The iPhone privacy settings I actually change first
When it comes to privacy on your personal devices, there are plenty of ways to tighten things up. The iOS platform keeps privacy reasonably tight out of the box, but a few changes will push it further, and some of the more useful settings are buried where most people never look.
I’ve pulled together the changes I make first, along with a note on where each one stops helping. That last part matters. A setting that gives you false confidence is worse than no setting at all.
Turn off notification previews (not necessarily the notifications)
Push notifications can put information on your lock screen that you would not want a passer-by to read. Leave your phone face up on a desk and a message preview can appear for anyone nearby to see.
Most apps push you hard to enable notifications. That is not for your benefit. It is to keep their icon relevant and their app in use, because apps that sit unused eventually get offloaded, and an offloaded app is not making anyone any money. So the first question worth asking is whether you actually want that app notifying you at all.
But you do not have to choose between “all notifications” and “none.” The better middle ground is to hide the content of the preview and keep the alert itself. Go to Settings > Notifications > Show Previews and set it to “When Unlocked” or “Never.” You still know a message has arrived, but the contents stay private until you unlock the phone. I use “When Unlocked” as a sensible default.
iCloud Private Relay
iCloud Private Relay is included with iCloud+ subscriptions. When you browse in Safari, it hides your IP address and encrypts your traffic so that no single party can see both who you are and which sites you visit. It sends your requests through two separate relays: Apple handles the first hop and can see your IP but not your destination, while a third-party partner handles the second and can see the destination but not your IP. That split is the whole point. It stops trackers tying your browsing back to your identity and location, and makes it harder for services to build a profile on you.
Two things worth knowing. First, it is not switched on automatically. You will find it under Settings > [your name] > iCloud > Private Relay. Second, it is not a full VPN. It only covers Safari browsing (plus some insecure app traffic and DNS lookups), so anything else leaves your device outside its protection. Some networks and a handful of countries also block it. If you want everything your device does routed through an encrypted tunnel, that is a job for a proper VPN, not Private Relay.
Privacy screen protectors
If you commute by train or spend time on public transport, you will know the sight of the “shoulder surfer,” the person quietly reading your screen over your shoulder. It is a pet hate of mine, and there are cheap products that deal with it.
My favourite is a privacy screen protector. It works like a normal tempered glass protector, so it guards against scratches and drops, but it also narrows the viewing angle. Look at the phone straight on and you see everything as normal. Move much beyond roughly 45 degrees either side and all anyone sees is a black screen. A low-cost bit of privacy for anyone who works or reads on the move.
A privacy screen protector is a must for anyone who regularly travels by bus or train.
Alias and masked email addresses
When you sign up to newsletters or online services, you can protect your main inbox using aliases. There are two approaches, and they are not the same thing, so it is worth being clear about what each one does.
The first is a “plus” address. If your email is my.email@emailservice.com, you can hand over my.email+bbcnews@emailservice.com when you sign up to BBC News. If that address later turns up in spam or a breach list, you know exactly which service leaked or sold it, and you can filter or bin anything sent to that specific alias in seconds.
One caveat though, and it’s one a lot of guides get wrong. A plus address does not hide your real address. Anyone holding my.email+bbcnews@emailservice.com can simply delete the +bbcnews part and get straight back to my.email@emailservice.com. Plenty of spam operators strip plus tags automatically. So treat plus addressing as a way to spot and filter, not as a mask.
If you genuinely want to hide your real address, that is where Apple’s Hide My Email comes in, included with iCloud+. It generates a random, unique address that forwards to your real inbox. The service you sign up to never sees your actual email, and if that address starts attracting rubbish you can switch it off without touching your main account. Because the address is random rather than a tagged version of your real one, there is nothing to strip back to. I use plus addresses for low-stakes sign-ups where I just want to track the source, and Hide My Email for anything I am not sure I trust.
Aliases also make it far easier to shut down unsolicited mail and to spot when you have been signed up to a list you never subscribed to.
Mail Privacy Protection
While you are in your email settings, turn on Mail Privacy Protection if you use Apple’s Mail app. Go to Settings > Apps > Mail > Privacy Protection and switch on “Protect Mail Activity.”
This does two useful things. It hides your IP address from senders, and it loads the invisible tracking pixels that marketers embed in emails through a proxy, in the background, whether or not you actually open the message. The result is that senders can no longer reliably tell when, where, or whether you opened their email. If you have ever wondered how a newsletter “knows” you read it, that pixel is how, and this setting quietly breaks it.
App tracking
On any current iPhone, you can block apps from asking to track you across other companies’ apps and websites in one go. Go to Settings > Privacy & Security > Tracking and turn off “Allow Apps to Request to Track.” That single switch stops the tracking pop-up appearing and denies apps access to your device’s advertising identifier. The same screen shows which apps you have previously allowed, so you can revoke any of them.
My take though: this stops apps using Apple’s official tracking identifier, but it does not stop every form of tracking. Some companies still attempt to fingerprint you using other signals, which is against Apple’s rules but happens anyway. It is a strong, easy win, not a force field.
Advanced Data Protection, and the UK catch
This is the big one, and it is the setting most guides skip. By default, some of your iCloud data (backups, photos, notes, iCloud Drive) is encrypted in a way that Apple itself can still access, which means it can be handed over if legally compelled, or exposed in a breach on Apple’s side. Advanced Data Protection extends end-to-end encryption to those categories, so that only your trusted devices hold the keys and not even Apple can read the data.
There’s a UK-specific snag here though. As things stand, you cannot turn Advanced Data Protection on in the UK. Apple withdrew it for UK users in early 2025 following a demand from the Home Office under the Investigatory Powers Act, and the legal fight over that demand is still working its way through the courts. The position has shifted more than once and is genuinely contested, so it is worth checking the current state of play, but at the time of writing UK users have less iCloud protection available to them than users elsewhere. If you travel or hold accounts in other regions, the setting lives under Settings > [your name] > iCloud > Advanced Data Protection where it is offered.
My take is you’re better off knowing the setting exists and is currently off-limits here than assuming it’s available when it isn’t.
Stolen Device Protection
If someone watches you type your passcode and then steals your phone, the passcode alone can unlock a frightening amount. Stolen Device Protection closes that gap. When your phone is somewhere unfamiliar, it requires Face ID or Touch ID (with no passcode fallback) for sensitive actions, and adds a one-hour security delay before things like changing your Apple Account password can go through. Turn it on under Settings > Face ID & Passcode > Stolen Device Protection. For the small amount of friction it adds, it is well worth having.
Lockdown Mode, for higher-risk users
Most people do not need this, and that is fine. But if you are a journalist, campaigner, executive, or anyone who might realistically be targeted by sophisticated attackers, Lockdown Mode (Settings > Privacy & Security > Lockdown Mode) sharply reduces the ways your device can be attacked by disabling certain message attachment types, some web technologies, and more. It is deliberately restrictive and will make the phone less convenient, which is the trade-off you are choosing to make.
Safety Check, if your situation has changed
This one rarely appears in privacy round-ups and it should. Safety Check (Settings > Privacy & Security > Safety Check) lets you quickly review and cut off who has access to your location, photos, and accounts. It is built with people leaving controlling or abusive relationships in mind, with an Emergency Reset that severs sharing across the board in one action. If you have ever shared access with someone you no longer trust, this is the fastest way to take it back.
Rein in location sharing
Two quick location settings worth checking. First, per app, you can share only an approximate location rather than a precise one: in the app’s location settings, turn “Precise Location” off for anything that does not truly need your exact position (a weather app does not). Second, recent iOS versions let you stop your mobile network operator receiving your precise location. It is worth a look under Settings > Privacy & Security > Location Services while you are in there, along with the System Services and Significant Locations entries at the bottom, which most people have never opened.
The point of all this
None of these settings makes you invisible, and I would be wary of anyone who tells you a single toggle will. What they do, taken together, is reduce how much of your activity gets quietly collected, profiled, and exposed, and give you back some control over who sees what. Start with the ones that cost you nothing (notification previews, app tracking, Mail Privacy Protection) and add the rest as they fit how you use your phone.
If you run a business and you are trying to work out where privacy sits alongside everything else on your plate, that is the sort of thing I help with. Get in touch with me and we can talk it through.