Security
The iPhone Privacy Checklist for 2026 (32 Things to Lock Down)
The iPhone privacy checklist for 2026: 32 settings, apps and habits to lock down your Apple Account, device, apps and network on iOS in under an hour.
Quick answer: The 2026 iPhone privacy checklist is 32 items across four layers: Apple Account, device, apps and network. The highest-value subset (a long passcode, Stolen Device Protection, Advanced Data Protection, hardware security keys, and Lockdown Mode if you are a target) takes under an hour and blocks most realistic attacks. Rerun the list every January.
Want to tick items off as you go? Use the interactive iPhone privacy settings checklist, which lists each setting with its exact Settings path and saves your progress on your device only.
How do you lock down your Apple Account?
Start with the account, because it is the master key to everything in iCloud: devices, backups, synced notes and photos. Use a unique password, two-factor authentication with hardware keys, Advanced Data Protection and a Legacy Contact, then remove old devices and phone numbers you no longer control.
- Set a long, unique Apple Account password. Not reused, not in any breach database. Generate and store it in a password manager.
- Enable two-factor authentication if it is not already on (it is the default for new accounts, but older ones may lag).
- Register hardware security keys (YubiKey, Google Titan). iOS 16.3 and later support FIDO security keys for Apple Account sign-in. Apple requires at least two; keep one in a safe.
- Turn on Advanced Data Protection. It makes iCloud Backup, Photos, Notes, iCloud Drive and other categories end-to-end encrypted, so Apple no longer holds the keys. Read our full ADP guide and set up a recovery contact or recovery key first.
- Set up a Legacy Contact.Settings > your name > Sign-In & Security > Legacy Contact. Pick one or two trusted people. See what happens to iCloud notes when you die for inheritance planning.
- Use Sign in with Apple where possible. It can hide your real email behind a per-app relay address.
- Audit your Apple Account device list.Settings > your name, then scroll down. Remove old phones, other people's laptops and devices you sold.
- Review trusted phone numbers. SIM-swap attacks target them. Remove old numbers and keep one you actually control.
How do you lock down the iPhone itself?
The device passcode protects the keys behind iOS Data Protection, so it is the most important setting on the phone. Use a long alphanumeric passcode, turn on Stolen Device Protection, keep Control Center and USB accessories off the Lock Screen, and shorten Auto-Lock.
- Set a 10+ character alphanumeric passcode.Settings > Face ID & Passcode > Change Passcode > Passcode Options > Custom Alphanumeric Code. It is far harder for forensic tools to guess than six digits.
- Enable Stolen Device Protection.Settings > Face ID & Passcode > Stolen Device Protection. Choose “Away from familiar locations” for the security delay.
- Disable Control Center on the Lock Screen. Stops a thief from switching on Airplane Mode to cut off Find My.
- Disable USB accessories when locked.Settings > Face ID & Passcode > Allow Access When Locked > Accessories: off. This makes it harder for forensic hardware to talk to a locked phone.
- Set Auto-Lock to 30 seconds or 1 minute. A phone that locks quickly is harder to grab and use.
- Hide notification previews when locked.Settings > Notifications > Show Previews > When Unlocked. Stops people reading 2FA codes on your Lock Screen.
- Enable Lockdown Mode if you are a target.Settings > Privacy & Security > Lockdown Mode. It disables many features; for journalists, activists and executives it is the strongest mitigation Apple offers.
- Keep Require Attention for Face ID on.Settings > Face ID & Passcode. Your eyes must be open and looking at the phone. More in Face ID for notes on iOS and how Face ID protects your data.
- Consider Erase Data after 10 failed passcode attempts. With a long passcode, accidental erasure is unlikely and guessing becomes pointless. Make sure you have a backup first.
How do you lock down your apps?
Apple's built-in apps are mostly fine; the leaks come from third-party apps and their permissions. Deny tracking requests, audit location, photos, camera and microphone access, read the App Privacy Report, and keep high-stakes content in apps built to protect it.
- Turn off app tracking requests.Settings > Privacy & Security > Tracking > Allow Apps to Request to Track: off, or decide app by app. When an app asks, “Ask App Not to Track” blocks access to your advertising identifier. Many apps, including ours, use this prompt for ad measurement, so your answer matters.
- Enable Mail Privacy Protection.Settings > Apps > Mail > Privacy Protection. Hides your IP address and loads remote content privately.
- Use Hide My Email (iCloud+) to give each service its own relay address.
- Audit Location Services.Settings > Privacy & Security > Location Services. Set most apps to While Using or Never.
- Audit Photos access. Switch apps to Limited Access unless they truly need the full library.
- Audit Microphone and Camera access. Revoke anything that does not need it. The orange and green dots show live use, but prevention beats detection.
- Review the App Privacy Report.Settings > Privacy & Security > App Privacy Report. Shows which apps contacted which domains.
- Move high-stakes content to the right app. Passwords belong in a password manager (see storing passwords in a notes app). For private notes, compare options in best encrypted notes apps, and check whether an app encrypts notes itself or relies on iOS plus a lock. Secure Notes for iPhone is the second kind: a passcode and Face ID lock, a decoy PIN and, from version 3.8.1, encrypted backups on top of iOS Data Protection.
- Lock sensitive notes and folders. Apple Notes can lock individual notes with your device passcode or a separate password. Apps like Secure Notes add app-wide, folder and note locks plus a decoy PIN. See secure folder on iOS and how to lock notes on iPhone.
How do you lock down your network?
Even when content is encrypted, network metadata shows who you talk to, when and from where. Turn on iCloud Private Relay, use encrypted DNS, forget public Wi-Fi after use, understand what a VPN does and does not do, and switch off AirDrop and Bluetooth when you do not need them.
- Enable iCloud Private Relay(iCloud+). Settings > your name > iCloud > Private Relay. A two-hop relay for Safari, DNS and some unencrypted app traffic. Not a full VPN, but free with iCloud+.
- Set encrypted DNS. Use Cloudflare 1.1.1.1, Quad9 or NextDNS through a DNS-over-HTTPS profile or app, so your network provider cannot log every domain.
- Forget public Wi-Fi networks after use.Settings > Wi-Fi, tap the network, then Forget This Network. Stops auto-joining a fake network with the same name.
- Disable Auto-Join on untrusted networks such as hotels, airports and cafes.
- Understand what a VPN does. It moves trust from your network to the VPN provider. It does not make you anonymous or stop in-app tracking. Use one on networks you do not trust, and avoid free VPNs.
- Turn off AirDrop and Bluetooth when not needed. Set AirDrop to Contacts Only or Receiving Off in public places.
How often should you review this list?
Once a year. Every January, set aside 30 minutes and rerun the checklist, because iOS adds privacy settings in most major releases and app permissions drift over time.
- Read what is new in the latest iOS release for new privacy settings.
- Recheck the App Privacy Report; apps change owners and behavior.
- Make sure your Legacy Contact is still someone you trust.
- Recheck your Apple Account device list.
- Confirm the recovery words or recovery keys for every app and account you rely on are still where you wrote them down.
- Test that your hardware security keys still work.
- Reread is iCloud safe for sensitive notes and the Apple Notes encryption status; the answers change as Apple ships features.
Privacy is a maintenance habit, not a one-time setup. If you have worked through this list, you have climbed the steepest part of the curve.
Frequently asked: iPhone privacy in 2026
What is the most important iPhone privacy setting?
A long alphanumeric device passcode combined with Stolen Device Protection. The passcode protects the keys behind iOS Data Protection, so a 10+ character alphanumeric code is far harder to guess or crack than six digits. Stolen Device Protection adds a Face ID or Touch ID requirement and a one-hour delay for sensitive changes away from familiar locations.
Should I use Lockdown Mode?
Only if you are a journalist, activist, executive or anyone with a credible targeted-threat profile. Lockdown Mode turns off many attack surfaces (link previews, most message attachments, FaceTime from unknown callers, configuration profiles, JIT JavaScript) at a real cost in daily convenience. For most users it is overkill; for at-risk users it is the strongest protection Apple ships.
What is Stolen Device Protection?
Stolen Device Protection, added in iOS 17.3, stops a thief who learned your passcode from quickly taking over your accounts. Sensitive actions such as changing your Apple Account password, turning off Find My or viewing saved passwords need Face ID or Touch ID with no passcode fallback, and some need a one-hour delay when you are away from familiar locations.
Is iCloud Private Relay a VPN?
No. iCloud Private Relay is a two-hop relay for Safari browsing, DNS lookups and some unencrypted app traffic. It hides your IP address from websites and your browsing from Apple and your network provider, but it does not cover all apps, does not let you pick a country and does not unblock geo-restricted content. A VPN covers all traffic but moves trust to the VPN provider.
How often should I audit my iPhone privacy settings?
At least once a year, ideally in January. iOS gets a major release every year plus security updates, and new privacy controls arrive regularly: App Privacy Report, Lockdown Mode, Advanced Data Protection and Stolen Device Protection all arrived between iOS 15 and iOS 17. A 30-minute yearly review catches permission drift, outdated Legacy Contacts and new settings worth turning on.
What apps should I replace for better privacy?
Safari is good; keep it and tune its privacy settings. In Mail, turn on Mail Privacy Protection. For sensitive notes, either turn on Advanced Data Protection so Apple Notes is end-to-end encrypted in iCloud, or use an app built for it, such as a password manager for credentials or an app that encrypts its own vault. Remove third-party keyboards that have Full Access.
Keep reading
