Galaxy S26 Ultra privacy guide: Privacy Display and Galaxy AI

The Galaxy S26 Ultra is expensive, and people buy it anyway. Counterpoint ranked it the best-selling Android phone worldwide in the second quarter of 2026, and about 71% of US Galaxy S26-series sales go to the Ultra. It went on sale in March at $1,299.99; after Samsung’s October 1 price rise, the 256GB model costs $1,399.99 at Samsung.com.

For that money you get Samsung’s strongest privacy toolkit: monthly security patches for seven years, a screen that hides itself from the person next to you, and a switch that keeps Galaxy AI on the phone. What you don’t get is a way out of Samsung’s software. US Galaxy phones can’t unlock the bootloader, so GrapheneOS and other private systems won’t install. This guide hardens One UI as far as it goes. It’s one of ten in our privacy series on America’s top-selling Android phones.

What you can and can’t fix on the S26 Ultra

You can control a lot: the screen, the AI, Samsung’s ad profile, theft protection, the network and most of the bloat. The hard limits:

• No private OS: no OEM unlock on US models, and no custom systems as a result.
• Samsung’s data practices: its US privacy policy says sharing identifiers and online activity with ad partners “may be considered a ‘sale’”, and US data may be used to train its AI models. You can opt out of both; you can’t audit them.
• Google Play Services: it keeps system-level privileges on any stock Android phone.
• Some preloaded apps: Bixby can only be disabled, and some apps can’t be removed.

Samsung says menus “may vary depending on the model and software version.” This guide is written for One UI 9. If a path doesn’t match, use the search box at the top of Settings.

Before you start

1. Check that One UI 9 (Android 17) is installed. Samsung began the stable rollout on September 16, 2026. Go to Settings > Security and privacy > Updates.
2. The S26 Ultra is on Samsung’s monthly patch list. One caveat from Samsung: some carriers may only deliver updates quarterly. If you bought through a carrier, its schedule applies.
3. Back up anything you’d hate to lose before the ADB step later on.

1. Privacy Display: the Ultra’s own feature

Privacy Display is built into the Ultra’s screen hardware, and only the Ultra has it. When it’s on, the screen looks normal to you but limits what someone sees from the side, which helps on a plane or a crowded train. It’s off by default.

1. Go to Settings > Display > Privacy Display. You can also press and hold its tile in the Quick Panel.
2. Choose when it switches on. Samsung lists four options:
   • Apps: pick the apps that trigger it, such as banking, email or your password manager.
   • PIN, pattern and password entry: hides your unlock code from shoulder-surfers.
   • Notification pop-ups: blocks out only the pop-up area, not the whole screen.
   • Maximum privacy protection: narrows the side view further.
3. Add the Quick Panel tile so you can switch it on by hand before you board.

Privacy Display hides your screen from people. It does nothing about what apps send. Treat it as one item on the list.

2. Galaxy AI: keep it on the phone

The Ultra runs the full Galaxy AI suite, and some of it uses Samsung’s cloud.

1. Open Settings > Galaxy AI.
2. Turn on “Process data only on device”. Cloud features such as generative photo edits and some summaries stop working. Everything that runs locally keeps working.
3. In the same menu, open Writing assist and switch off any part you don’t use.

Samsung says on-device AI data sits in Knox Enhanced Encrypted Protection (KEEP), which encrypts each app’s data separately, with Knox Vault hardware underneath. That’s useful protection for data stored on the phone. Once a feature goes to the cloud, KEEP no longer covers it, which is why the toggle above matters more.

Samsung’s switch is for Galaxy AI features. Gemini is Google’s assistant and has its own settings. If you don’t want it on the side button, set Settings > Advanced features > Side button > Long press to the power off menu.

3. What One UI 9 adds

One UI 9 brought three privacy-related additions. Samsung hasn’t published menu paths for them, so search Settings or open the app named:

• AI Assistant Activity dashboard: one place to review what AI agents did on your behalf. Search Settings for “AI Assistant Activity” and look through it once a month.
• Security Brief: a security summary inside Now Brief.
• Protect from malicious web: a Samsung Internet setting. Open Samsung Internet’s settings and search for it.

Samsung also lists Privacy Alerts for the S26 series. They use machine learning to warn you when an app with device admin rights tries to read your precise location, call logs or contacts. They work on their own; when one appears, act on it.

4. Samsung account and cloud backups

A Samsung account is optional at setup, but on an Ultra you’ll probably want one: Identity check, the Secure Folder reset and several Galaxy AI features need it. If you use Samsung Cloud, encrypt it end to end:

1. Go to Settings > Security and privacy > More security settings > Enhanced data protection.
2. Turn on “Encrypt backup data” and “Encrypt synced data”.
3. Store the 28-character recovery code somewhere safe. Samsung doesn’t keep a copy, so losing it means losing the backup.

Samsung notes this option may be missing on some carrier models. Two more account clean-ups: delete stored Samsung Pass data at privacy.samsung.com if you move to another password manager, and remove old phones in Wallet > Menu > Settings > Manage devices in use.

5. Samsung’s ad profile and diagnostics

• Send diagnostic data: Settings > Security and privacy > More privacy settings > Samsung. Turn it off.
• Customization Service: collects app usage, Samsung Internet browsing and searches, location and voice. Search Settings for “Customization”, turn off the ad consents under your Samsung account’s Security and privacy, and delete the collected data at privacy.samsung.com.
• Sale and sharing opt-out: file it through Samsung’s privacy rights request page and the Samsung Do Not Sell or Share page.
• Google ads: Settings > Google > All services > Privacy & security > Ads > Delete advertising ID. Then at myaccount.google.com/activitycontrols, turn off or auto-delete Web & App Activity.
• Bixby: Settings > Advanced features > Bixby > Leave Bixby, then Settings > Apps > Bixby > Disable.

6. Auto Blocker, Maximum restrictions and Advanced Protection

1. Settings > Security and privacy > Auto Blocker should already be on. It blocks sideloaded apps, USB commands, malicious images in messaging apps and uncertified system software.
2. At the bottom, Maximum restrictions goes further: automatic app scanning, no 2G, no auto-joining non-secure Wi-Fi, no links or preview images in texts, no Gallery shared albums, and location stripped from shared photos. The cost: work apps that need device admin or a work profile break, and you lose service where only 2G exists. If your employer manages your Ultra, test it before you rely on it.
3. Android 16 and later also include Google’s Advanced Protection, which blocks sideloading among other things. On recent Samsung software it sits under Settings > Google > All services > Personal and device safety > Advanced Protection; if you don’t see it there, search Settings for “Advanced Protection”.

7. Theft protection and repairs

1. Settings > Security and privacy > Lost device protection > Theft protection: turn on Theft detection lock, Offline device lock, Remote lock and Identity check. Identity check asks for biometrics away from your Safe places and adds a one-hour Security delay before big changes.
2. Search Settings for “Lock network” so a thief can’t switch on airplane mode without unlocking.
3. Before you hand the phone in for repair, turn on Settings > Device care > Maintenance mode, which Samsung built for exactly that situation.

Samsung added escalating lockouts for phones that launched with One UI 9, such as the S26 FE and Fold8 (our Galaxy Z Fold8 and Flip8 lockdown guide explains the 13-try rule); it hasn’t said the update brings them to the S26 Ultra.

8. Network and permissions

• Private DNS: Settings > Connections > More connection settings > Private DNS, set to a filtering resolver. Turn off Nearby device scanning on the same screen. Picking a filtering resolver is covered in our settings walkthrough.
• Secure Wi-Fi: a free Samsung VPN (1024 MB a month) under More security settings. It moves your trust from the hotspot to Samsung.
• Permission manager: Settings > Security and privacy > Privacy > Permission manager. Review Camera, Microphone and Location, and check the 24-hour and 7-day usage history.

9. Debloat with ADB

Even a $1,400 phone ships with apps you never asked for. Our step-by-step ADB bloat removal covers setup; turn Auto Blocker off while you work, since it blocks USB commands, and back on afterwards.

Commonly disabled with adb shell pm disable-user --user 0 <package>: com.samsung.android.bixby.agent, com.samsung.android.visionintelligence, com.facebook.appmanager, com.facebook.services, com.facebook.system, com.microsoft.skydrive, com.linkedin.android, com.samsung.android.rubin.app (Customization Service) and com.samsung.android.knox.analytics.uploader.

Leave com.samsung.android.fmm (Find), com.samsung.android.knox.containercore (Secure Folder) and com.samsung.android.samsungpass alone. Never remove com.sec.android.soagent, com.wssyncmldm (updates) or com.samsung.android.kgclient.

A carrier-bought Ultra carries extras: com.att.iqi and com.att.dh on AT&T, com.tmobile.echolocate (diagnostics) on T-Mobile, com.verizon.obdm on Verizon.

10. Carrier ad programs

• Verizon: Custom Experience is on by default. Switch it off in My Verizon > Privacy preferences.
• AT&T: opt out at att.com/PrivacyChoices; AT&T says its ad sharing “may be considered a sale”.
• T-Mobile: turn off “Relevant Ads” and “Analytics and Reporting” in the Privacy Dashboard.

Is the Ultra the right privacy phone?

If you want Samsung hardware, Privacy Display and long monthly support, yes. If you want Google out of the operating system entirely, no Galaxy can do it. For that, look at a Pixel that runs GrapheneOS, such as the Pixel 10 Pro, and the GrapheneOS browser installer walkthrough.

Block apps from the internet with Rethink

One UI can limit apps, but it can’t cut one off completely. Settings > Connections > Data usage > Allowed networks for apps holds an app to Wi-Fi only, and Data usage > Mobile data usage > [app] > Allow background data usage stops it using mobile data in the background. Samsung notes both vary by carrier. To block an app on every network, the Galaxy S26 Ultra needs a firewall app. Our pick is Rethink, listed in the stores as “Rethink: DNS + Firewall + VPN”. It’s free, open source (Apache-2.0) and needs no root. It works as a local VPN: traffic is filtered on the phone and goes nowhere else unless you add a VPN server yourself.

1. Install Rethink from Google Play. Auto Blocker stops installs from outside Galaxy Store and Play, and Samsung says apps from other sources can’t update while it’s on, so the F-Droid build would mean switching Auto Blocker off for every update.
2. Open it, keep the default mode, “DNS and Firewall”, tap Start and accept Android’s VPN request.
3. Go to Configure > Apps. Every app has a Wi-Fi switch and a mobile-data switch. Block both for apps that work offline: Gallery, Calculator, Voice Recorder, Samsung Notes if you don’t sync it, the keyboard and offline games. Block only mobile data for photo backup.
4. Turn Android’s Private DNS off: Settings > Connections > More connection settings > Private DNS > Off. Rethink warns that Private DNS overrides its own DNS, so pick your filtering resolver under Configure > DNS instead. You keep the blocking and gain a per-app log.
5. Open Settings > Connections > More connection settings > VPN, tap the gear next to Rethink, and turn on Always-on VPN and Block connections without VPN. If Rethink ever stops, apps lose the network instead of slipping past it.
6. Settings > Apps > Rethink > Battery and choose Unrestricted, so One UI doesn’t put it to sleep.

Leave it running for a day, then open Rethink’s logs to see which apps connect where. A few catches:

• Android runs one VPN at a time. Samsung’s Secure Wi-Fi and any VPN app compete for the same slot. Rethink can carry your VPN provider’s WireGuard settings, so you can keep both the firewall and the VPN.
• Apps inside Secure Folder run in a separate profile that Rethink doesn’t cover.
• Devices on your hotspot bypass it.
• If Wi-Fi calling or Android Auto stops working, set the apps involved to “Bypass DNS & Firewall” in Rethink’s app list.

NetGuard is the simpler, firewall-only alternative. Our NetGuard and Rethink side-by-side compares them.

How anonymous can the Galaxy S26 Ultra get?

Start with the hard limit. While the phone is on, your carrier knows roughly where it is. The EFF puts it plainly: “There is no way to hide from this kind of tracking as long as your mobile phone is powered on.” In April 2024 the FCC fined T-Mobile, AT&T, Verizon and Sprint nearly $200 million for selling customers’ location data, and in June 2026 the Supreme Court upheld the AT&T and Verizon fines. No phone setting changes what the network sees. What you can cut is the trail to advertisers, apps and the people around you.

People nearby

• Device name: Settings > About phone > Device name. Samsung says it’s visible to Bluetooth and Wi-Fi devices. Keep the model name or anything else that isn’t your name.
• Quick Share: Settings > Connected devices > Quick Share > Who can share with you. Pick Contacts or Your devices; Everyone switches back after 10 minutes.
• Wi-Fi address: Android gives each network a random MAC address by default, but keeps the same one for that network until a factory reset. Networks saved long ago may still use the real one: tap the gear next to a saved network and check that MAC address type reads Randomized MAC.

Photos and finding networks

• Camera: Camera > Settings > Location tags, off. New photos then carry no GPS position.
• Sharing older photos: in Gallery, tick Remove location data on the share screen. Maximum restrictions does this automatically.
• Samsung offline finding: Settings > Security and privacy > Lost device protection > Offline finding. Samsung says this makes your phone a “Find Node” that helps locate other people’s SmartTags and Galaxy devices. If you keep it on, turn on Encrypt offline location.
• Google’s Find Hub network: Settings > Google > All services > Find Hub > Find your offline devices. The options are Off, Without network, With network in busy places only and With network everywhere. By default your phone joins the crowd network that locates other people’s devices; Without network keeps it out. The cost of opting out is that a lost phone is harder to find once it goes offline.

Your number and accounts

• Prepaid lines: no federal law requires ID to buy prepaid service today. That may change: a May 2026 FCC proposal (FCC 26-27, aimed at robocalls) would have voice providers collect your name, address and ID number, and it was still open in October 2026. Either way, paying by card or giving an email at checkout ties the line to you.
• Wi-Fi calling: Settings > Connections > Wi-Fi Calling > Emergency Address shows the address your carrier keeps on file for 911. If you don’t want your home address tied to the account, leave Wi-Fi calling off.
• Accounts: You can skip the Samsung account at setup, but the Galaxy Store needs one. Google Play needs a Google account, so give it as little as you can.
• Sign-ups: use email aliases for apps and shops. SimpleLogin’s free plan gives 10 aliases, and addy.io offers unlimited standard aliases on its free tier. Both forward to your real inbox, so the alias service itself still knows who you are.

Browsing and traffic

• Samsung Internet: use Secret mode (Tabs > Secret mode). Smart anti-tracking is on by default; leave it that way.
• Tor Browser for Android: the Tor Project’s official app, on Google Play and F-Droid. Use it for searches and sites you don’t want tied to your connection.
• A VPN that doesn’t need your email: Mullvad issues a random account number and takes cash by post or Monero; IVPN generates an account ID and also takes cash. Load its WireGuard settings into Rethink and the firewall keeps working. A VPN hides your browsing from the carrier and Wi-Fi owner, not your location from the cell network.
• Tor for chosen apps: Rethink has a one-tap Orbot option that sends traffic through Tor. Install Orbot first.
• Airplane mode: the GrapheneOS FAQ calls it “the only way to avoid the cellular network tracking your device.” It doesn’t erase what the carrier logged before you switched it on, but it’s the honest answer for a sensitive trip.

Quick checklist

• One UI 9 and the latest monthly patch installed
• Privacy Display set for apps, PIN entry and pop-ups
• “Process data only on device” on; Writing assist trimmed
• AI Assistant Activity reviewed
• Enhanced data protection on, recovery code stored
• Samsung diagnostics and Customization Service off; opt-out filed
• Advertising ID deleted
• Auto Blocker on; Maximum restrictions decided
• Theft protection, Identity check and network lock on
• Private DNS (or Rethink’s DNS) set; bloat disabled; carrier ads off
• Rethink blocking offline apps; Always-on VPN and Block connections without VPN on
• Device name, Quick Share, randomized MAC checked
• Camera location off; Find Hub network choice made

Check the unlocked Galaxy S26 Ultra on Amazon
affiliate link — same price for you, small commission for us

The other nine phones get the same treatment in our US top-10 phone privacy hub.