Your phone knows more than your laptop

Your phone has a microphone, a camera, a precise location and a list of everyone you know, and it is in your pocket all day. Most privacy advice ignores it in favour of browsers. That is backwards.

Here is what is worth doing, in order.

1. Location, and specifically "Always"

Go through your apps and look at which ones have location access, and which have it set to Always rather than While Using. Very few things need to know where you are when you are not using them. A weather app does not. A shopping app definitely does not.

On iPhone: Settings, Privacy and Security, Location Services. On Android: Settings, Location, App permissions.

Precise location is the other half. A weather app works fine with an approximate location, and both systems let you grant that instead.

2. Your advertising identifier

Both platforms give apps a single identifier specifically for tracking you across apps. You can turn it off in one place, and it applies everywhere.

On iPhone: Settings, Privacy and Security, Tracking, and turn off "Allow Apps to Request to Track". On Android: Settings, Privacy, Ads, and delete the advertising ID.

Five seconds, and it does more than most of the rest.

3. The permissions you granted once and forgot

Both systems now show you a privacy report of what has been accessed recently. Read it once. The useful shock is usually not the camera, it is how often something reads your location or your contacts in the background.

Contacts is the permission people underestimate. Granting it hands over other people's details, not just your own, and they never agreed to anything.

4. Old apps

An app you have not opened in a year still has every permission you gave it and still receives updates. Delete it. This is the highest-value five minutes on this page.

5. Wi-Fi behaviour

Turn off automatic connection to open networks. Your phone will otherwise join anything with a familiar name, including something named to be familiar. Turn off Wi-Fi scanning when location is off, which both systems otherwise keep doing.

6. Lock screen

A six-digit PIN rather than four. Notifications hidden until unlocked, so a preview of a bank code is not readable from a table. Automatic lock at thirty seconds or a minute.

Where a VPN fits

On mobile it is worth more than on a laptop, because a phone moves between networks all day and joins them automatically. Every one of those is a network you did not choose. A VPN with a kill switch means a two-second gap on the train does not fall back to the open network.

It does not touch anything else on this page. App permissions are app permissions.