Pixel 10 privacy guide: tame the AI or switch to GrapheneOS

A year after launch, the Pixel 10 is still selling steadily on Amazon, often below its $799 launch price. It runs the Tensor G5 chip and Android 17, and Google guarantees OS and security updates until August 2032. It also happens to be the phone GrapheneOS points people to right now: when the project declined to support the Pixel 11, it called the Pixel 10 “cheaper with similar hardware and MTE.”

That gives Pixel 10 owners a real choice. You can keep Google’s software and tame Google’s AI and tracking features one by one, or you can switch to GrapheneOS and remove Google from the system entirely. This guide covers both, starting with the stock route. It belongs to our series of privacy guides for the top 10 US Android phones.

The short version

• Keep stock Pixel OS if you need Google Wallet tap-to-pay, use a Verizon-bought Pixel 10, or don’t want to wipe the phone. Expect to trim most of what Google collects, but not all of it: Google Play Services keeps its system privileges.
• Run GrapheneOS if you want the Pixel 10 without Google built in. It’s officially supported, LineageOS is too, and CalyxOS isn’t (it covers the 10a, not the 10).

Either way, back up first (Settings > Google > All services > Backup and restore) and install any pending system update. One warning about that backup: Google end-to-end encrypts some of it with your screen lock, but not Google Photos or MMS media. And because Google’s help pages describe “recent Pixels” without naming versions, menu names may differ slightly on your phone; the Settings search bar finds anything below.

Path A: harden stock Pixel OS, one data collector at a time

Rather than a long list of switches, think about who can see what. There are five audiences on a stock Pixel 10.

Google’s AI features

The Pixel 10 launched with Google’s newest screen-reading AI features, so start here.

1. Magic Cue (US): it surfaces information from your apps while you use other apps, processed “on your device or in the cloud”, in Google’s words. Turn it off under Settings > Magic Cue, or limit it per app with Settings > Apps > [app] > Screen Access > Proactive Assistance.
2. Pixel Screenshots: open the Screenshots app > Settings, turn off “Search your screenshots with AI”, then tap Delete all AI summaries and metadata. Google says this processing can also happen on the device or in the cloud.
3. Gemini: in the Gemini app, tap your profile > Gemini Apps Activity > Turn off, and delete past activity (also at myactivity.google.com/product/gemini). Google keeps chats for 72 hours even with this off, and chats chosen for human review for up to three years.
4. On-device models: Gemini Nano runs locally through AICore, which is the better trade-off. To reset what Android System Intelligence has learned, use Settings > Security & privacy > More security & privacy > Android System Intelligence > Clear data.
5. Call Screen: screening runs on the phone and transcripts stay there. If you don’t want audio kept, turn off Save Call Screen audio in the Phone app > Settings > Spam and Call Screen.

Google, through your account

• Web & App Activity: turn it off at myactivity.google.com. Google is rolling out a split into “Search Services History” and “Personalized Recommendations” (google.com/search-personalization), so you may need to turn off both.
• YouTube history and Voice Match: off, under Data & privacy in your Google Account.
• Usage & diagnostics: Settings > Google > three-dot menu > Usage & diagnostics > off.
• Find Hub network: Settings > Google > All services > Find Hub > Find your offline devices. The choices run from Off and Without network to busy places only or everywhere; the first two share the least.

Timeline (location history) now lives on the phone and is off by default, so leave it alone unless you turned it on.

Advertisers

Settings > Google > All services > Privacy & security > Ads > Ads privacy has three switches: Ad topics, App-suggested ads and Ad measurement. Turn all three off, then use Delete advertising ID on the Ads page.

Your carrier is the other advertiser. Verizon’s Custom Experience (My Verizon > Privacy preferences, or 866-211-0874), AT&T’s personalized ads (att.com/PrivacyChoices and att.com/cpni/optout) and T-Mobile’s ad and analytics settings (the T-Mobile Privacy Dashboard) are all on by default.

Apps on the phone

The Privacy dashboard (Settings > Security & privacy > Privacy > Privacy dashboard) shows seven days of location, camera and microphone use. Anything surprising there, fix in Permission manager on the same screen. Give maps and weather apps approximate location only: Settings > Location > App location permissions > [app] > Use precise location off.

Apps that shouldn’t be online at all, like a gallery or a keyboard, can be cut off with a firewall app that needs no root. For a calmer phone overall, Private space (Settings > Security & privacy > Privacy > Private space) hides a second set of apps that stop running when it’s locked.

Someone holding your phone

1. Settings > Google > All services > Personal & device safety > Theft protection: turn on Theft Detection Lock, Offline Device Lock and Identity Check. Identity Check asks for your fingerprint or face outside trusted places before anyone can change the screen lock, see saved passwords, factory reset or turn off Find Hub.
2. Turn off Extend Unlock under Settings > Security & privacy > More security & privacy if you don’t want the phone staying unlocked near trusted places or devices.
3. USB data protection blocks new USB data connections while the phone is locked. It comes on with Advanced Protection; search Settings for “USB” to check it on its own.
4. Set a SIM PIN (Settings > Security & privacy > More security settings > SIM lock).
5. At a border or a protest, hold Power + Volume Up and tap Lockdown: biometrics and notifications stay off until you type your PIN.

Your network

• Encrypted DNS: Settings > Network & internet > Private DNS > Private DNS provider hostname. Pick a filtering provider from our DNS and settings lockdown guide.
• 2G network protection: Settings > Network & internet > SIMs > [your SIM]; keep it on.
• Mobile network security notifications: Android 16 added alerts for unencrypted connections and for networks asking for your SIM’s identity (IMSI). They’re off by default and need modem support; secondary reports list the Pixel 10 as supported. On recent versions this sits under Settings > Security & privacy > More security & privacy > Mobile network security; if you don’t see it, search Settings for “network security”.

Want the maximum on stock? Advanced Protection bundles many of these settings and blocks sideloading. Our Pixel 11 walkthrough explains what it switches on and what it costs you.

Path B: run GrapheneOS on the Pixel 10

GrapheneOS lists the Pixel 10, 10 Pro, 10 Pro XL and 10 Pro Fold as supported, and the Pixel 10 has the memory tagging (MTE) hardware GrapheneOS treats as a requirement. That’s why the Pixel 11 news story ended with “buy a Pixel 10 instead”. Updates follow Google’s: GrapheneOS’s FAQ says official support typically ends shortly after Google’s guaranteed date, which is August 2032 here.

Check two things before you order or wipe

• Unlocked, not Verizon. Verizon Pixels have OEM unlocking disabled by a carrier ID, and there’s no fix. Our Pixel 10 phone page lists the model details.
• Your eSIM. US Pixel 10 phones are eSIM-only. An eSIM already on the phone keeps working after the install. To add or move one later, GrapheneOS has a switch at Settings > Network & internet > eSIM support that enables Google’s eSIM component without the Play Store. Easiest path: set up your eSIM on stock first.

How the install goes

You need a computer with 2 GB of free memory and 32 GB of storage (or an Android 14 to 17 phone), plus Chrome, Chromium, Edge or Brave with Shields off; Flatpak and Snap browsers don’t work. On the Pixel 10 you enable OEM unlocking in Developer options while online, then boot to fastboot by holding Volume Down. The official installer at grapheneos.org/install/web then unlocks the bootloader (this wipes the phone), flashes GrapheneOS and relocks. Finish by turning OEM unlocking off and verifying the boot key hash or using Auditor. Our step-by-step browser install guide walks through every screen.

Stock vs GrapheneOS on the Pixel 10

What stops working

• Tap-to-pay with Google Wallet. Google says it may not work on uncertified or modified software. Some banks have their own tap-to-pay apps; a physical card always works.
• Some bank and security apps. Apps that check Google’s Play Integrity may refuse to run. Many work once you add sandboxed Google Play, but GrapheneOS’s attestation guide names apps that block it, including Authy, TextNow and Strava.

Android Auto does work.

LineageOS instead?

LineageOS also has official Pixel 10 builds. It takes a different approach to security and app compatibility than GrapheneOS. If you’re choosing between them, read our comparison of the private Android systems first.

Block apps from the internet with Rethink

Stock Pixel software has no per-app switch for the internet. Data Saver (Settings > Network & internet > Data Saver) and each app’s Background data setting (Settings > Network & internet > SIMs > [your SIM] > App data usage > [app]) only limit mobile data, and Wi-Fi stays open. To block an app on every network, the Pixel 10 needs a firewall app. Our pick is Rethink, listed in the stores as “Rethink: DNS + Firewall + VPN”. It’s free, open source (Apache-2.0) and needs no root. It works as a local VPN: traffic is filtered on the phone and goes nowhere else unless you add a VPN server yourself.

1. Install Rethink from Google Play or F-Droid. If you turn on Advanced Protection, it blocks apps from unknown sources and their updates, so pick the Play version in that case.
2. Open it, keep the default mode, “DNS and Firewall”, tap Start and accept Android’s VPN request.
3. Go to Configure > Apps. Every app has a Wi-Fi switch and a mobile-data switch. Block both for apps that work offline: the gallery, calculator, recorder, a local notes app, the keyboard and offline games. Block only mobile data for photo backup.
4. Turn Android’s Private DNS off: Settings > Network & internet > Private DNS > Off. Rethink warns that Private DNS overrides its own DNS, so pick your filtering resolver under Configure > DNS instead. You keep the blocking and gain a per-app log.
5. Open Settings > Network & internet > VPN, tap the gear next to Rethink, and turn on Always-on VPN and Block connections without VPN. If Rethink ever stops, apps lose the network instead of slipping past it.
6. Settings > Apps > Rethink > App battery usage and allow unrestricted background use.

Leave it running for a day, then open Rethink’s logs to see which apps connect where. A few catches:

• Android runs one VPN at a time. Rethink can carry your VPN provider’s WireGuard settings, so you can keep both the firewall and the VPN.
• Apps in Private space aren’t covered: Rethink lists Always-on VPN not starting there as an open bug.
• Devices on your hotspot bypass it.
• If Wi-Fi calling or Android Auto stops working, set the apps involved to “Bypass DNS & Firewall” in Rethink’s app list.

On GrapheneOS you don’t need the VPN trick for blocking: every app has a Network permission you can switch off at install time or in App info. Rethink is still worth it for DNS blocklists and the connection log.

NetGuard is the simpler, firewall-only alternative. Our NetGuard and Rethink side-by-side compares them.

How anonymous can the Pixel 10 get?

Start with the hard limit. While the phone is on, your carrier knows roughly where it is. The EFF puts it plainly: “There is no way to hide from this kind of tracking as long as your mobile phone is powered on.” In April 2024 the FCC fined T-Mobile, AT&T, Verizon and Sprint nearly $200 million for selling customers’ location data, and in June 2026 the Supreme Court upheld the AT&T and Verizon fines. No phone setting changes what the network sees. What you can cut is the trail to advertisers, apps and the people around you.

People nearby

• Device name: Settings > About phone > Device name. Bluetooth devices see this name, so keep your own name out of it. The hotspot has its own name under Settings > Network & internet > Hotspot & tethering > Wi-Fi hotspot.
• Quick Share: search Settings for “Quick Share”, then Who can share with you. Pick Your devices or Contacts; Everyone switches back after 10 minutes.
• Wi-Fi address: Android gives each network a random MAC address by default, but keeps the same one for that network until a factory reset. Networks saved long ago may still use the real one: open Settings > Network & internet > Internet, tap the gear next to a saved network and check its privacy setting uses a randomized MAC.
• On GrapheneOS the MAC address changes on every connection by default, which is stronger than stock Android’s one-per-network address.

Photos and finding networks

• Camera: in the Camera app, open Settings > More settings and turn off Save location.
• Sharing: Google Photos leaves locations out of shared links and albums by default (partner sharing is the exception). Other apps may keep them, so share photos taken before you changed the camera setting with care.
• Google’s Find Hub network: Settings > Google > All services > Find Hub > Find your offline devices. The options are Off, Without network, With network in busy places only and With network everywhere. By default your phone joins the crowd network that locates other people’s devices; Without network keeps it out. The cost of opting out is that a lost phone is harder to find once it goes offline.

Your number and accounts

• Prepaid lines: no federal law requires ID to buy prepaid service today. That may change: a May 2026 FCC proposal (FCC 26-27, aimed at robocalls) would have voice providers collect your name, address and ID number, and it was still open in October 2026. Either way, paying by card or giving an email at checkout ties the line to you.
• Wi-Fi calling: when you switch on Wi-Fi calling, your carrier asks for an emergency (E911) address and keeps it on file. If you don’t want your home address tied to the account, leave Wi-Fi calling off.
• Accounts: Stock Pixel software needs a Google account for the Play Store. On GrapheneOS, sandboxed Google Play is optional, and Aurora Store can install Play apps with shared anonymous accounts. F-Droid flags it because your app list and device details still go to Google’s servers.
• Sign-ups: use email aliases for apps and shops. SimpleLogin’s free plan gives 10 aliases, and addy.io offers unlimited standard aliases on its free tier. Both forward to your real inbox, so the alias service itself still knows who you are.

Browsing and traffic

• Tor Browser for Android: the Tor Project’s official app, on Google Play and F-Droid. Use it for searches and sites you don’t want tied to your connection.
• A VPN that doesn’t need your email: Mullvad issues a random account number and takes cash by post or Monero; IVPN generates an account ID and also takes cash. Load its WireGuard settings into Rethink and the firewall keeps working. A VPN hides your browsing from the carrier and Wi-Fi owner, not your location from the cell network.
• Tor for chosen apps: Rethink has a one-tap Orbot option that sends traffic through Tor. Install Orbot first.
• Airplane mode: the GrapheneOS FAQ calls it “the only way to avoid the cellular network tracking your device.” It doesn’t erase what the carrier logged before you switched it on, but it’s the honest answer for a sensitive trip.

Quick checklist

• Magic Cue, AI screenshot search and Gemini Apps Activity off
• Web & App Activity (or its replacements), YouTube history, Voice Match off
• Ad topics, App-suggested ads, Ad measurement off; advertising ID deleted
• Verizon, AT&T or T-Mobile ad program opted out
• Theft protection and Identity Check on; SIM PIN set
• Private DNS (or Rethink’s DNS) set; 2G protection on; network alerts checked
• For GrapheneOS: unlocked model, eSIM set up on stock, OEM unlocking off afterwards
• Rethink blocking offline apps; Always-on VPN and Block connections without VPN on
• Device name, Quick Share, randomized MAC checked
• Camera location off; Find Hub network choice made

Check current Pixel 10 deals on Amazon
affiliate link — same price for you, small commission for us

Other phones in the household? Back to the US top-10 privacy hub.