Galaxy S26 privacy guide: lock down Samsung's flagship

The Galaxy S26 is the flagship for people who want monthly updates and the full Galaxy AI package without paying Ultra money. It was a top-10 seller worldwide in the second quarter of 2026, according to Counterpoint. It launched in March at $899.99 and costs about $999.99 after Samsung’s October price rise.

Privacy-wise, the S26 gets nearly everything its big sibling gets: seven years of monthly security patches, One UI 9, Knox Vault and the switch that keeps Galaxy AI on the device. Like every US Galaxy, though, it can’t unlock its bootloader, so a private OS such as GrapheneOS is not an option. This guide works through the settings step by step. It belongs to our 10-phone privacy series for US buyers.

S26 or S26 Ultra: what’s different for privacy

Most of the difference is the screen. Here’s the short version:

Privacy Display is the Ultra’s hardware trick: it limits what people beside you can see on the screen. If you ride crowded trains and type passwords in public, that’s worth something. Everything else in this guide applies to both phones, so if you’re choosing, the $400 gap buys a screen feature, not better data protection. Our S26 Ultra settings walkthrough covers Privacy Display.

What you can’t fix on a Galaxy S26

• The operating system: no OEM unlock on US models means One UI is permanent.
• Samsung’s ad sharing: Samsung’s US privacy policy says sharing identifiers and online activity with ad partners “may be considered a ‘sale’”. You can opt out, which is as far as it goes.
• AI training: the same policy says US data may be used “to develop and train our artificial intelligence algorithms and models.”
• Some preloads: Bixby and certain Samsung apps can be disabled but not removed.

Samsung says menus “may vary depending on the model and software version.” If a path below doesn’t match yours, search Settings for the setting’s name.

Before you start

1. Update: Settings > Security and privacy > Updates. One UI 9 started rolling out as a stable release on September 16, 2026.
2. Note who sells you updates. Samsung lists the S26 for monthly patches, but warns that some carriers may only ship them quarterly.
3. Copy your photos to a computer before you change anything big.

1. Without Privacy Display: keep prying eyes off the screen

The S26 can’t dim its screen to side viewers, so do it with software:

• Lock screen notifications: search Settings for “Lock screen notifications” and hide the message content. A phone face-up on a table shows less that way.
• Secure Folder: Settings > Security and privacy > More security settings > Secure Folder. It’s a separate locked space for apps and files. On recent versions it locks when the screen turns off, and Samsung no longer supports Secure Folder backups, so keep copies of anything important elsewhere.
• Private Album: in Gallery, hide photos in a Private Album. It doesn’t need a Samsung account.

2. Galaxy AI: decide what goes to the cloud

1. Open Settings > Galaxy AI and turn on “Process data only on device”. Cloud-based features, such as generative edits and some summaries, stop; local ones keep running.
2. In Settings > Galaxy AI > Writing assist, switch off what you won’t use.
3. On One UI 9, look for the AI Assistant Activity dashboard (search Settings for it). It lists what AI agents did for you.

Samsung says the S26 stores on-device AI data in Knox Enhanced Encrypted Protection (KEEP), which encrypts each app’s data separately. That protects data at rest on the phone; the on-device switch keeps it from leaving.

Don’t forget the keyboard. Predictive words can sync to your Samsung account. Go to Settings > General management > Samsung Keyboard settings, turn off what you don’t need under Predictive text, and use Reset to default settings > Erase personalized predictions to start clean.

3. Samsung’s data and ad profile

This takes about ten minutes and covers Samsung’s largest data streams:

1. Settings > Security and privacy > More privacy settings > Samsung > Send diagnostic data: off.
2. Search Settings for “Customization”. Samsung’s Customization Service gathers app usage, Samsung Internet browsing and searches, location and voice for personalized content and ads. Turn off the ad consents under your Samsung account’s Security and privacy section, then delete stored data at privacy.samsung.com.
3. File the opt-out through Samsung’s US privacy choices page and its California “Do Not Sell or Share” form.
4. Bixby: Settings > Advanced features > Bixby > Leave Bixby, then Settings > Apps > Bixby > Disable.

If you use Samsung Health, its data is encrypted with Knox keys. You can download or erase it from Samsung Health > More options > Settings.

A Samsung account is optional at setup. Skipping it costs you Identity check, the Secure Folder reset and some Galaxy AI features.

4. Google settings

• Settings > Google > All services > Privacy & security > Ads > Delete advertising ID.
• At myaccount.google.com/activitycontrols, turn off Web & App Activity or set auto-delete.
• In My Ad Center, turn personalized ads off. Google’s Timeline stays on the device and is off by default; leave it that way unless you want it.

5. Permissions and Privacy Alerts

1. Settings > Security and privacy > Privacy > Permission manager. Go through Location, Camera and Microphone, and pick “Only while using”, “Ask every time” or “Don’t allow”.
2. Check the permission usage history (24 hours or 7 days) for anything unexpected.
3. When the green dot appears at the top of the screen, tap it to see which app is using the camera or mic.

The S26 series includes Samsung’s Privacy Alerts, which use machine learning to flag apps with device admin rights that try to read your precise location, call logs or contacts. You don’t set them up. When one fires, open the app’s permissions and cut it back.

6. Auto Blocker and Maximum restrictions

Settings > Security and privacy > Auto Blocker blocks sideloaded apps, USB commands, malicious images in messaging apps and uncertified system software. It’s on by default for current models; leave it on. Check Settings > Security and privacy > More security settings > Install unknown apps too, and revoke anything you don’t recognise.

Maximum restrictions, at the bottom of the Auto Blocker page, blocks 2G, stops auto-joining non-secure Wi-Fi, blocks links and preview images in texts, disables Gallery shared albums, strips location from shared photos and scans apps automatically. Two catches: work apps that need device admin or a work profile stop working, and you lose service in 2G-only areas.

7. Theft protection

1. Settings > Security and privacy > Lost device protection > Theft protection. Turn on Theft detection lock, Offline device lock, Remote lock and Identity check (needs biometrics and a Samsung account; it adds a one-hour Security delay away from Safe places).
2. On Lost device protection, decide whether you want “Allow this phone to be found”, “Send last location” and “Offline finding”. Remote lock and erase work from samsungfind.samsung.com.
3. Search Settings for “Lock network” so turning off mobile data requires an unlock.

8. Network

Settings > Connections > More connection settings > Private DNS: enter a filtering resolver. Also turn off Nearby device scanning there, and Wi-Fi and Bluetooth scanning in each one’s Advanced settings. Our Private DNS setup guide compares resolvers. Samsung’s Secure Wi-Fi VPN is free up to 1024 MB a month, but it routes traffic through Samsung.

9. Debloat, including carrier apps

Our no-root bloatware removal guide explains the ADB setup. Turn Auto Blocker off for the session (it blocks USB commands), then turn it back on.

Low-risk packages for adb shell pm disable-user --user 0 <package>: com.samsung.android.bixby.wakeup, com.samsung.android.app.spage, com.samsung.android.ardrawing, com.samsung.android.aremoji, com.facebook.katana, com.samsung.android.rubin.app and com.samsung.android.providers.context. Never touch com.sec.android.soagent, com.wssyncmldm, com.samsung.android.honeyboard (the keyboard) or com.samsung.android.kgclient.

Verizon units: com.vzw.hss.myverizon, com.vcast.mediamanager and com.telecomsys.directedsms.android.SCG can go; keep com.verizon.mips.services if you use the hotspot. T-Mobile units: com.tmobile.pr.adapt and com.tmobile.echolocate, but keep com.tmobile.simlock if you’ll ask T-Mobile to unlock the phone later.

10. Your carrier’s ad program

• T-Mobile: “Relevant Ads” and “Analytics and Reporting” live in the T-Mobile Privacy Dashboard. Turn both off.
• Verizon: Custom Experience is on by default; turn it off in My Verizon > Privacy preferences or by calling 866-211-0874.
• AT&T: opt out at att.com/PrivacyChoices.

Then swap a few defaults for private apps from our starter app list for 2026. If you’d rather have a phone that can drop Google from the OS itself, the Pixel 10 runs GrapheneOS.

Block apps from the internet with Rethink

One UI can limit apps, but it can’t cut one off completely. Settings > Connections > Data usage > Allowed networks for apps holds an app to Wi-Fi only, and Data usage > Mobile data usage > [app] > Allow background data usage stops it using mobile data in the background. Samsung notes both vary by carrier. To block an app on every network, the Galaxy S26 needs a firewall app. Our pick is Rethink, listed in the stores as “Rethink: DNS + Firewall + VPN”. It’s free, open source (Apache-2.0) and needs no root. It works as a local VPN: traffic is filtered on the phone and goes nowhere else unless you add a VPN server yourself.

1. Install Rethink from Google Play. Auto Blocker stops installs from outside Galaxy Store and Play, and Samsung says apps from other sources can’t update while it’s on, so the F-Droid build would mean switching Auto Blocker off for every update.
2. Open it, keep the default mode, “DNS and Firewall”, tap Start and accept Android’s VPN request.
3. Go to Configure > Apps. Every app has a Wi-Fi switch and a mobile-data switch. Block both for apps that work offline: Gallery, Calculator, Voice Recorder, Samsung Notes if you don’t sync it, the keyboard and offline games. Block only mobile data for photo backup.
4. Turn Android’s Private DNS off: Settings > Connections > More connection settings > Private DNS > Off. Rethink warns that Private DNS overrides its own DNS, so pick your filtering resolver under Configure > DNS instead. You keep the blocking and gain a per-app log.
5. Open Settings > Connections > More connection settings > VPN, tap the gear next to Rethink, and turn on Always-on VPN and Block connections without VPN. If Rethink ever stops, apps lose the network instead of slipping past it.
6. Settings > Apps > Rethink > Battery and choose Unrestricted, so One UI doesn’t put it to sleep.

Leave it running for a day, then open Rethink’s logs to see which apps connect where. A few catches:

• Android runs one VPN at a time. Samsung’s Secure Wi-Fi and any VPN app compete for the same slot. Rethink can carry your VPN provider’s WireGuard settings, so you can keep both the firewall and the VPN.
• Apps inside Secure Folder run in a separate profile that Rethink doesn’t cover.
• Devices on your hotspot bypass it.
• If Wi-Fi calling or Android Auto stops working, set the apps involved to “Bypass DNS & Firewall” in Rethink’s app list.

NetGuard is the simpler, firewall-only alternative. Our NetGuard and Rethink side-by-side compares them.

How anonymous can the Galaxy S26 get?

Start with the hard limit. While the phone is on, your carrier knows roughly where it is. The EFF puts it plainly: “There is no way to hide from this kind of tracking as long as your mobile phone is powered on.” In April 2024 the FCC fined T-Mobile, AT&T, Verizon and Sprint nearly $200 million for selling customers’ location data, and in June 2026 the Supreme Court upheld the AT&T and Verizon fines. No phone setting changes what the network sees. What you can cut is the trail to advertisers, apps and the people around you.

People nearby

• Device name: Settings > About phone > Device name. Samsung says it’s visible to Bluetooth and Wi-Fi devices. Keep the model name or anything else that isn’t your name.
• Quick Share: Settings > Connected devices > Quick Share > Who can share with you. Pick Contacts or Your devices; Everyone switches back after 10 minutes.
• Wi-Fi address: Android gives each network a random MAC address by default, but keeps the same one for that network until a factory reset. Networks saved long ago may still use the real one: tap the gear next to a saved network and check that MAC address type reads Randomized MAC.

Photos and finding networks

• Camera: Camera > Settings > Location tags, off. New photos then carry no GPS position.
• Sharing older photos: in Gallery, tick Remove location data on the share screen. Maximum restrictions does this automatically.
• Samsung offline finding: Settings > Security and privacy > Lost device protection > Offline finding. Samsung says this makes your phone a “Find Node” that helps locate other people’s SmartTags and Galaxy devices. If you keep it on, turn on Encrypt offline location.
• Google’s Find Hub network: Settings > Google > All services > Find Hub > Find your offline devices. The options are Off, Without network, With network in busy places only and With network everywhere. By default your phone joins the crowd network that locates other people’s devices; Without network keeps it out. The cost of opting out is that a lost phone is harder to find once it goes offline.

Your number and accounts

• Prepaid lines: no federal law requires ID to buy prepaid service today. That may change: a May 2026 FCC proposal (FCC 26-27, aimed at robocalls) would have voice providers collect your name, address and ID number, and it was still open in October 2026. Either way, paying by card or giving an email at checkout ties the line to you.
• Wi-Fi calling: Settings > Connections > Wi-Fi Calling > Emergency Address shows the address your carrier keeps on file for 911. If you don’t want your home address tied to the account, leave Wi-Fi calling off.
• Accounts: You can skip the Samsung account at setup, but the Galaxy Store needs one. Google Play needs a Google account, so give it as little as you can.
• Sign-ups: use email aliases for apps and shops. SimpleLogin’s free plan gives 10 aliases, and addy.io offers unlimited standard aliases on its free tier. Both forward to your real inbox, so the alias service itself still knows who you are.

Browsing and traffic

• Samsung Internet: use Secret mode (Tabs > Secret mode). Smart anti-tracking is on by default; leave it that way.
• Tor Browser for Android: the Tor Project’s official app, on Google Play and F-Droid. Use it for searches and sites you don’t want tied to your connection.
• A VPN that doesn’t need your email: Mullvad issues a random account number and takes cash by post or Monero; IVPN generates an account ID and also takes cash. Load its WireGuard settings into Rethink and the firewall keeps working. A VPN hides your browsing from the carrier and Wi-Fi owner, not your location from the cell network.
• Tor for chosen apps: Rethink has a one-tap Orbot option that sends traffic through Tor. Install Orbot first.
• Airplane mode: the GrapheneOS FAQ calls it “the only way to avoid the cellular network tracking your device.” It doesn’t erase what the carrier logged before you switched it on, but it’s the honest answer for a sensitive trip.

Quick checklist

• Latest One UI 9 patch installed
• Lock screen hides notification content
• “Process data only on device” on, keyboard predictions reset
• Samsung diagnostics, Customization Service and ad consents off
• Samsung opt-out request filed
• Advertising ID deleted, Web & App Activity limited
• Permissions reviewed; Privacy Alerts acted on
• Auto Blocker on, Maximum restrictions decided
• Theft protection on
• Private DNS (or Rethink’s DNS) set, bloat and carrier apps disabled, carrier ads off
• Rethink blocking offline apps; Always-on VPN and Block connections without VPN on
• Device name, Quick Share, randomized MAC checked
• Camera location off; Find Hub network choice made

Check the unlocked Galaxy S26 on Amazon
affiliate link — same price for you, small commission for us

See how the S26 compares with the rest of the list in our hub of US best-seller privacy guides.