Locking down your Android

Before you change anything

If you think someone is monitoring your phone, changing settings can tip them off — some monitoring apps notify their controller when permissions change or when the app stops working, and removing something can also destroy evidence you might need later. Read Safety first: before you remove anything before you touch any of the steps below, especially if you’re in an abusive or controlling relationship.

If you’re just doing routine maintenance on your own phone, none of that applies — work through this at whatever pace makes sense.

Menus below are for close-to-stock Android (Pixel-style); other manufacturers rename or nest these screens differently — search your Settings app for the bolded term if you can’t find it where described.

Check who’s signed in to your Google account

Your Google account, not just your phone, is often the real target. Google’s Security Checkup walks through your signed-in devices, recovery info, and recent security activity in one pass.

Go to Settings → Google → Manage your Google Account → Security, or visit Security Checkup directly from a browser.
Under Your devices, look for anything you don’t recognize, don’t own anymore, or haven’t used in months.
Select any unfamiliar device and sign it out.

You can also see this list directly at google.com/devices, which shows every device currently or recently signed in to your account and lets you sign out sessions individually (Google Account Help). A device you don’t recognize with account access can see Gmail, Photos, and anything else tied to that account — not just what’s on the phone in your hand.

Turn on Play Protect — and understand what it won’t catch

Google Play Protect scans apps from the Play Store and from other sources for known malicious behavior, and it’s on by default (Google Play Help).

Open the Play Store app.
Tap your profile icon (top right) → Play Protect → Settings (gear icon).
Make sure Scan apps with Play Protect is on.

Here’s the honest version: Play Protect is a reasonable baseline, not proof of a clean phone. In 2025 testing by the Electronic Frontier Foundation and AV-Comparatives covering 17 stalkerware products, Play Protect had the lowest detection rate — 53 percent — and EFF notes this is partly because some stalkerware comes with specific instructions telling the person installing it to disable Play Protect first (EFF). If Play Protect is already off and you didn’t turn it off yourself, that’s worth noting. Treat a clean scan as one data point, not a verdict. For more on what any scan can and can’t promise, see What a scan can and can’t tell you.

Review app permissions — by app or by type

Android gives you two ways in: Settings → Apps → [app] → Permissions for a single app, or Settings → Security & Privacy → Privacy → Permission manager to audit by permission type across every app.

By app:

Tap the app → Permissions.
For each permission, choose Allow, Allow only while using the app, Ask every time, or Don’t allow (Google Android Help).

By permission type (faster for an audit):

Go to Settings → Security & Privacy → Privacy → Permission manager.
Tap a permission — Location, Camera, Microphone, Contacts, Notifications — and see every app that has it.
Tap any app in that list to change or revoke it (Google Android Help).

For location specifically, prefer Allow only while using the app over All the time unless you have a real reason otherwise. If you’re unsure what a given permission actually grants an app, What app permissions actually mean breaks each one down.

Turn on auto-reset for apps you don’t use. Go to Settings → Apps → [app], and under Unused app settings, turn on Pause app activity if unused — Android will automatically strip access from apps sitting idle, which closes a gap without you having to remember every app you installed once (Google Android Help).

Check accessibility services and device admin apps

These two settings are the ones stalkerware is repeatedly documented abusing, because both are designed to grant broad, persistent access to what’s on your screen.

Accessibility services are meant for screen readers and similar tools — but that same access lets an app read your screen and act on your behalf.

Go to Settings → Accessibility.
Look through Installed apps or Downloaded apps. If you don’t use accessibility tools, this list should be effectively empty.
Anything unfamiliar — especially with a vague name like “System Service” or “Device Health” — deserves a closer look before you decide whether to turn it off. Peer-reviewed research from the University of Cambridge found that several major stalkerware families rely on accessibility services as their main way of reading on-screen messages and logging keystrokes (Catch Me If You Scan, University of Cambridge; restricted-settings background at Google Android Help).

Device admin apps originated for corporate device management — remote wipe, forced lock screens — but grant similarly deep control (Android Developers).

Search Settings for Device admin apps, or go to Settings → Security & Privacy → More security settings → Device admin apps (path varies by manufacturer).
On most personal phones you’d expect none active. If you see one you don’t recognize, that’s a flag.

If you find something in either list that you didn’t install and don’t understand, stop before disabling or removing it — go back to Safety first rather than acting immediately.

Sideloading and “unknown sources”

Apps installed outside the Play Store — sideloaded apps — skip Google’s app-review process entirely, and researchers have documented sideloading as a primary distribution path for stalkerware (Catch Me If You Scan, University of Cambridge). Android controls this per-app rather than with one global switch: go to Settings, search Install unknown apps, and check which apps (a browser, a file manager) are allowed to install others. Turn off any you don’t remember granting.

Separate from your device’s location permission, Google Location Sharing controls who sees your real-time location in Maps, Messages, and related apps. Check Settings → Location → Location services → Google Location Sharing, or open Google Maps → profile picture → Location sharing, to see who you’re currently sharing with and stop it for anyone who shouldn’t have it (Google Account Help).

None of this proves a phone is clean, and that’s fine — the goal is closing the ordinary doors, not chasing certainty that doesn’t exist.