iPhone Privacy Settings: A Complete Checklist

iPhone privacy is not one switch. It is a stack of per-app permissions, system services, account protections, and network-level controls spread across Settings, and the defaults favor convenience over restraint. This guide walks through each layer in order of impact, with the exact menu paths, the commands and tools for admins managing fleets, and the failure modes to check when something breaks. Menu names below follow iOS 26; earlier versions use the same structure with minor label changes.

Quick Takeaways

• Highest impact first: Apple Account security, Location Services, app permissions, and Safari tracking controls cover most real-world exposure.
• Audit with built-ins: Settings > Privacy & Security (including App Privacy Report) shows which apps accessed what, and when.
• Lockdown Mode is an extreme option for high-risk users and should not be enabled casually.
• Admins should enforce these controls through MDM configuration profiles instead of trusting users to configure each device.

Prerequisites

Before changing anything, confirm your baseline.

1. Update to the latest iOS: Settings > General > Software Update. Privacy fixes ship in point releases.
2. Back up first: Settings > [Your Name] > iCloud > iCloud Backup > Back Up Now.
3. Know your iOS version: Settings > General > About > iOS Version.

Conceptual Overview: How iOS Enforces Privacy

iOS runs every app in a sandbox. An app cannot read another app’s container or touch protected resources without passing through TCC (Transparency, Consent, and Control), the permission framework behind every prompt you see for camera, microphone, contacts, photos, and location. Once you grant a permission, the app keeps it until you revoke it. iOS does not expire most grants on its own, so a once-tapped “Allow” can persist for years.

The practical consequence: your job is to audit grants periodically, not just answer prompts correctly the first time.

Step 1: Lock Down the Apple Account

An attacker who controls your Apple Account controls your backups, passwords, and location. Fix this layer first.

Enable Two-Factor Authentication and Review Devices

• Path: Settings > [Your Name] > Sign-In & Security
• Confirm Two-Factor Authentication is on.
• Under Devices (scroll on the account page), remove any device you do not recognize.

Add Recovery Options

• Recovery Contacts and a Recovery Key live under Sign-In & Security > Account Recovery.
• A Recovery Key is a 28-character code. If you enable it, Apple support cannot reset your account for you, so store it offline.

Turn On Advanced Data Protection

• Path: Settings > [Your Name] > iCloud > Advanced Data Protection
• This extends end-to-end encryption to most iCloud categories, including backups and Photos. Apple cannot decrypt them.
• Requires a recovery contact or key, and all signed-in devices must run a supported iOS.

Step 2: Harden Device Access

Passcode and Biometrics

• Path: Settings > Face ID & Passcode
• Use Custom Alphanumeric Code. A six-digit numeric passcode is weak against offline brute force.
• Enable Erase Data to wipe the device after 10 failed attempts.
• Under Allow Access When Locked, disable items you do not need on the lock screen: Control Center, Notification Center, Wallet, Home Control, and Return Missed Calls.

Stolen Device Protection

• Path: Settings > Face ID & Passcode > Stolen Device Protection
• Set it to Always. Sensitive changes then require biometrics plus a one-hour security delay when you are away from familiar locations.

Step 3: Audit Privacy & Security Permissions

Open Settings > Privacy & Security. Work through each category and tap into it to see which apps hold access.

Location Services

• Path: Settings > Privacy & Security > Location Services
• For each app, choose Never, Ask Next Time Or When I Share, While Using the App, or Always.
• Default to While Using the App. Reserve Always for navigation or find-my-device tools.
• Disable Precise Location per app when city-level accuracy is enough (weather, news, shopping).
• Under System Services, turn off Location-Based Suggestions, Location-Based Alerts, and Significant Locations history if you do not want on-device location pattern storage.

Permission Review Table

Photos: Limit Instead of Granting Everything

Choose Selected Photos so the app sees only the images you pick. iOS will periodically ask whether to keep or revise the selection.

Tracking

• Path: Settings > Privacy & Security > Tracking
• Turn off Allow Apps to Request to Track. This blocks the ATT (App Tracking Transparency) prompt and denies access to the advertising identifier (IDFA) for every app.

Analytics and Advertising

• Settings > Privacy & Security > Analytics & Improvements: disable Share iPhone Analytics and Improve Siri & Dictation.
• Settings > Privacy & Security > Apple Advertising: turn off Personalized Ads.

Step 4: Use App Privacy Report for Evidence

• Path: Settings > Privacy & Security > App Privacy Report
• Tap Turn On App Privacy Report, wait a few days, then review.

It records:

• Which apps accessed location, photos, camera, microphone, and contacts
• Which domains each app contacted (App Network Activity)
• Which domains were contacted from within websites (Website Network Activity)
• The most frequently contacted domains (Most Contacted Domains)

An app that contacts dozens of ad or analytics domains while you barely use it is a candidate for removal. Tap Save App Privacy Report to export a JSON file for deeper analysis.

Parse the Export on a Mac or Linux Host

The exported file is newline-delimited JSON. Quick triage with jq:

# Count network contacts per domain, highest first
jq -r 'select(.type=="networkActivity") | .domain' AppPrivacyReport.ndjson \
  | sort | uniq -c | sort -rn | head -20

• select(...): filters records to network events only.
• -r: outputs raw strings without quotes.
• uniq -c: prefixes each domain with its count.

Field names can differ between iOS releases. Run head -n 3 AppPrivacyReport.ndjson | jq . first to confirm the schema.

Step 5: Safari and Browsing Privacy

Path: Settings > Apps > Safari (on older versions, Settings > Safari).

Private Browsing and Extensions

• Use Private Browsing for sessions you do not want in history. Tabs lock when you leave the app if you enable it.
• Review extensions under Settings > Apps > Safari > Extensions. Set each to Ask instead of Allow for all sites.

Advanced Tracking and Fingerprinting Protection

In Settings > Apps > Safari > Advanced, set Advanced Tracking and Fingerprinting Protection to All Browsing. This limits fingerprinting signals and strips known tracking parameters from URLs.

Step 6: Network-Level Controls

Private Wi-Fi Address

• Path: Settings > Wi-Fi > (i) next to the network > Private Wi-Fi Address
• Keep it on (Fixed or Rotating) so each network sees a different MAC address.

iCloud Private Relay

• Path: Settings > [Your Name] > iCloud > Private Relay (requires a paid iCloud+ plan)
• Splits your connection across two relays so neither Apple nor the relay operator sees both your IP and the destination.
• It may not be available in every region, and some corporate networks block it.

Limit IP Address Tracking in Mail

• Path: Settings > Apps > Mail > Privacy Protection
• Enable Protect Mail Activity to hide your IP and preload remote content through proxies, defeating tracking pixels.

DNS

Use an encrypted DNS profile or a trusted resolver. Install a configuration profile from your chosen provider under Settings > General > VPN & Device Management. Verify it afterward in the same menu.

Step 7: Reduce Data Exposure from Features

Safety Check deserves special attention. It lets you quickly stop sharing location and data with specific people, and reset system privacy permissions across apps. Emergency Reset applies changes instantly, while Manage Sharing & Access lets you review each item.

Step 8: Lockdown Mode (High-Risk Users Only)

• Path: Settings > Privacy & Security > Lockdown Mode
• It blocks most message attachment types, disables complex web technologies like JIT JavaScript, rejects FaceTime calls from unknown contacts, and blocks configuration profile installation.
• Intended for journalists, activists, and others who may face targeted spyware. It degrades normal usability.

Fleet Management: Enforcing Privacy with MDM

Administrators should push settings through MDM instead of relying on user behavior. Common restriction payload keys in a configuration profile:

<key>allowAssistantWhileLocked</key><false/>
<key>forceLimitAdTracking</key><true/>
<key>allowDiagnosticSubmission</key><false/>
<key>forceAirDropUnmanaged</key><true/>
<key>allowUIConfigurationProfileInstallation</key><false/>

• allowAssistantWhileLocked: blocks Siri on the lock screen.
• forceLimitAdTracking: limits ad tracking.
• allowDiagnosticSubmission: stops diagnostic data uploads.
• forceAirDropUnmanaged: treats AirDrop as an unmanaged destination to curb data leakage.
• allowUIConfigurationProfileInstallation: prevents users from installing rogue profiles.

Key names and availability vary by iOS version and supervision state. Confirm each against Apple’s Device Management documentation before deployment, and test on a pilot group first.

Troubleshooting and Real-World Scenarios

Scenario 1: An App Stopped Working After Revoking Permissions

Symptom: A navigation or camera app shows a blank screen or “location unavailable.”

Fix:

1. Go to Settings > [App Name] and re-enable only the required permission.
2. Set location to While Using the App instead of Never.
3. Force-quit and reopen the app.

Scenario 2: Private Relay Breaks Streaming or a Banking Site

Symptom: Region errors or login challenges.

Fix:

1. Open Settings > Wi-Fi > (i) on the affected network and toggle iCloud Private Relay off for that network only.
2. Alternatively, choose Maintain General Location instead of Use Country and Time Zone under Settings > [Your Name] > iCloud > Private Relay > IP Address Location.

Scenario 3: Suspected Stalkerware or Unwanted Access

Symptom: Unexplained battery drain, unfamiliar profiles, or someone knows your location.

Fix:

1. Run Safety Check > Emergency Reset.
2. Remove unknown profiles under Settings > General > VPN & Device Management.
3. Change your Apple Account password and review Devices on the account page.
4. Check Settings > Privacy & Security > Location Services > Share My Location and Find My for unknown people.
5. If compromise persists, back up essential data and restore the device through Settings > General > Transfer or Reset iPhone > Erase All Content and Settings.

Scenario 4: Lock Screen Leaks Message Content

Fix: Settings > Notifications > Show Previews > When Unlocked, then apply per app where needed.

Final Verification Checklist

Run this once after configuration, then quarterly.

• [ ] iOS is current
• [ ] Two-Factor Authentication on; unknown devices removed
• [ ] Advanced Data Protection enabled (if suitable)
• [ ] Stolen Device Protection set to Always
• [ ] Alphanumeric passcode set; Erase Data on
• [ ] Location Services reviewed; Always limited
• [ ] Photos set to Selected Photos where possible
• [ ] Allow Apps to Request to Track off
• [ ] App Privacy Report on and reviewed
• [ ] Safari tracking protections and Hide IP Address on
• [ ] Private Wi-Fi Address on; Protect Mail Activity on
• [ ] Show Previews set to When Unlocked
• [ ] Safety Check reviewed

FAQ

How do I stop apps from tracking me on iPhone?

Go to Settings > Privacy & Security > Tracking and turn off Allow Apps to Request to Track. Then disable Personalized Ads under Apple Advertising and review per-app permissions.

Is iPhone Lockdown Mode worth enabling?

Only if you may be a target of sophisticated spyware. It blocks many attachment types and web features, which reduces attack surface but disrupts everyday use. Most users are better served by the standard checklist above.

How can I see which apps are using my location or microphone?

Open Settings > Privacy & Security > App Privacy Report. It lists every app’s access to location, microphone, camera, photos, and contacts, plus the domains each app contacted. The status bar indicators (orange for microphone, green for camera) show live use.

Does iCloud Private Relay hide my IP address like a VPN?

It masks your IP address and browsing from network observers for Safari and some app traffic, using two separate relays. It is not a full VPN. It does not cover all device traffic and cannot change your apparent country the way many VPNs do.