Private DNS, permissions and settings lockdown

Part of the max-degoogle any Android phone series.

Menu names differ between Pixel, Samsung, Xiaomi and others. When a path below doesn’t match your phone, use the search box at the top of Settings — every setting here is searchable by the name in bold.

1. Private DNS: block trackers for every app (Android 9+)

Every app looks up domain names before it connects. Private DNS, added in Android 9, sends those lookups encrypted (DNS over TLS) to a resolver you choose. Choose one that refuses to resolve ad and tracker domains, and those connections fail in every app — including system apps you couldn’t remove or firewall.

Settings → Network & internet → Private DNS → Private DNS provider hostname, then enter one of:

Hostnames from each provider’s own documentation: AdGuard, Mullvad, Quad9. For NextDNS, create a free configuration at nextdns.io; its setup page shows the personal hostname to paste into Android.

Good to know:

• If a site or app breaks, switch to a less aggressive option (Quad9, or AdGuard’s unfiltered resolver) rather than off.
• A VPN or RethinkDNS takes over DNS while it runs. RethinkDNS has its own blocklists — see the firewall guide.
• DNS blocking stops connections to known tracking domains; it can’t stop tracking that comes from the same domain as the content.

2. Advertising ID: delete it

Google Play services gives every phone an advertising ID that apps can read to link your activity. You can delete it entirely — apps then receive a string of zeros instead (Google’s documentation).

Settings → search Ads (on Pixel: Security & privacy → Other privacy settings → Ads; on most others: Google → Ads) → Delete advertising ID → confirm.

3. Google account activity: turn it off and auto-delete

On myactivity.google.com/activitycontrols, or Settings → Google → Manage your Google Account → Data & privacy:

• Web & App Activity → off (and delete existing activity, or set auto-delete).
• Timeline / Location History → off.
• YouTube History → off or auto-delete.
• Personalized ads (Ad Center) → off.

On the phone, search Settings for Usage & diagnostics and turn it off — it sends device usage and crash data to Google.

4. Permissions: the five-minute audit

Settings → Security & privacy → Privacy → Permission manager (Android 10+; search “Permission manager”). Go through these categories and remove access from anything that doesn’t obviously need it:

• Location — maps, weather, ride apps. Almost nothing else.
• Camera / Microphone — camera, messaging, video calls.
• Contacts, Call logs, SMS — your dialer and messaging apps. Messaging apps that ask for contacts can usually work without them.
• Nearby devices, Physical activity, Body sensors — rarely needed.

Built-in features that help:

• “Only this time” (Android 11+) — grant location, camera or mic for one use.
• Unused apps (Android 11+) — Android removes permissions from apps you haven’t opened in months. Make sure it’s on (App info → Pause app activity if unused / Remove permissions if app is unused).
• Privacy dashboard (Android 12+) — shows which apps used location, camera and mic in the last 24 hours. Check it once after your audit — surprises are the point.
• Camera and microphone toggles (Android 12+) — quick-settings tiles that cut camera or mic access for all apps at once.

5. Location, done right

• Approximate location (Android 12+): when an app asks for location, choose Approximate. Weather and local news don’t need your exact address.
• “Allow only while using the app” instead of “all the time” for everything except navigation you rely on in the background.
• Settings → Location → Location services:
  • Google Location Accuracy → off. It uses Wi-Fi and mobile networks to locate you faster by sending data to Google.
  • Wi-Fi scanning and Bluetooth scanning → off. These let apps and services scan for nearby networks and devices even when Wi-Fi or Bluetooth is turned off.
• Emergency Location Service — leave it on. It only sends your location when you call or text an emergency number.

6. Find Hub (formerly Find My Device): decide, don’t default

Google’s Find Hub lets you ring, lock or erase a lost phone — and requires Google to know where the phone is. If you keep a Google account on the phone and fear losing it more than you fear the location data, keep it on. If you’re retiring the account, turn it off and rely on a strong screen lock plus regular backups instead.

7. Lock screen and notifications

• Settings → Notifications → Notifications on lock screen → hide silent and sensitive notifications (or show “conversations only”).
• Turn off Sensitive notifications on the lock screen, so message contents don’t show to anyone holding your phone.
• Use a 6-digit PIN or longer passcode, not a pattern.
• Set a short screen timeout and enable lockdown in the power menu (it disables fingerprint/face unlock until the PIN is entered — useful at borders and protests).

8. Network hardening

• Allow 2G → off, on phones that offer it (Pixels since Android 12; other brands vary). 2G’s weak security is what fake base stations exploit — Google’s own security team calls disabling the 2G stack the best strategy where you don’t need it.
• Wi-Fi → turn off Notify for public networks / auto-connect to open networks.
• Bluetooth and NFC → off when not in use.
• Use randomized MAC (the default since Android 10) for every saved Wi-Fi network.

9. Google apps you keep: make them quieter

If you still use Chrome, Google Maps or the Play Store for now:

• In Chrome: turn off Make searches and browsing better and Help improve Chrome; set a non-Google search engine. Better: switch browsers.
• In the Play Store: turn off Personalization based on your app use where offered, and disable auto-update over mobile data.
• In Gboard (if you keep it): turn off Share usage statistics and Improve for everyone. Better: a private keyboard.

Checklist

• Private DNS set to a filtering resolver
• Advertising ID deleted
• Web & App Activity, Location History off; Usage & diagnostics off
• Permission audit done; “Only this time” used for one-off access
• Location: approximate where possible, Google Location Accuracy off, scanning off
• Find Hub: deliberate decision
• Lock screen hides message contents; 6+ digit PIN
• 2G off (if available), auto-join open Wi-Fi off

Next step

Settings can only do so much — the last mile is how you use the phone: Privacy habits that actually matter →