Pixel 10a privacy guide: harden it or install GrapheneOS

The Pixel 10a is Google’s mid-range phone for 2026. It launched in March at $499 and now costs $599 at the Google Store after Google’s October price rise. Inside are the Tensor G4 chip and Android 17, and Google promises seven years of OS and security updates, to March 2033.

For privacy, the 10a has one big advantage over almost everything else at this price: you’re allowed to replace the software. An unlocked 10a can run GrapheneOS, CalyxOS or LineageOS, all with official support. So this guide gives you two paths. Path A keeps Google’s own software and switches off what it can. Path B installs GrapheneOS. The 10a is one of ten phones in our privacy series on the best-selling Android phones in the US.

What you can and can’t fix on the Pixel 10a

On stock Pixel software, Google Play Services is part of the operating system. It has privileges that no toggle removes, and your Google account sits at the center of the phone. Hardening the stock software cuts what Google collects through your account, ads, location and AI features, and it makes a lost or stolen 10a much harder to get into. It can’t make Google’s own system apps stop talking to Google.

GrapheneOS can. It ships with no Google apps. If you want the Play Store, you add sandboxed Google Play as an ordinary app with no special access. The price is a wiped phone, an afternoon of setup and a few apps that won’t run.

Not sure yet? Do Path A today; nothing in it stops you flashing later.

Before you start

• Update: search Settings for “system update” and install anything waiting.
• Back up: Settings > Google > All services > Backup and restore. Google says some backup data is end-to-end encrypted with your screen lock, but Google Photos and MMS media are not. Copy your photos to a computer if you plan on Path B.
• Menus move: Google’s help pages describe “recent Pixels” without version numbers, so a menu name can differ slightly. If a path below doesn’t match, use the search bar at the top of Settings.

Path A: harden the stock Pixel 10a

1. Account switches

1. Open myactivity.google.com (or Settings > Google > Manage your Google Account > Data & privacy) and turn off Web & App Activity. Google is gradually splitting it into “Search Services History” and “Personalized Recommendations” for Search and Maps, managed at google.com/search-personalization, so you may see those names instead.
2. Turn off YouTube history on the same page.
3. Under Data & privacy, turn off Voice Match if you never say “Hey Google”.
4. On the phone, go to Settings > Google, tap the three-dot menu, open Usage & diagnostics and turn it off.

2. Ads

Go to Settings > Google > All services > Privacy & security > Ads > Ads privacy and switch off Ad topics, App-suggested ads and Ad measurement. Back on the Ads page, tap Delete advertising ID.

Your carrier runs its own ad program too, and it is on by default:

• Verizon: Custom Experience, under My Verizon > Privacy preferences, or call 866-211-0874.
• AT&T: personalized ads at att.com/PrivacyChoices, plus the CPNI opt-out at att.com/cpni/optout.
• T-Mobile: the T-Mobile Privacy Dashboard, with “Do not sell or share” and “Advertising and analytics”.

3. App permissions

1. Open Settings > Security & privacy > Privacy > Privacy dashboard. It shows which apps used location, camera and microphone in the last seven days.
2. Open Permission manager on the same screen and work down the list. Location, Microphone, Camera, Contacts and Nearby devices matter most.
3. For apps that need your area, not your street, go to Settings > Location > App location permissions > [app] and turn off Use precise location. The app then sees roughly a 3 km² area.
4. For apps you rarely open, go to Settings > Apps > [app] and turn on Pause app activity if unused.
5. Settings > Security & privacy > Privacy > Privacy controls has system-wide Camera access and Microphone access switches, plus Quick Settings tiles. While you’re there, turn on Show clipboard access if you see it.

4. Location services

Under Settings > Location > Location Services, turn off Location Accuracy, Wi-Fi scanning and Bluetooth scanning. Then decide how much the Find Hub network may use your phone: Settings > Google > All services > Find Hub > Find your offline devices offers Off, Without network, busy places only, or everywhere.

5. Private Space for the apps you don’t trust

Settings > Security & privacy > Privacy > Private space creates a separate, lockable area. Apps inside stop running when it’s locked and don’t appear in your app list. Google recommends a separate Google account for it. Two limits: it isn’t included in backups, and apps or ADB can detect that it exists. Nosy social apps belong here.

6. Theft and the lock screen

Go to Settings > Google > All services > Personal & device safety > Theft protection:

• Theft Detection Lock: locks the screen when the phone detects it being grabbed.
• Offline Device Lock: locks the screen when a thief takes the phone offline.
• Failed Authentication Lock: on by default; leave it that way.
• Identity Check: asks for your fingerprint or face, outside trusted places, before anyone can view saved passwords, change the screen lock, factory reset or turn off Find Hub.
• Remote Lock: lets you lock the phone from android.com/lock.

Then add a SIM PIN under Settings > Security & privacy > More security settings > SIM lock, and in the same area set Notifications on lock screen to hide sensitive content. Learn one shortcut: hold Power + Volume Up and tap Lockdown, which turns off fingerprint unlock and notifications until you enter your PIN.

7. Network

• Private DNS: Settings > Network & internet > Private DNS > Private DNS provider hostname. A filtering resolver blocks tracker domains in every app. Our Private DNS and permissions walkthrough lists providers. It only encrypts DNS, not your traffic.
• 2G network protection: under Settings > Network & internet > SIMs > [your SIM]. Leave it on so the phone won’t drop to old, easily intercepted 2G.

8. Gemini and call features

In the Gemini app, tap your profile > Gemini Apps Activity > Turn off, then delete past chats. Google says it’s on by default for adults, chats are kept 72 hours even when it’s off, and chats picked for human review can be kept up to three years.

Call Screen runs on the phone. If you don’t want recordings kept, open the Phone app > Settings > Spam and Call Screen and turn off Save Call Screen audio. To wipe what Android System Intelligence has learned, go to Settings > Security & privacy > More security & privacy > Android System Intelligence > Clear data.

9. Optional: Advanced Protection

Settings > Security & privacy > Other settings > Advanced Protection is Android’s strongest built-in mode, but it blocks installs from outside the Play Store, which rules out F-Droid and Obtainium. Our Pixel 11 guide explains everything it switches on.

10. Swap the apps

Settings only go so far while Chrome, Maps and Gboard do the daily work. Our private app starter pack has drop-in replacements, and a no-root per-app firewall can cut the network off for apps you keep.

Path B: install GrapheneOS on the Pixel 10a

GrapheneOS officially supports the Pixel 10a. Our browser install walkthrough covers each screen. Here’s what’s different on a 10a.

Check the model

The bootloader must be unlockable. Verizon Pixels use a carrier ID that disables OEM unlocking, so a Verizon-bought 10a can’t run GrapheneOS, CalyxOS or LineageOS. Buy the unlocked model from Google or an unlocked listing. If OEM unlocking is greyed out after you connect to the internet, the phone is locked to a carrier.

What you need

• A computer with 2 GB of free memory and 32 GB of free storage, or another phone on Android 14 to 17.
• Chrome, Chromium, Edge or Brave (turn Brave Shields off). A browser installed as a Flatpak or Snap won’t work.
• A good USB-C cable, and an hour.

The install in six steps

1. Back up, then turn on Developer options and enable OEM unlocking (the phone needs internet for this).
2. Hold Volume Down while the phone starts to reach fastboot mode, and connect it to the computer.
3. Open grapheneos.org/install/web and unlock the bootloader. This wipes the phone.
4. Download and flash the GrapheneOS release from the same page.
5. Lock the bootloader again from the installer.
6. After first setup, turn OEM unlocking off. Check the verified boot key hash against the one on the install page, or use the Auditor app.

What changes

No Google apps, no Google telemetry. You get Network and Sensors permission switches per app, Storage Scopes and Contact Scopes (an app sees only what you pick), an automatic reboot when the phone sits locked (18 hours by default), USB-C that charges only while locked, a duress PIN, PIN scrambling, an LTE-only mode and memory tagging (MTE) across the system. Sandboxed Google Play is optional and runs as a normal app in whichever profile you install it. Android Auto is supported.

What breaks

• Google Wallet tap-to-pay: Google says it may not work on uncertified or modified software. Plan on a card or a bank app that has its own tap-to-pay.
• Some banking apps: apps that check Google’s Play Integrity can refuse to run. Many work fine with sandboxed Google Play; GrapheneOS keeps a list of apps that block it, such as Authy, TextNow and Strava.
• Verizon units: as above, not possible at all.

Comparing models? See our spec pages for the Pixel 9a and the Pixel 10.

CalyxOS and LineageOS on the 10a

GrapheneOS isn’t the only option here. CalyxOS supports the 10a (it doesn’t cover the regular Pixel 10), and LineageOS 24 supports it officially under the codename “stallion”. The same unlocked-model and eSIM rules apply. Both make different security and convenience trade-offs from GrapheneOS, which our GrapheneOS vs CalyxOS vs /e/OS comparison lays out.

Block apps from the internet with Rethink

Stock Pixel software has no per-app switch for the internet. Data Saver (Settings > Network & internet > Data Saver) and each app’s Background data setting (Settings > Network & internet > SIMs > [your SIM] > App data usage > [app]) only limit mobile data, and Wi-Fi stays open. To block an app on every network, the Pixel 10a needs a firewall app. Our pick is Rethink, listed in the stores as “Rethink: DNS + Firewall + VPN”. It’s free, open source (Apache-2.0) and needs no root. It works as a local VPN: traffic is filtered on the phone and goes nowhere else unless you add a VPN server yourself.

1. Install Rethink from Google Play or F-Droid. If you turn on Advanced Protection, it blocks apps from unknown sources and their updates, so pick the Play version in that case.
2. Open it, keep the default mode, “DNS and Firewall”, tap Start and accept Android’s VPN request.
3. Go to Configure > Apps. Every app has a Wi-Fi switch and a mobile-data switch. Block both for apps that work offline: the gallery, calculator, recorder, a local notes app, the keyboard and offline games. Block only mobile data for photo backup.
4. Turn Android’s Private DNS off: Settings > Network & internet > Private DNS > Off. Rethink warns that Private DNS overrides its own DNS, so pick your filtering resolver under Configure > DNS instead. You keep the blocking and gain a per-app log.
5. Open Settings > Network & internet > VPN, tap the gear next to Rethink, and turn on Always-on VPN and Block connections without VPN. If Rethink ever stops, apps lose the network instead of slipping past it.
6. Settings > Apps > Rethink > App battery usage and allow unrestricted background use.

Leave it running for a day, then open Rethink’s logs to see which apps connect where. A few catches:

• Android runs one VPN at a time. Rethink can carry your VPN provider’s WireGuard settings, so you can keep both the firewall and the VPN.
• Apps in Private space aren’t covered: Rethink lists Always-on VPN not starting there as an open bug.
• Devices on your hotspot bypass it.
• If Wi-Fi calling or Android Auto stops working, set the apps involved to “Bypass DNS & Firewall” in Rethink’s app list.

On GrapheneOS you don’t need the VPN trick for blocking: every app has a Network permission you can switch off at install time or in App info. Rethink is still worth it for DNS blocklists and the connection log.

NetGuard is the simpler, firewall-only alternative. Our NetGuard and Rethink side-by-side compares them.

How anonymous can the Pixel 10a get?

Start with the hard limit. While the phone is on, your carrier knows roughly where it is. The EFF puts it plainly: “There is no way to hide from this kind of tracking as long as your mobile phone is powered on.” In April 2024 the FCC fined T-Mobile, AT&T, Verizon and Sprint nearly $200 million for selling customers’ location data, and in June 2026 the Supreme Court upheld the AT&T and Verizon fines. No phone setting changes what the network sees. What you can cut is the trail to advertisers, apps and the people around you.

People nearby

• Device name: Settings > About phone > Device name. Bluetooth devices see this name, so keep your own name out of it. The hotspot has its own name under Settings > Network & internet > Hotspot & tethering > Wi-Fi hotspot.
• Quick Share: search Settings for “Quick Share”, then Who can share with you. Pick Your devices or Contacts; Everyone switches back after 10 minutes.
• Wi-Fi address: Android gives each network a random MAC address by default, but keeps the same one for that network until a factory reset. Networks saved long ago may still use the real one: open Settings > Network & internet > Internet, tap the gear next to a saved network and check its privacy setting uses a randomized MAC.
• On GrapheneOS the MAC address changes on every connection by default, which is stronger than stock Android’s one-per-network address.

Photos and finding networks

• Camera: in the Camera app, open Settings > More settings and turn off Save location.
• Sharing: Google Photos leaves locations out of shared links and albums by default (partner sharing is the exception). Other apps may keep them, so share photos taken before you changed the camera setting with care.
• Google’s Find Hub network: Settings > Google > All services > Find Hub > Find your offline devices. The options are Off, Without network, With network in busy places only and With network everywhere. By default your phone joins the crowd network that locates other people’s devices; Without network keeps it out. The cost of opting out is that a lost phone is harder to find once it goes offline.

Your number and accounts

• Prepaid lines: no federal law requires ID to buy prepaid service today. That may change: a May 2026 FCC proposal (FCC 26-27, aimed at robocalls) would have voice providers collect your name, address and ID number, and it was still open in October 2026. Either way, paying by card or giving an email at checkout ties the line to you.
• Wi-Fi calling: when you switch on Wi-Fi calling, your carrier asks for an emergency (E911) address and keeps it on file. If you don’t want your home address tied to the account, leave Wi-Fi calling off.
• Accounts: Stock Pixel software needs a Google account for the Play Store. On GrapheneOS, sandboxed Google Play is optional, and Aurora Store can install Play apps with shared anonymous accounts. F-Droid flags it because your app list and device details still go to Google’s servers.
• Sign-ups: use email aliases for apps and shops. SimpleLogin’s free plan gives 10 aliases, and addy.io offers unlimited standard aliases on its free tier. Both forward to your real inbox, so the alias service itself still knows who you are.

Browsing and traffic

• Tor Browser for Android: the Tor Project’s official app, on Google Play and F-Droid. Use it for searches and sites you don’t want tied to your connection.
• A VPN that doesn’t need your email: Mullvad issues a random account number and takes cash by post or Monero; IVPN generates an account ID and also takes cash. Load its WireGuard settings into Rethink and the firewall keeps working. A VPN hides your browsing from the carrier and Wi-Fi owner, not your location from the cell network.
• Tor for chosen apps: Rethink has a one-tap Orbot option that sends traffic through Tor. Install Orbot first.
• Airplane mode: the GrapheneOS FAQ calls it “the only way to avoid the cellular network tracking your device.” It doesn’t erase what the carrier logged before you switched it on, but it’s the honest answer for a sensitive trip.

Quick checklist

• Web & App Activity, YouTube history, Voice Match and Usage & diagnostics off
• Ad topics, App-suggested ads, Ad measurement off; advertising ID deleted
• Carrier ad program opted out
• Permissions reviewed; precise location off where it isn’t needed
• Location Accuracy and scanning off
• Theft Detection Lock, Offline Device Lock and Identity Check on; SIM PIN set
• Private DNS (or Rethink’s DNS) set; 2G network protection on
• Gemini Apps Activity off and deleted
• Path B only: unlocked (non-Verizon) model, eSIM activated, OEM unlocking off after install
• Rethink blocking offline apps; Always-on VPN and Block connections without VPN on
• Device name, Quick Share, randomized MAC checked
• Camera location off; Find Hub network choice made

Check the unlocked Pixel 10a on Amazon
affiliate link — same price for you, small commission for us

Next phone on your list? The full top-10 Android privacy series covers Samsung and Motorola too.