What your phone's privacy settings really do

A new phone can ask for dozens of permissions before you have finished setting it up. An app wants your location, camera, microphone, contacts, photos, Bluetooth access or permission to send alerts. Tapping “Allow” is easy, yet each choice changes what the app can observe, store or share.

Privacy settings are not a single switch that makes a device invisible. They are a collection of controls covering app access, advertising identifiers, account activity, network connections and information displayed on a locked screen. Some settings stop collection altogether, while others merely limit how data is used.

For Australians, the issue also sits alongside everyday habits such as using public Wi-Fi on a Sydney train, checking a banking app in Melbourne or relying on maps during a road trip through regional Queensland. Understanding the practical effect of each control makes it easier to choose convenience without giving away more information than necessary.

Permissions control access, not trust

When an app requests access to your camera or microphone, the operating system is asking whether that app may use the relevant hardware. It does not mean the camera is recording continuously, and denying access does not automatically make the app unsafe. A photo-editing app may reasonably need your photo library, while a simple torch app has little reason to request contacts or precise location.

Modern iPhones and Android phones generally let you choose between options such as “Allow once”, “Allow while using the app”, “Allow all the time” and “Don’t allow”. The wording varies by software version. “While using” is usually a sensible choice for navigation, whereas “always” should be reserved for an app whose main function genuinely depends on background location.

Permissions can be reviewed later through the phone’s privacy dashboard or settings menu. Android may show a timeline of recent access, and iOS displays indicators when the microphone or camera is active. These indicators are useful warnings, but they do not explain what happens to the information after an app receives it. An app can still upload data under its privacy policy or share it with service providers.

Location access reveals more than a map pin

Location data can identify a person’s movements, routines and interests. A map app may need precise positioning to provide turn-by-turn directions, but a weather app might work with an approximate suburb. A shopping app may ask for location to find nearby stores, though its marketing benefit can be greater than its practical need.

“Precise location” and “approximate location” are different permissions. Turning off precision can stop an app from seeing an exact address while still allowing it to identify a general area. Background access is more revealing because it permits collection when the app is not visibly open. Reviewing these choices is especially worthwhile after installing travel, fitness, dating or delivery services.

Location history may also exist at the account level. Google Maps Timeline, Apple location features and similar services can retain places visited even when a particular app’s permission seems limited. Deleting the app may not delete old account records. Look for activity controls, saved history and automatic deletion options, rather than assuming an uninstall wipes everything.

Tracking controls limit advertising profiles

A phone’s advertising identifier is a changeable code that helps advertising networks recognise a device across apps. It is not the same as your name, but it can contribute to a profile built from searches, purchases, browsing behaviour and app activity. Resetting or restricting the identifier makes tracking harder; it does not remove all personalised advertising.

On an iPhone, App Tracking Transparency asks whether an app may track activity across other companies’ apps and websites. Choosing “Ask App Not to Track” blocks the permission covered by that system. Android offers advertising controls that may allow users to delete or reset the advertising ID and reduce ad personalisation. Menus and labels can change after an operating system update.

This distinction matters because tracking and analytics are not identical. A company may still collect information about how its own app is used for security, performance or internal advertising. Turning off personalised ads can change the adverts you see without reducing the number of adverts. For a broader explanation of the decisions worth checking before granting access, these privacy basics provide useful background.

Photos, contacts and Bluetooth need careful review

Photo access can expose far more than the image an app needs. A social media service might require one selected picture, while a full-library permission can reveal images containing children, documents, home addresses, screenshots or travel details. iOS and Android increasingly provide a photo picker that lets you share selected items instead of opening the entire library.

Contacts are similarly sensitive. An app that receives an address book may gain names, phone numbers, email addresses and information about people who never agreed to share it. Messaging and calling services have a clearer reason to request contacts, but a game, discount app or quiz usually does not. If an app works without the permission, refusal is a reasonable default.

Bluetooth access is sometimes necessary for headphones, smart watches, medical devices or car systems. It can also be used to discover nearby devices and support location-related features. When visiting a busy shopping centre in Brisbane or using public transport in Melbourne, there is little benefit in giving every app permanent access to nearby devices.

Account settings matter as much as device settings

Privacy controls inside a phone do not govern everything held by an online account. A social platform, cloud storage provider or email service may retain search history, uploaded files, contacts, messages and device information. Two phones with identical settings can therefore create different privacy outcomes because their account histories and app profiles differ.

Check what is synchronised to iCloud, Google, Microsoft or another account. Backup can protect precious photos if a phone is lost, but it also places copies on remote servers. Review shared albums, family groups, connected devices and third-party sign-ins. Removing an old tablet or unfamiliar browser session can be more effective than changing a minor app permission.

Strong account security supports privacy as well. Use a long, unique password and enable multi-factor authentication, preferably with an authenticator app or security key where practical. A text message code is useful, though it can be vulnerable to phone-number theft. Australians should be cautious of unexpected messages claiming to come from a bank, myGov or a delivery company, particularly when they ask for a login or one-time code.

Network and lock-screen controls reduce exposure

A privacy setting cannot make an untrusted network private. Public Wi-Fi in airports, hotels and cafés may be legitimate, but a criminal can create a network with a convincing name. HTTPS protects many connections, yet it does not stop a fake sign-in page, malicious app or careless sharing of sensitive information. Mobile data is often the safer choice for banking or account recovery when the network seems uncertain.

A VPN can encrypt traffic between the phone and the VPN provider, but it does not make the user anonymous. The provider may see connection information, and websites can still recognise a person through account logins, cookies or browser fingerprinting. Free VPN services deserve particular scrutiny because their business model may involve advertising, data collection or weak security.

Lock-screen notifications are another overlooked source of exposure. Message previews, authentication codes and appointment details can appear while a phone sits on a desk or is handed to someone for a quick call. Set notifications to show only that a message has arrived, or require the phone to be unlocked before displaying its contents. Also review emergency contacts and medical ID settings, since these are designed to reveal selected information when help is needed.

Privacy menus are worth revisiting after installing a major update, changing phones or adding a new collection of apps. Permission managers can reveal which services have used the microphone, location or camera recently. Delete apps that are no longer needed, because an unused app can retain account data and may receive future updates that alter its behaviour.

The most useful approach is selective rather than extreme. Give an app the narrowest access that still lets it perform its job, prefer one-time or approximate location where suitable, restrict cross-app tracking, and check cloud accounts separately. The key point to remember is simple: your phone’s privacy settings control doors into your information, but you still decide which doors need to be open.