What your phone collects, who buys it, and the settings that actually matter
Most people assume their data is gone and there is nothing to be done. That is roughly half true, and the useful half is the other one. A phone straight out of the box shares your location continuously, lets every app build an advertising profile, and feeds your voice recordings and photos into systems you never agreed to specifically. Twenty minutes of settings changes cuts most of that off. The rest — data brokers who sell your address, phone number and family members to anyone with a credit card — takes an afternoon to reduce and matters more than people think, because that is where scammers get the detail that makes a call convincing. This guide is about the changes that make a real difference, not the ones that just make you feel careful.
Free PDF, about ten pages. No sign-up.
Knowing where to stop is a skill, not a failure of nerve. These jobs are not DIY:
An afternoon
The settings pass takes twenty minutes. Broker removals take longer and are worth doing once properly.
A password manager
The free tiers are fine. Reused passwords are how one breach becomes six.
A second email address
For shops, signups and anything that will sell you out. Keep your real one for people and banks.
Your phone's privacy dashboard
Both iPhone and Android now show which apps used your location, camera and microphone, and when. Genuinely revealing.
A credit freeze
Free at all three bureaus. Blocks new accounts in your name. The strongest single thing on this list.
Part 1
Do these in order. They are the changes with the largest effect per minute spent, and none of them break anything you actually use.
Turn off location for apps that do not need it
iPhone: Settings, Privacy & Security, Location Services. Android: Settings, Location, App permissions. A weather app needs approximate location. A game, a flashlight, a shopping app, or a social network does not need your precise position, and none of them need it in the background. Set everything you can to While Using or Never.
Stop the advertising identifier
iPhone: Settings, Privacy & Security, Tracking — turn off Allow Apps to Request to Track. Android: Settings, Privacy, Ads — delete the advertising ID. This is the number that lets separate companies stitch your behavior across apps into one profile. Removing it is the highest-value single toggle here.
Review microphone and camera access
Same privacy menus. Anything that has microphone access but is not a phone, messaging, or recording app should lose it. Then look at the recent-access log, which is often the moment people take this seriously.
Turn off voice recording retention
Siri, Google Assistant and Alexa each keep recordings and each let you stop it and delete history. Amazon: Alexa Privacy settings. Google: myactivity.google.com. Apple: Settings, Privacy, Analytics & Improvements.
Check what your chatbot keeps
Most AI tools default to using your conversations for training and let you turn it off in settings. If you have ever pasted work documents or personal details in, do this now, and delete the old conversations while you are there.
Turn on two-step verification for email
Not strictly privacy, but your email resets every other password you own. It is the account that matters most and it is usually the least protected.
Safety
Do this on the phones of anyone in the family who will not do it themselves — that usually means teenagers and older parents. Both groups are targeted specifically, for different reasons.
Part 2
These are companies that compile and sell your name, current and previous addresses, phone numbers, age, relatives and estimated income. This is not theoretical: it is where the caller who knows your daughter's name got it.
Understand what is for sale
Search your own name plus your city. You will likely find several sites showing your address history and relatives. That is the raw material for a convincing scam call, and it is available to anyone for a few dollars.
Start with the big ones
Whitepages, Spokeo, BeenVerified, Intelius, PeopleFinders, Radaris, MyLife and Acxiom cover most of it. Each has an opt-out page, usually buried in the footer under Privacy or Do Not Sell My Information.
Use the state law
The Texas Data Privacy and Security Act gives you the right to demand deletion, and brokers operating here must maintain a registry entry. Say explicitly that you are exercising your rights under it — requests citing the law get handled properly far more often.
Expect to repeat it
Records reappear as brokers re-acquire data. Once a year is a reasonable rhythm. Paid removal services exist and mostly do exactly what you would do, on a schedule; that convenience is the product.
Remove the one that matters most first
If your time is limited, prioritize anything showing your current home address alongside family names. That combination is what makes a threatening or emergency-story call land.
Safety
Never pay a company that contacts you offering to remove your data. Legitimate services do not cold-call, and that pitch is itself a common scam.
Part 3
Worth being accurate about, because both the panic and the complacency are wrong.
Part 4
New tools, and the defaults are set for the company's benefit rather than yours.
Assume anything you paste may be kept
Conversations are commonly stored, reviewed by staff for quality, and used for training unless you opt out. Treat the box as if a stranger might read it, because in a small number of cases one will.
Never paste identifiers
Social Security numbers, account numbers, passwords, medical records, or a document containing someone else's personal details. If you need help with a document, redact the identifying parts first.
Understand photo uploads
A photo carries location and time in its metadata unless stripped. Uploading a picture of your house, your child, or a document shares more than the visible image.
Check the setting that matters
Look for 'improve the model for everyone', 'training', or 'chat history'. Turning it off is usually one switch and often disables history too, which is the trade.
Be careful with connected accounts
Tools that plug into your email, calendar or files are genuinely useful and genuinely broad. Read what access is being granted, and remove connections you stopped using.
Safety
For a business, an employee pasting customer records into a chatbot can be a reportable data incident. Have a written rule before it happens — the work guide in this library covers what it should say.
Part 5
If you do one thing from this guide, do this. It is free, it is quick, and it prevents the harm rather than reporting it afterwards.
Knowing the right word is half of getting good help.
Reading changes nothing on its own.
Next guide
Your phone, speaker, TV and car are already using it — make them work for you
