Smartphone Privacy UK 2026: What Your Android and iPhone Know About You — and How to Take Back Control

Your smartphone knows more about you than almost any other device you own. It tracks where you go, what you search for, who you call, what you buy, how you sleep, and — if you've granted the right permissions — it can listen through your microphone and see through your camera. For UK users, this raises important questions under UK GDPR and the UK Data Protection Act 2018: what data are Apple and Google actually collecting, what are your rights, and what practical steps can you take to reduce your exposure? This guide, based on thorough research of Apple's and Google's official privacy documentation, the UK Information Commissioner's Office (ICO) guidance, and independent privacy research as of October 2026, gives you the full picture.

The Scale of Smartphone Data Collection

Before diving into specific platforms, it's worth understanding the categories of data that smartphones routinely collect. These fall into several broad groups:

• Location data: GPS coordinates, Wi-Fi network locations, cell tower triangulation, and Bluetooth proximity data. Your phone can build a detailed map of everywhere you've been.
• Usage data: Which apps you open, how long you spend in them, what you tap on, and when you use your phone.
• Communications metadata: Who you call, when, and for how long. The content of calls is generally not collected by the OS, but metadata is.
• Health and biometric data: Step counts, heart rate (if you have a paired wearable), sleep patterns, and — on newer devices — blood oxygen levels.
• Financial data: Purchase history through payment apps, in-app purchases, and subscription records.
• Advertising identifiers: A unique ID assigned to your device that allows advertisers to track your behaviour across apps and websites.
• Sensor data: Accelerometer, gyroscope, barometer, and proximity sensor data — which can reveal more than you might expect about your activities.

The key distinction is between data collected by the operating system manufacturer (Apple or Google) and data collected by third-party apps. Both matter, but they operate under different rules and with different levels of transparency.

iPhone and iOS: Apple's Privacy Approach

What Apple Collects

Apple has built its brand identity around privacy, and its approach is genuinely more privacy-preserving than Google's in several important respects. However, "more private" does not mean "no data collection." According to Apple's official privacy documentation (apple.com/uk/privacy), the company collects data in the following categories when you use Apple services:

• Apple ID and account data: Your name, email address, payment information, and device identifiers.
• iCloud data: If you use iCloud, Apple stores your photos, messages, contacts, calendar entries, and documents on its servers. End-to-end encryption is available for most iCloud categories via Advanced Data Protection, but it must be enabled manually.
• Siri and Apple Intelligence data: Voice queries and interactions. Apple states that Siri requests are processed on-device where possible, with more complex requests handled by Private Cloud Compute — a system Apple says does not retain your data on its servers.
• App Store and purchase data: Your purchase history, app downloads, and subscription records.
• Diagnostic and usage data: Crash reports and performance data, which Apple says are anonymised before transmission. This can be disabled in Settings.
• Location data: Used for features like Find My, Maps, and location-based Siri suggestions. Each app must request location permission separately.

Apple's Key Privacy Features (iOS 17 and Later)

Apple has introduced a number of privacy features in recent iOS versions that give users meaningful control:

• App Tracking Transparency (ATT): Apps must ask your permission before tracking you across other apps and websites. You can review and revoke these permissions in Settings → Privacy & Security → Tracking.
• Privacy Nutrition Labels: The App Store shows a summary of what data each app collects before you download it.
• Advanced Data Protection: Enables end-to-end encryption for most iCloud data categories, including iCloud Backup, Photos, and Notes. Must be enabled manually in Settings → [Your Name] → iCloud → Advanced Data Protection.
• Lockdown Mode: An extreme privacy mode for users at high risk of targeted attacks. Disables many features but significantly reduces attack surface.
• Private Browsing in Safari: Blocks known trackers and prevents browsing history from being saved. Enhanced Tracking Protection is enabled by default.
• Hide My Email: Generates random email addresses for app sign-ups, preventing companies from linking your real email to your account.
• Location permission granularity: Apps can be granted precise location, approximate location (within a few miles), or no location access at all.

What Apple Doesn't Do (That Google Does)

Apple does not use your personal data to serve targeted advertising in the same way Google does. Apple's advertising business (Apple Search Ads) uses on-device processing to match ads to users without sending personal data to Apple's servers. This is a meaningful structural difference from Google's advertising model.

Android and Google: A Different Privacy Model

What Google Collects

Google's business model is fundamentally built on advertising, which means data collection is more central to its Android ecosystem. According to Google's official privacy documentation (safety.google/privacy), the company collects:

• Google Account data: Your name, email, phone number, payment information, and account activity across all Google services.
• Search and browsing history: If you use Google Search or Chrome, your queries and browsing activity are linked to your Google Account by default.
• Location history: Google Maps and other Google services collect detailed location data. Google's Timeline feature (formerly Location History) builds a record of everywhere you've been. This can be disabled, but it's on by default for many users.
• App usage data: Google Play Services collects data about which apps you use and how you use them.
• Voice and audio data: Google Assistant interactions are processed on Google's servers. Google states that audio is not retained unless you opt in to Voice & Audio Activity.
• Advertising ID: Android assigns each device an advertising ID that allows advertisers to track behaviour across apps. This can be reset or deleted in Settings.
• Contacts, calendar, and email: If you use Gmail, Google Contacts, or Google Calendar, this data is stored on Google's servers.

Android's Key Privacy Features (Android 14 and Later)

Google has significantly improved Android's privacy controls in recent versions:

• Privacy Dashboard: Shows which apps have accessed your camera, microphone, and location in the past 24 hours. Found in Settings → Privacy → Privacy Dashboard.
• Permission auto-reset: Apps you haven't used for several months automatically have their permissions revoked.
• Approximate location: Like iOS, Android allows you to grant approximate rather than precise location to apps.
• Microphone and camera indicators: A green dot appears in the status bar whenever an app is actively using your microphone or camera.
• Delete advertising ID: You can now delete your advertising ID entirely (Settings → Privacy → Ads → Delete advertising ID), which prevents interest-based ad targeting.
• Google Play Protect: Scans apps for malware and harmful behaviour, both at install time and periodically thereafter.
• Private Space: Introduced in Android 15, this creates a separate, locked profile for sensitive apps — useful for keeping banking or health apps isolated.

The Google Account Problem

The most significant privacy consideration for Android users is the Google Account. Unlike Apple, where many features work without an Apple ID, Android is deeply integrated with Google Account services. Signing out of your Google Account on Android significantly limits the device's functionality. This means that for most Android users, Google has access to a substantial amount of personal data by design.

The practical implication: if you want to minimise Google's data collection on Android, you need to actively manage your Google Account settings at myaccount.google.com — not just your phone's settings.

Your Rights Under UK Law

UK users have meaningful rights under the UK GDPR and the Data Protection Act 2018, enforced by the Information Commissioner's Office (ICO). These rights apply to both Apple and Google as data controllers:

• Right of access: You can request a copy of all personal data held about you. Both Apple (privacy.apple.com) and Google (myaccount.google.com/data-and-privacy) provide data download tools.
• Right to erasure: You can request deletion of your personal data. Google's "Delete all activity" and Apple's account deletion tools support this right.
• Right to object: You can object to processing of your data for direct marketing purposes.
• Right to data portability: You can request your data in a machine-readable format for transfer to another service.

If you believe your data rights have been violated, you can complain to the ICO at ico.org.uk. The ICO has the power to investigate and fine companies that breach UK data protection law.

Practical Steps to Improve Your Smartphone Privacy

For iPhone Users

1. Enable Advanced Data Protection: Settings → [Your Name] → iCloud → Advanced Data Protection. This enables end-to-end encryption for most iCloud data. Note: if you lose access to your account, Apple cannot help you recover it — set up a recovery contact or key first.
2. Review app tracking permissions: Settings → Privacy & Security → Tracking. Disable tracking for any apps you don't trust.
3. Audit location permissions: Settings → Privacy & Security → Location Services. Set most apps to "While Using" or "Never." Only grant "Always" to apps that genuinely need it (navigation, fitness tracking).
4. Review microphone and camera access: Settings → Privacy & Security → Microphone / Camera. Revoke access for any app that doesn't need it.
5. Disable personalised ads: Settings → Privacy & Security → Apple Advertising → Personalised Ads (toggle off).
6. Use Sign in with Apple: When signing up for new services, use Sign in with Apple with the "Hide My Email" option to prevent companies from linking your real email to your account.
7. Check your iCloud data: Visit privacy.apple.com to see and download the data Apple holds about you.

For Android Users

1. Delete your advertising ID: Settings → Privacy → Ads → Delete advertising ID. This prevents interest-based ad targeting across apps.
2. Review the Privacy Dashboard: Settings → Privacy → Privacy Dashboard. Check which apps have accessed your camera, microphone, and location recently.
3. Audit location permissions: Settings → Location → App permissions. Set most apps to "Only while using" or "Deny." Review any app set to "Allow all the time."
4. Manage Google Account activity: Visit myaccount.google.com → Data & Privacy. Turn off Location History, Web & App Activity, and YouTube History if you don't want Google building a profile of your behaviour.
5. Use a privacy-focused browser: Replace Chrome with Firefox or Brave for everyday browsing. Both offer stronger tracking protection than Chrome by default.
6. Enable Google Play Protect: Settings → Security → Google Play Protect. Ensure it's active and run a scan periodically.
7. Review app permissions regularly: Settings → Apps → [App name] → Permissions. Revoke any permissions that seem excessive for the app's function.
8. Download your Google data: Visit myaccount.google.com → Data & Privacy → Download your data to see the full extent of what Google holds about you.

Third-Party Apps: The Bigger Privacy Risk

While Apple and Google attract most of the attention in smartphone privacy discussions, third-party apps are often the bigger practical risk. Many free apps — games, utilities, social media clients, weather apps — monetise through advertising and data collection. Some collect far more data than their core function requires.

Key principles for managing third-party app privacy:

• Read the privacy nutrition label (iOS) or data safety section (Android): Before downloading an app, check what data it collects. Both platforms now require developers to disclose this information.
• Question excessive permissions: A torch app that requests access to your contacts and location is a red flag. Grant only the permissions an app genuinely needs to function.
• Be cautious with free apps in sensitive categories: Free VPNs, free antivirus apps, and free keyboard apps have a poor track record on privacy. Research the developer before installing.
• Delete apps you no longer use: Unused apps may still collect data in the background. Remove them.
• Check for data broker opt-outs: Some data brokers that aggregate smartphone data offer opt-out mechanisms. The ICO's website provides guidance on your rights in this area.

iPhone vs Android: Which Is More Private?

The honest answer is that it depends on your threat model and how you use your device. As a general rule:

• iPhone with Advanced Data Protection enabled offers stronger default privacy than most Android configurations, primarily because Apple's business model doesn't depend on advertising revenue from your data.
• Android with a de-Googled ROM (such as GrapheneOS, available for Pixel devices) can be more private than iPhone, but requires significant technical knowledge and sacrifices app compatibility.
• Stock Android with careful settings management can be reasonably private, but requires active effort — the defaults favour Google's data collection.
• iPhone with default settings is more private than stock Android with default settings, but still collects meaningful data through iCloud and Apple services.

For most UK users, the practical recommendation is: use whichever platform you prefer, but take the time to review and tighten the privacy settings outlined above. The difference between default settings and optimised settings is significant on both platforms.

A Note on UK-Specific Considerations

UK users should be aware of a few specific considerations:

• The Investigatory Powers Act 2016 (sometimes called the "Snoopers' Charter") gives UK intelligence agencies broad powers to access communications data. End-to-end encryption (such as Apple's Advanced Data Protection) provides meaningful protection against this, though the legal landscape continues to evolve.
• UK GDPR and the Data Protection Act 2018 give you rights over your personal data that are enforceable through the ICO. Both Apple and Google are subject to these laws for UK users.
• The Online Safety Act 2023 has implications for encrypted messaging services, though its full impact on end-to-end encryption is still being determined.

Final Thoughts

Your smartphone is the most personal device you own, and the data it collects reflects that intimacy. Neither Apple nor Google is a perfect privacy guardian — both collect meaningful amounts of data, and both have commercial interests that shape their privacy decisions. But both also provide tools that, when used actively, can significantly reduce your exposure.

The most important step is simply to engage with your privacy settings. Most people never review them after setting up a new phone. Spending 30 minutes working through the steps outlined in this guide — on either platform — will meaningfully improve your privacy posture. And if you want to understand exactly what data is held about you, both Apple and Google provide data download tools that are worth using at least once.

For further guidance, the ICO's website (ico.org.uk) provides authoritative information on your rights under UK data protection law, and the National Cyber Security Centre (ncsc.gov.uk) publishes practical security advice for UK consumers.