particularly one that's signed into a synced account — creates a single point of failure. If that browser account is compromised, stored credentials and card numbers may be accessible too.
What to do: In your browser settings, navigate to Autofill or Passwords and disable saving for payment methods. Consider using a dedicated password manager instead of the browser's built-in option, which provides more control over encryption and access. Also check whether your browser syncs data to a cloud account and decide what categories you're comfortable sharing.
Storing payment details in a browser ties your financial data to a single, potentially vulnerable account.
Microphone and camera permissions granted to apps that don't need them
App permissions for the microphone and camera are among the most sensitive on any device, yet they're routinely granted during app installation and then forgotten. A gaming app, a retail app, or a productivity tool rarely has a legitimate need for ongoing microphone access.
What to do: On both iOS and Android, review microphone and camera permissions in your privacy settings. Revoke access for any app where the purpose isn't immediately obvious. Social media and communication apps may legitimately need these for recording or calling — but only allow access 'While Using the App' rather than persistently. For a deeper look at how always-on audio devices handle this, our smart speakers privacy overview is relevant context.
Most apps that have microphone access don't need it — and many users don't realize they granted it.
Browser set to accept all cookies by default
Browsers ship with relatively permissive cookie policies. Third-party cookies — those set by domains other than the site you're visiting — are the primary mechanism advertisers use to track you across the web. Most browsers still accept them unless you explicitly change the setting.
What to do: In your browser's privacy or cookie settings, block third-party cookies. Major browsers including Chrome, Firefox, and Safari offer this option, though the path varies. You can also enable 'Do Not Track' (though its legal weight is limited) and consider a browser extension designed to block tracking scripts. Note that blocking all cookies can break some site functionality — third-party only is a practical middle ground.
Blocking third-party cookies is one of the single most effective steps you can take in a browser.
Wi-Fi set to auto-connect and share network passwords
Most phones are set by default to remember and automatically reconnect to previously used Wi-Fi networks. Some operating systems also have a feature that shares your saved Wi-Fi passwords with contacts. Both settings carry risk — auto-connect can expose your device on untrusted networks, and password sharing removes your control over who can access your home network.
What to do: Review your Wi-Fi settings and disable auto-join for any public or unfamiliar networks. On iOS, check the 'Personal Hotspot' and password sharing features under your Apple ID settings. On Android, review Network & Internet settings for similar options. For a full breakdown of network-level risks, see our piece on public Wi-Fi risk.
Auto-connecting to saved networks can silently join untrusted access points without any prompt.
Make This a Habit, Not a One-Time Fix
Privacy settings aren't static. Apps update, operating systems add new data-sharing options, and permissions you granted years ago may still be active. A quarterly review — checking app permissions, toggling off new opt-ins, and revisiting browser settings — keeps your configuration current without much effort.
Set a quarterly privacy reminder
Add a recurring calendar reminder every three months to review app permissions, check for new browser settings, and audit which apps still have location or microphone access. Operating system updates frequently introduce new data-sharing options that default to 'on.' Staying current takes less than 20 minutes once you know where to look.
If you recently got a new device, the first-day setup guide walks through the full configuration process in order. And for understanding how the apps already on your phone collect and use data, the built-in apps overview is worth a read alongside these adjustments.