A useful Android privacy check starts with the access you actually granted. You do not have to disable every feature: a map needs location for navigation, and an accessibility tool may legitimately need broad access. Keep a short record of what you change so you can restore a needed feature without granting everything back.
Review recent camera, microphone and location use
Search Settings for Privacy dashboard or open Security & privacy, then Privacy. Menu names differ by manufacturer and Android version. Google describes a 24-hour history on Android 12 and seven days on Android 13 in its Privacy dashboard guide. Select a permission to see which apps used it and compare the time with what you were doing.
A recent-use indicator is not proof of malware. A call, recorder or navigation session can explain access. If you cannot explain it, review the app and its permissions before assuming the whole phone is compromised.
Give access that fits the task
- Location: try approximate location when a feature does not need your precise position. Navigation or a pickup point may need greater accuracy.
- Photos: prefer selecting individual items when Android and the app offer that option. A photo editor does not automatically need your entire library or all files.
- Microphone and camera: grant them for features you choose to use. Review apps that no longer need them.
- Unused apps: uninstall tools you no longer use, or check the option to pause activity and remove permissions when unused.
See Google’s permission instructions. Test one familiar task after changing a permission; if it fails, decide whether that feature is worth the access instead of restoring unrelated permissions.
Inspect special access separately
Search Settings for Accessibility, Notification access, Install unknown apps and Device admin apps. These controls are not all covered by ordinary camera or location permissions. Password managers, accessibility aids and managed work software can have legitimate reasons for special access. Verify the developer and purpose. Do not remove required work management or accessibility tools without understanding the effect.
If an unfamiliar app persuaded you to grant access during a support call or after opening a message attachment, stop following that caller’s instructions. Use a trusted device to contact the affected service and follow its account-recovery guidance.
Separate Timeline from other location-related records
Google Maps Timeline is an optional record of visits and routes, now stored on individual devices with an optional encrypted backup. Turning it off is not the same as disabling every use of location. Other settings, including Web & App Activity, can still store location-related information, and services such as device finding have their own controls. Review the actual setting and deletion options before clearing history you may need. See Google’s Timeline explanation.
Review linked services and advertising controls
In your Google Account’s linked-app list, inspect the access for each service. Basic profile access for sign-in is different from permission to read or modify Drive, Gmail or Calendar data. Remove access you no longer need, but first confirm another way to sign in if you rely on Google sign-in. Revoking access does not automatically erase copies the service already received. Google explains these access levels.
My Ad Center can turn off Google’s personalised ads. That does not remove all advertisements, control every other advertising company or erase account activity. Review activity controls separately. Google describes the scope of this setting.
Make the review repeatable
Keep a private checklist: app, permission, why it is needed, change made and whether the feature still works. Revisit it after installing a new app or noticing unexpected access. Do not publish screenshots containing account identifiers or location history. This review reduces unnecessary access; it is not a malware scan or a guarantee against account fraud.
Reviewed on 27 October 2026. Updated location and linked-app guidance and removed unsupported security claims.
