iPhone Privacy and Security Settings Checklist: What to Change Today

The most valuable iPhone privacy change is to turn on Stolen Device Protection under Settings, Face ID & Passcode, because it limits what a thief can do even if they have watched you enter your passcode. After that, review location access, turn on App Privacy Report to see what your apps actually do, limit what a locked phone shows, and check your Apple Account sign-in. This checklist walks through each setting in order of impact and takes about 15 minutes.

Menu paths come from Apple Support pages checked on 28 October 2026. Apple changes iOS menus between versions, so if a path differs on your iPhone, use the Search box at the top of Settings.

Who this is for and what you will have at the end

This is for anyone who keeps email, banking, photos and work chats on an iPhone. It suits individuals and small business owners who want sensible protection without extreme measures.

At the end you will have:

• Theft protection switched on, and a plan if the phone goes missing.
• A passcode setup that resists guessing and shoulder surfing.
• Location, tracking and app access reviewed.
• A way to monitor what apps do in the background.
• A decision about the optional high-security tools.

Before you start

1. Update iOS: go to Settings, General, Software Update. Several features below need recent versions.
2. Make sure two-factor authentication is on for your Apple Account. Apple's Stolen Device Protection page lists it as a requirement.
3. Have your passcode ready, since Settings will ask for it.
4. Back up the phone. See iPhone backup: iCloud vs computer if you are unsure which method to use.

1. Turn on Stolen Device Protection

Apple says Stolen Device Protection adds security when your iPhone is away from familiar places like home or work, and helps protect your accounts and personal data even if a thief knows your passcode.

Requirements, from Apple's page:

• iOS 17.3 or later, turned on before the phone is lost or stolen.
• Two-factor authentication for your Apple Account.
• A device passcode, Face ID or Touch ID, and Significant Locations (under Location Services).
• Find My turned on, which cannot be disabled while the feature is on.

To turn it on, go to Settings, Face ID & Passcode, enter your passcode, and turn on Stolen Device Protection. Apple notes it may already be on by default.

What it changes when you are away from familiar locations:

• Face ID or Touch ID is required, with no passcode fallback, to use saved Keychain passwords or passkeys and saved Safari payment methods, to turn off Lost Mode, erase all content and settings, open a locked app, and to set up a new device or an eSIM, among other actions.
• Changes to critical settings require a security delay: authenticate with biometrics, wait one hour, then authenticate again. Examples include changing your Apple Account password, signing out, changing your passcode, adding or removing Face ID or Touch ID, Reset All Settings and turning off Stolen Device Protection. Apple says the iPhone may end the delay early once it detects you have arrived at a familiar location.

You can choose Always under Require Security Delay so the measures apply everywhere, not just away from familiar places. That is stricter and suits people who rarely feel safe anywhere with their phone.

Before you sell, give away or trade in the phone, turn Stolen Device Protection off, as Apple advises.

2. Set a strong passcode and limit lock-screen access

Your passcode is the key to the phone, so choose one that is hard to guess and that nobody can learn by watching you. Apple's passcode page covers how to change it under Settings, Face ID & Passcode, including the code-format options your iOS version offers.

Turn on the Erase Data option, also in Face ID & Passcode (Touch ID & Passcode on Home-button models), near the bottom. Apple describes it as erasing all information, media and personal settings after 10 consecutive failed passcode attempts. Consider this carefully if children or others might repeatedly try your phone. Keep a current backup either way.

Review Allow Access When Locked. Apple's passcode article says it controls access to some features while the device is locked, including Today View, Notification Center, Control Center, Siri, Reply with Message, Home Control and Wallet. In practice, turn off anything that lets a stranger control smart home devices or use Siri from the lock screen. Apple's page does not say where the toggle sits on every version, so look for it in Face ID & Passcode or search Settings for Allow Access When Locked.

3. Review Location Services

Go to Settings, Privacy & Security, Location Services. Apple's guide describes these controls:

• The main toggle turns Location Services on or off.
• Tap an app to review its access and how often it can use your location. Prefer options such as While Using the App or Ask Next Time over Always, for anything that does not need background tracking.
• Precise Location: leave it on for navigation, and turn it off to share only your general area, which is enough for weather, news or shopping apps.
• System Services (scroll down): shows system features that use your location. Significant Locations & Routes can be turned off here to stop the device learning places and routes used by Maps, Calendar and Photos.
• Location Alerts: turn off Show Map in Location Alerts to hide the map while still getting alerts.

Note that Stolen Device Protection requires Significant Locations to be on. If you turn it off, you lose that protection. Decide which matters more to you.

4. Turn on App Privacy Report

Apple's page says App Privacy Report is available on iOS 15.2 or later. To turn it on:

1. Open Settings and tap Privacy & Security.
2. Scroll down and tap App Privacy Report.
3. Tap Turn on App Privacy Report.

Data collection starts only after you enable it, so entries take a while to appear. The report is encrypted and stored only on your device, and turning it off deletes the stored data. It covers the past 7 days and shows:

• Data & Sensor Access: how often and when apps used Location, Photos, Camera, Microphone, Contacts and similar.
• App Network Activity: domains apps contacted directly or through in-app content.
• Website Network Activity: domains contacted by websites you visited in apps.
• Most Contacted Domains: the domains all your apps contact most often.

Check back after a week. If a simple game accessed your microphone or contacts, go back to Settings, Privacy & Security, open the permission type and switch the app off, or delete the app. Private browsing sessions in browser apps are excluded from the report.

5. Limit app tracking

Apple's App Tracking Transparency page gives the path: Settings, Privacy & Security, Tracking. Turn off Allow Apps to Request to Track, or review the list and switch off individual apps. This reduces cross-app tracking requests. It does not stop an app collecting data for its own use, so continue to check the permissions listed in App Privacy Report.

6. Review other privacy permissions

In Settings, Privacy & Security, step through the permission categories that matter: Contacts, Photos, Camera, Microphone, Bluetooth and Local Network. For each, remove any app that does not need it for its main function.

7. Check your Apple Account sign-in

Your Apple Account protects Find My, iCloud backups and Keychain. Apple offers Security Keys for Apple Account, an optional feature for extra protection against phishing and social engineering. With two-factor authentication on, signing in on a new device or the web then needs your password plus either a FIDO-certified physical security key or a nearby trusted Apple device.

Apple's page states the constraints: you need at least two compatible FIDO-certified keys, iOS 16.3 or later on all signed-in devices, and two-factor authentication on. Once enabled these are the only sign-in methods, so if you lose all trusted devices and keys you could be permanently locked out. You can register up to six keys and must keep at least two. The path on iPhone is Settings, your name, Sign-in & Security, Two-Factor Authentication, Security Keys, Add Security Keys. This is worth considering if you manage business data or have been the target of phishing, but only after you have secured spare keys.

8. Know the emergency tools: Safety Check and Lockdown Mode

Safety Check. Apple describes Safety Check on iPhone with iOS 16 or later as reached through Settings, Privacy & Security, Safety Check, requiring an Apple Account with two-factor authentication. It offers Emergency Reset, which immediately resets sharing for all people and apps, and Manage Sharing & Access, which lets you review sharing person by person and app by app. Apple notes it cannot review non-Apple accounts, social media sharing, or devices signed in to a different Apple Account. It is useful if you suspect someone you know can see your location or data.

Lockdown Mode. Apple calls it optional, extreme protection for the very few individuals who may be personally targeted by sophisticated digital threats, and says most people are never targeted by attacks of this nature. To turn it on, go to Settings, Privacy & Security, Lockdown Mode, tap Turn On Lockdown Mode, then Turn On & Restart. It restricts message attachments and link previews, complex web technologies, incoming FaceTime calls from people you have not contacted in the past 30 days, and more. Phone calls, plain text messages and emergency features still work. Most readers should skip it, but know it exists if your work or profile raises your risk.

Verify your changes

• Open Settings, Face ID & Passcode and confirm Stolen Device Protection shows on.
• Walk to a place that is not home or work, and check that the phone asks for Face ID or Touch ID for a saved password. Do not test destructive actions.
• Look at Location Services and confirm no unexpected app shows Always.
• Check App Privacy Report again after a few days.

Troubleshooting

• Stolen Device Protection will not turn on. Check the requirements: iOS 17.3 or later, two-factor authentication, Significant Locations and Find My must all be on, and the phone needs a passcode and Face ID or Touch ID.
• The setting is greyed out or missing. Update iOS and confirm your Apple Account is signed in with two-factor authentication.
• A needed setting change is blocked for an hour. That is the security delay working as designed. Authenticate, wait an hour, authenticate again. The iPhone may end the delay early if it detects you are at a familiar location.
• An app breaks after you deny a permission. Re-open its page in Settings and allow only the one setting it needs.
• No data in App Privacy Report. It only collects after you turn it on, so wait a day or two.
• A phone restored from backup behaves differently at home. Apple notes there may be a delay before a restored or transferred device recognises familiar locations.

Checklist

• iOS updated and two-factor authentication on.
• Stolen Device Protection on, with Require Security Delay set as you prefer.
• Long passcode, Erase Data considered, lock-screen access limited.
• Location Services set to While Using or Ask, Precise Location off where possible.
• App Privacy Report on and reviewed weekly for the first month.
• Tracking requests off.
• Contacts, Photos, Camera, Microphone and Bluetooth reviewed.
• Security Keys considered, with spare keys stored.
• Safety Check and Lockdown Mode understood, used only if needed.

Related reading: iPhone battery health and when to replace the battery.

References

• About Stolen Device Protection for iPhone: https://support.apple.com/en-us/120340
• Use App Privacy Report on iPhone: https://support.apple.com/en-us/102188
• Manage Location Services settings: https://support.apple.com/guide/personal-safety/manage-location-services-settings-ips9bf20ad2f/web
• Use a passcode with your iPhone, iPad, or iPod touch: https://support.apple.com/en-us/119586
• About Lockdown Mode: https://support.apple.com/en-us/105120
• Safety Check for an iPhone with iOS 16 or later: https://support.apple.com/guide/personal-safety/safety-check-iphone-ios-16-ips2aad835e1/web
• Security Keys for Apple Account: https://support.apple.com/en-us/102637
• App Tracking Transparency: https://support.apple.com/en-us/102420