How to Keep Your Phone Safe From Data Leaks

Your phone holds more sensitive information than most laptops — banking credentials, health data, private messages, and a full record of where you’ve been. And unlike a laptop, it’s always on, always connected, and almost never audited.

The good news: most Android data leaks are preventable. They happen through predictable vectors — apps with excessive permissions, unsafe network connections, and outdated software. The steps below cover each one, in plain language, without requiring technical expertise or root access.

1. Enable and Verify Google Play Protect

Most Android users assume their phone is actively being scanned for malware. It is — but only if Google Play Protect is switched on and has run recently. This is the single most important baseline check to make, and most people have never confirmed it.

According to Google’s official Android security report for 2025, Play Protect now scans over 350 billion Android apps every day. In 2025 alone, its real-time scanning identified more than 27 million new malicious apps from sources outside Google Play. That scale reflects a real and active threat — not a theoretical one.

To verify it is running on your device:

1. Open the Google Play Store
2. Tap your profile icon in the top-right corner
3. Select Play Protect
4. Confirm the toggle is enabled, and tap Scan to run a manual check

Play Protect is a strong baseline, but it has documented limitations. Independent testing by AV-TEST in the second half of 2025 ranked it last among major Android security products when facing evasive, zero-day malware. Think of it as a floor — necessary, but not sufficient on its own.

2. Turn Off Installation From Unknown Sources

This is the most direct route for malicious software onto your device. When “Install Unknown Apps” is enabled for any app — a browser, a file manager, a messaging app — that app can push APK files onto your phone from any source, with no safety verification from Google.

The permission is granular on modern Android, meaning it’s granted app-by-app rather than as a single global toggle. This also means you may have granted it to multiple apps without realising it.

To audit and revoke it:

1. Go to Settings → Apps
2. Tap the three-dot menu and select Special App Access
3. Tap Install Unknown Apps
4. Review every app listed and disable the permission for any that don’t need it

One nuance worth understanding: not all sideloading carries equal risk. Installing an app from a source with a public audit trail like F-Droid is meaningfully different from installing an APK forwarded via a Telegram link. If you must sideload, grant the permission to a single dedicated installer app, install the file, and revoke the permission immediately after. For most users, there is no valid reason to have this enabled at all.

3. Audit Your App Permissions Regularly

This is where most data collection quietly happens — not through exploits, but through permissions users approved without reading. A flashlight app with access to your contacts. A photo editor with permanent microphone access. These approvals accumulate over years and are rarely revisited.

ESET’s security researchers, in their 2026 analysis of mobile app permissions, make the risk explicit: granting access to contacts, call logs, location, camera, or microphone to a malicious developer gives them the ability to build a detailed personal profile — and potentially read your screen as you type. The Android permissions framework requires explicit user approval for all sensitive categories, but that approval prompt is easy to dismiss habitually.

Run a permission audit every 60 to 90 days:

1. Go to Settings → Privacy → Permission Manager
2. Tap each sensitive category in turn: Location, Microphone, Camera, Contacts, Call Logs, SMS
3. For each app listed, apply one question: does this app have a legitimate, functional reason to access this?
4. Revoke anything that doesn’t pass that test — or remove the app entirely

After major app updates, permissions sometimes expand. That’s another reason to repeat this process periodically rather than doing it once and forgetting it.

4. Keep Your OS and Apps Updated

Software vulnerabilities are patched in updates. Between the day a flaw is discovered (or disclosed) and the day you install the fix, your device has a known exploitable weakness. The longer that gap, the more exposure you carry.

The EFF’s Android security and privacy guide lists OS updates as a non-negotiable baseline — not a nice-to-have. To minimise the patch window:

• Enable automatic app updates in the Play Store: tap your profile icon → Settings → Network Preferences → Auto-update apps
• Check for system updates monthly: Settings → System → System Update
• If your phone’s manufacturer has stopped releasing security patches, treat that as a real risk signal — unpatched OS-level vulnerabilities cannot be fixed by apps

Devices more than four or five years old that no longer receive security updates are operating without a safety net at the kernel level. No amount of careful app behaviour fully compensates for that.

5. Use a VPN on Public Wi-Fi

Public Wi-Fi — in airports, hotels, cafes, and transport hubs — is one of the most effective environments for intercepting mobile data. Two common passive techniques are man-in-the-middle (MITM) attacks, where traffic is routed through an attacker-controlled device, and Wi-Fi sniffing, where unencrypted data packets are captured without any visible interaction.

As NordVPN explains in their guide to securing public Wi-Fi connections, a VPN encrypts all traffic end-to-end, rendering intercepted packets unreadable regardless of the capture method. The critical word is trusted. A free, no-name VPN can itself become the data collection point you were trying to avoid — many free VPN services monetise by logging and selling user traffic. If you use a VPN, choose one from a provider with a published no-log policy and an independent third-party audit.

If a VPN is not available, the minimum rule: do not log into banking, email, or any account holding sensitive credentials over public Wi-Fi. For a vetted list of options, see our guide to recommended VPN apps for Android.

6. Be Selective About Ad-Supported Apps

In-app advertising is not just a nuisance — some ad SDKs embedded in third-party apps collect behavioural data across sessions, track activity across other apps, and can serve redirects to phishing pages or trigger silent file downloads. This is a documented pattern, particularly in free utility apps, games, and battery optimisers.

Before installing any free app, check its Data Safety section in the Play Store. This section discloses what data the app collects, whether it is shared with third parties, and whether it can be deleted. An app that collects location, device IDs, and browsing history — and shares them with “advertising partners” — is a data leak built into your home screen.

Practical filters:

• Prefer apps that offer a paid, ad-free version — it signals a business model that doesn’t depend on harvesting your data
• Browsers like Brave and Firefox for Android include built-in content blocking — no root required, no third-party install needed
• Enable Private DNS in Android settings (Settings → Network & Internet → Private DNS) using a filtering provider like dns.adguard.com to block ad and tracking domains at the system level

The guidance in older Android articles suggesting that ad blockers require a rooted phone has been outdated since Android 9. Every method above works on a standard, unmodified device.

7. Lock Down Authentication

A phone that can be physically accessed bypasses most software security. If someone can get past your lock screen — or reset it — every other protection becomes irrelevant within minutes.

Current best-practice standards for Android authentication, as documented in the Android authentication hardening guide:

• Use a 6-digit PIN minimum — avoid sequential numbers, repeated digits, and any number derived from personal information
• Enable fingerprint or face unlock as convenience over a strong PIN — biometrics are fast but cannot be legally compelled in many jurisdictions the same way a PIN can be
• Enable Identity Check on supported devices (Settings → Security & Privacy → Device Unlock → Theft Protection) — this adds a biometric requirement before changing critical settings, even if someone has your PIN
• Set your screen lock timeout to 30 seconds or less

Also enable two-factor authentication on your Google Account at Google’s account security settings. If your Google Account is compromised, everything synced to it — passwords, photos, emails, contacts — is exposed regardless of what’s running on the device itself.

8. Consider a Mobile Security App — With Realistic Expectations

A dedicated security app adds detection capability beyond Play Protect, particularly for phishing URLs, unsafe network warnings, and newer malware variants. It is not a replacement for any of the steps above — it is an additional layer. And it is only worth adding if you choose a product with a credible track record.

Options with strong independent testing results in 2025–2026:

• Bitdefender Mobile Security — consistently high detection rates with minimal system performance impact
• Malwarebytes for Android — effective against adware and spyware with a clear, uncluttered interface
• ESET Mobile Security — well-regarded in AV-TEST evaluations, includes a built-in permission audit tool

Before choosing, review AV-TEST’s independently conducted Android antivirus evaluations — they test all major products without vendor sponsorship and update results regularly.

Security Checklist

When These Steps Are Not Enough

The measures in this guide significantly reduce risk for everyday users. They do not protect against state-level or professional targeted attacks — sophisticated spyware like Pegasus and Predator exploits zero-day vulnerabilities and requires no user action to install. If you are a journalist, activist, lawyer handling sensitive cases, or anyone facing a targeted threat, the protection model is entirely different. The EFF’s Surveillance Self-Defense project is the right starting point for that threat level.

One additional edge case: if your phone was purchased second-hand, perform a full factory reset before first use. Pre-installed surveillance or adware software on some devices — particularly from less-regulated grey market channels — is a documented issue that sits outside the standard Android threat model.

Frequently Asked Questions