Pixel 11 privacy guide: the most private setup without GrapheneOS

The Pixel 11 went on sale in August 2026 at $899 for the 256GB model. It’s Google’s current flagship, with the Tensor G6 chip, the new Titan M3 security chip, Android 17 and seven years of updates, to August 2033. If you bought one, or one was handed to you at work, this guide gets the stock software as private as it goes.

That last part matters. Unlike the Pixel 10 and 10a, the Pixel 11 can’t run GrapheneOS today, and no other private OS supports it either. So everything here is about hardening Google’s own Pixel software, and the single most useful switch is Advanced Protection. It’s one of ten phones in our US best-seller privacy series.

Why there’s no GrapheneOS option for the Pixel 11

The bootloader on an unlocked (non-Verizon) Pixel 11 can be unlocked, so in theory it could take another OS. In practice, GrapheneOS has said no for now. Its core security relies on memory tagging (MTE), a chip feature that catches the memory bugs most phone exploits use, and on the Pixel 11 it shipped switched off in firmware. On October 1 the project wrote: “We’re not going to add support for the Pixel 11 series unless it ships MTE support… we can’t make any commitment to supporting the Pixel 11 series.”

Android 17 QPR2, expected in December, may change that, with no promise. Our Pixel 11 and GrapheneOS news story has the full timeline. Until then, don’t flash anything, and treat any “GrapheneOS for Pixel 11” download you find as unofficial.

What a hardened Pixel 11 can and can’t do

On the plus side, stock Pixel software already gets a lot right: seven years of OS and security updates, and the Titan M3, which GrapheneOS itself said should improve security before first unlock. What you can’t change is Google’s place in the system. Google Play Services keeps its privileges, and the account stays central. Your goal is to shrink what that account collects and make the phone a poor target for thieves and scammers.

Before you start, install any waiting system update, and back up via Settings > Google > All services > Backup and restore. Google’s help pages describe “recent Pixels” without version labels, so a menu can be named a little differently on your Pixel 11; the Settings search bar finds every setting below.

Step 1: turn on Advanced Protection

Go to Settings > Security & privacy > Other settings > Advanced Protection > Device protection. You can also reach it from Settings > Google > All services > Personal and device safety > Advanced Protection. One switch turns on a long list of protections:

• Apps: Google Play Protect locked on, installs from unknown sources blocked, memory tagging for apps that support it, and limits on which apps can use accessibility access.
• Theft: Theft Detection Lock, Offline Device Lock and Failed Authentication Lock on, plus an automatic reboot after 72 hours locked, which puts your data back behind your PIN.
• USB Protection: new USB data connections are blocked while the phone is locked.
• Calls and messages: scam protection in Google Messages, plus call screening and spam protection.
• Network: 2G network protection on, so the phone won’t fall back to weak 2G.
• Web: Chrome switches to HTTPS-only and turns off its JavaScript optimizer.
• Intrusion Logging (optional): end-to-end encrypted security logs kept in the cloud, useful if you ever suspect a targeted attack.

The cost is real. With sideloading blocked, you can’t install apps from F-Droid, Obtainium or a downloaded APK. If you depend on any of those, skip Advanced Protection and set the theft and network options by hand (Steps 4 and 6).

Step 2: Proactive Assistance, Magic Cue and Gemini

The Pixel 11 reads your screen to be helpful, and that’s the part to set deliberately.

1. Proactive Assistance: in the US and most countries, the Pixel 11’s screen-aware suggestions run under this name. Magic Cue, the version on the Pixel 10, is offered on the Pixel 11 only in the UK and Ireland. Google says processing happens “on your device or in the cloud”. Search Settings for “Proactive Assistance” (or “Magic Cue” in the UK and Ireland) to turn it off, or limit it per app at Settings > Apps > [app] > Screen Access > Proactive Assistance. Banking, health and messaging apps are good ones to exclude.
2. Gemini: open the Gemini app > your profile > Gemini Apps Activity > Turn off, then delete what’s there. It’s on by default for adults. Even off, Google keeps chats for 72 hours, and chats sent for human review for up to three years.
3. Screenshots with AI: if your Pixel has the Pixel Screenshots app, open its Settings, turn off “Search your screenshots with AI” and tap Delete all AI summaries and metadata.
4. Call Screen: it runs on the phone. To stop it keeping audio, turn off Save Call Screen audio in the Phone app > Settings > Spam and Call Screen.

Step 3: shrink the Google account

• Activity: turn off Web & App Activity at myactivity.google.com. If you see “Search Services History” and “Personalized Recommendations” instead, that’s Google’s gradual split; turn off both.
• YouTube and voice: turn off YouTube history and Voice Match in your Google Account under Data & privacy.
• Diagnostics: Settings > Google > three-dot menu > Usage & diagnostics > off.
• Play Protect’s upload option: keep Play Protect scanning on, but in Play Store > profile > Play Protect > gear you can turn off “Improve harmful app detection”, which sends unknown apps to Google.

Step 4: lock it against theft

Advanced Protection covers most of this. Check Settings > Google > All services > Personal & device safety > Theft protection anyway and turn on Identity Check. It demands your fingerprint or face, outside trusted places, before anyone can change your screen lock, view passwords, factory reset, turn off Find Hub or open developer options. Add a SIM PIN under Settings > Security & privacy > More security settings > SIM lock, and remember Remote Lock at android.com/lock. For the moment you hand your phone over, hold Power + Volume Up > Lockdown.

Step 5: location, permissions and private apps

1. Settings > Location > Location Services: turn off Location Accuracy, Wi-Fi scanning and Bluetooth scanning.
2. Settings > Google > All services > Find Hub > Find your offline devices: choose Off or Without network if you’d rather the phone not join Google’s crowd-sourced finding network.
3. Settings > Location > App location permissions > [app] > Use precise location off, for apps that only need your area (about 3 km²).
4. Settings > Security & privacy > Privacy > Privacy dashboard shows seven days of permission use; Permission manager next to it fixes what you don’t like.
5. Settings > Security & privacy > Privacy > Private space keeps a set of apps hidden and stopped when locked. It isn’t backed up, and apps can tell it exists.

Step 6: ads, carriers and the network

Google ads: Settings > Google > All services > Privacy & security > Ads > Ads privacy, then switch off Ad topics, App-suggested ads and Ad measurement, and delete the advertising ID.

Carrier ads, on by default:

• Verizon Custom Experience: My Verizon > Privacy preferences, or 866-211-0874.
• AT&T: att.com/PrivacyChoices and att.com/cpni/optout.
• T-Mobile: “Do not sell or share” and “Advertising and analytics” in the Privacy Dashboard.

Private DNS sits at Settings > Network & internet > Private DNS > Private DNS provider hostname; pick a tracker-blocking provider from our Private DNS settings guide. If you skipped Advanced Protection, turn on 2G network protection yourself under Settings > Network & internet > SIMs > [your SIM].

Step 7: replace the apps that report back

Settings reduce what Google’s apps send; replacing them removes it. Our 2026 private app starter pack covers the browser, keyboard, maps and messaging. Note that with Advanced Protection on, you’ll need replacements available on the Play Store.

Block apps from the internet with Rethink

Stock Pixel software has no per-app switch for the internet. Data Saver (Settings > Network & internet > Data Saver) and each app’s Background data setting (Settings > Network & internet > SIMs > [your SIM] > App data usage > [app]) only limit mobile data, and Wi-Fi stays open. To block an app on every network, the Pixel 11 needs a firewall app. Our pick is Rethink, listed in the stores as “Rethink: DNS + Firewall + VPN”. It’s free, open source (Apache-2.0) and needs no root. It works as a local VPN: traffic is filtered on the phone and goes nowhere else unless you add a VPN server yourself.

1. Install Rethink from Google Play. With Advanced Protection on, Android blocks apps from unknown sources and their updates, so the F-Droid build is out.
2. Open it, keep the default mode, “DNS and Firewall”, tap Start and accept Android’s VPN request.
3. Go to Configure > Apps. Every app has a Wi-Fi switch and a mobile-data switch. Block both for apps that work offline: the gallery, calculator, recorder, a local notes app, the keyboard and offline games. Block only mobile data for photo backup.
4. Turn Android’s Private DNS off: Settings > Network & internet > Private DNS > Off. Rethink warns that Private DNS overrides its own DNS, so pick your filtering resolver under Configure > DNS instead. You keep the blocking and gain a per-app log.
5. Open Settings > Network & internet > VPN, tap the gear next to Rethink, and turn on Always-on VPN and Block connections without VPN. If Rethink ever stops, apps lose the network instead of slipping past it.
6. Settings > Apps > Rethink > App battery usage and allow unrestricted background use.

Leave it running for a day, then open Rethink’s logs to see which apps connect where. A few catches:

• Android runs one VPN at a time. Rethink can carry your VPN provider’s WireGuard settings, so you can keep both the firewall and the VPN.
• Apps in Private space aren’t covered: Rethink lists Always-on VPN not starting there as an open bug.
• Devices on your hotspot bypass it.
• If Wi-Fi calling or Android Auto stops working, set the apps involved to “Bypass DNS & Firewall” in Rethink’s app list.

NetGuard is the simpler, firewall-only alternative. Our NetGuard and Rethink side-by-side compares them.

How anonymous can the Pixel 11 get?

Start with the hard limit. While the phone is on, your carrier knows roughly where it is. The EFF puts it plainly: “There is no way to hide from this kind of tracking as long as your mobile phone is powered on.” In April 2024 the FCC fined T-Mobile, AT&T, Verizon and Sprint nearly $200 million for selling customers’ location data, and in June 2026 the Supreme Court upheld the AT&T and Verizon fines. No phone setting changes what the network sees. What you can cut is the trail to advertisers, apps and the people around you.

People nearby

• Device name: Settings > About phone > Device name. Bluetooth devices see this name, so keep your own name out of it. The hotspot has its own name under Settings > Network & internet > Hotspot & tethering > Wi-Fi hotspot.
• Quick Share: search Settings for “Quick Share”, then Who can share with you. Pick Your devices or Contacts; Everyone switches back after 10 minutes.
• Wi-Fi address: Android gives each network a random MAC address by default, but keeps the same one for that network until a factory reset. Networks saved long ago may still use the real one: open Settings > Network & internet > Internet, tap the gear next to a saved network and check its privacy setting uses a randomized MAC.

Photos and finding networks

• Camera: in the Camera app, open Settings > More settings and turn off Save location.
• Sharing: Google Photos leaves locations out of shared links and albums by default (partner sharing is the exception). Other apps may keep them, so share photos taken before you changed the camera setting with care.
• Google’s Find Hub network: Settings > Google > All services > Find Hub > Find your offline devices. The options are Off, Without network, With network in busy places only and With network everywhere. By default your phone joins the crowd network that locates other people’s devices; Without network keeps it out. The cost of opting out is that a lost phone is harder to find once it goes offline.

Your number and accounts

• Prepaid lines: no federal law requires ID to buy prepaid service today. That may change: a May 2026 FCC proposal (FCC 26-27, aimed at robocalls) would have voice providers collect your name, address and ID number, and it was still open in October 2026. Either way, paying by card or giving an email at checkout ties the line to you.
• Wi-Fi calling: when you switch on Wi-Fi calling, your carrier asks for an emergency (E911) address and keeps it on file. If you don’t want your home address tied to the account, leave Wi-Fi calling off.
• Accounts: Google Play needs a Google account, and Advanced Protection rules out side stores such as Aurora, so keep that account separate from your personal email if you can.
• Sign-ups: use email aliases for apps and shops. SimpleLogin’s free plan gives 10 aliases, and addy.io offers unlimited standard aliases on its free tier. Both forward to your real inbox, so the alias service itself still knows who you are.

Browsing and traffic

• Tor Browser for Android: the Tor Project’s official app, on Google Play and F-Droid. Use it for searches and sites you don’t want tied to your connection.
• A VPN that doesn’t need your email: Mullvad issues a random account number and takes cash by post or Monero; IVPN generates an account ID and also takes cash. Load its WireGuard settings into Rethink and the firewall keeps working. A VPN hides your browsing from the carrier and Wi-Fi owner, not your location from the cell network.
• Tor for chosen apps: Rethink has a one-tap Orbot option that sends traffic through Tor. Install Orbot first.
• Airplane mode: the GrapheneOS FAQ calls it “the only way to avoid the cellular network tracking your device.” It doesn’t erase what the carrier logged before you switched it on, but it’s the honest answer for a sensitive trip.

Quick checklist

• Advanced Protection on (or theft and 2G settings set by hand)
• Proactive Assistance off or limited per app
• Gemini Apps Activity off and history deleted
• Web & App Activity, YouTube history, Voice Match, Usage & diagnostics off
• Identity Check on; SIM PIN set
• Location Accuracy and scanning off; precise location trimmed
• Google ad switches off; advertising ID deleted; carrier opted out
• Private DNS (or Rethink’s DNS) set
• Watching for GrapheneOS news after Android 17 QPR2
• Rethink blocking offline apps; Always-on VPN and Block connections without VPN on
• Device name, Quick Share, randomized MAC checked
• Camera location off; Find Hub network choice made

Check the unlocked Pixel 11 on Amazon
affiliate link — same price for you, small commission for us

Comparing phones before a purchase? The privacy hub for all ten US best-sellers ranks what each one can reach.