Privacy Settings Audit Checklist: A Yearly Review for Apps, Browsers, and Online Accounts

Overview

Privacy settings are not a one-time task. Apps add features, devices change, accounts accumulate, and companies may reorganize controls after a redesign or policy update. A setting that was appropriate when you installed a service may no longer match how you use it.

Start with an inventory rather than changing everything at once. List the browsers, phones, computers, social platforms, messaging apps, cloud-storage services, shopping accounts, financial accounts, smart devices, and work tools you use. Prioritize accounts that hold identity information, payment details, private messages, location history, or documents.

Keep a simple audit record with the service name, review date, settings changed, and follow-up needed. Do not record passwords, authentication codes, security-question answers, recovery codes, or complete account numbers in the checklist. If you use a shared document, protect it as carefully as any other sensitive record.

Privacy and security overlap, but they are not identical. A setting that limits personalization may not protect an account from takeover, while a strong password may not prevent an app from accessing contacts or location data. Review both categories.

Checklist by scenario

Browsers

• ☐ Review which sites can use cookies, cross-site tracking, pop-ups, notifications, camera, microphone, location, and clipboard access.
• ☐ Remove permissions for sites you no longer use.
• ☐ Check saved passwords, payment information, addresses, and autofill entries. Delete anything outdated or stored on a device you no longer control.
• ☐ Review synchronization. Confirm which data is synced across devices and whether that is appropriate for the account.
• ☐ Check whether the browser is sending diagnostic or usage data, and choose the least data-sharing option that still meets your needs.
• ☐ Clear old extensions and review the permissions of extensions you keep. Remove extensions that are unused, duplicated, or broader than necessary.

Mobile apps and devices

• ☐ Open the device privacy or permissions panel and review location, contacts, photos, microphone, camera, Bluetooth, calendar, health, and local-network access.
• ☐ Change permissions from broad access to limited or one-time access where the device offers that choice.
• ☐ Remove apps you no longer use. Deleting an app may not delete the associated account, so check the service separately when necessary.
• ☐ Review background activity, notification previews, advertising identifiers, and personalization controls.
• ☐ Check lock-screen content so messages, calendar items, or authentication alerts are not displayed to anyone who can see the device.
• ☐ Confirm that automatic updates and device-finding features are enabled where practical.

Social platforms and messaging

• ☐ Review who can see posts, profile details, contact information, stories, tagged content, and your followers or connections.
• ☐ Limit discoverability by phone number or email address if you do not need people to find you that way.
• ☐ Review connected apps, active sessions, linked accounts, and devices. Revoke access you do not recognize or no longer need.
• ☐ Check direct-message, group-invite, mention, tagging, and read-receipt controls.
• ☐ Review contact-upload or address-book matching features. Disable them if the convenience does not justify sharing other people’s information.
• ☐ Inspect old public posts, profile fields, and photos for information that could support impersonation or social engineering.

Cloud storage, email, and online accounts

• ☐ Review folders and files shared by link, by person, or with an organization. Replace broad links with named recipients where possible.
• ☐ Remove former collaborators and check whether downloaded copies remain outside your control.
• ☐ Audit third-party integrations, forwarding rules, delegated access, and connected applications.
• ☐ Enable multifactor authentication, preferably with a method that does not rely solely on text messages when stronger options are available.
• ☐ Confirm recovery email addresses and phone numbers are current, private, and controlled by you.
• ☐ Review login alerts and active sessions. Sign out of old or unfamiliar devices, then change the password if activity cannot be explained.

Advertising, location, and data-broker preferences

• ☐ Review advertising personalization in your device, browser, search, social, shopping, and streaming accounts.
• ☐ Check location history, location sharing, saved places, and location access for individual apps. Keep precise location off unless a feature genuinely requires it.
• ☐ Review family, household, vehicle, and emergency-sharing features separately. Make sure old relationships or devices are not still included.
• ☐ Search for privacy centers, “do not sell or share” controls, access requests, deletion requests, and marketing opt-outs offered by services you use.
• ☐ If you submit a data-broker removal request, use the company’s official privacy or opt-out page and record the request date without saving unnecessary identity documents.
• ☐ Read the confirmation carefully. An opt-out may reduce certain uses of data without removing information from every source or service.

Menu names differ by platform and may change after an update. When a path is not obvious, use the service’s own help center or privacy dashboard rather than a link in an unsolicited message. For related scam checks, see this guide to smishing red flags.

What to double-check

After making changes, test the result from a normal user perspective. Open a private browsing window, view a profile while signed out if the platform allows it, inspect a shared-file link, or check what appears on a locked device. A control can be enabled in one place and overridden by a more specific setting elsewhere.

Pay particular attention to these areas:

• Account recovery: Privacy changes are not useful if an old email address or phone number can still reset the account. Review recovery methods and backup codes without exposing them in your audit notes.
• Third-party access: A service may retain access through an integration even after you change its main privacy settings. Review connected apps and remove unused authorizations.
• Shared information: Check whether a setting affects only future activity or also older posts, files, history, and backups.
• Household devices: Smart speakers, televisions, cameras, printers, and shared tablets may have separate accounts and permissions. Review microphones, recordings, remote access, and guest access.
• Work and personal boundaries: Do not upload personal documents to a work account or connect personal apps to an employer-managed device without understanding the organization’s controls and retention practices.
• Privacy rights: Access, correction, deletion, portability, or objection options vary by location, organization, account type, and applicable law. Treat the provider’s current privacy notice as the controlling source for available procedures.

Common mistakes

• Changing settings from an email link: Phishing pages can imitate privacy dashboards. Open the app or type the known website address yourself. If you receive a breach or privacy notice, use this safe verification process before entering credentials.
• Choosing “allow all” for convenience: Consider whether an app needs continuous location, contacts, or microphone access. A narrower permission often preserves the core feature.
• Assuming private means invisible: Private profiles, incognito windows, and deleted posts do not necessarily erase information already collected, copied, backed up, or shared with others.
• Ignoring old accounts: Abandoned accounts can contain addresses, payment records, messages, or reused passwords. Delete them when possible; otherwise update the password and recovery information.
• Saving sensitive audit notes: A checklist should show what was reviewed, not provide a roadmap into your accounts. Use partial identifiers and avoid secrets.
• Confusing privacy with breach recovery: If a company confirms exposed information, follow its official instructions and consider password changes, session review, and credit or identity protections appropriate to the data involved. Privacy settings alone do not reverse a data breach.

When to revisit

Schedule a full privacy audit at least once a year, ideally before a recurring planning or renewal cycle. A lighter review every few months is useful for high-value accounts such as email, cloud storage, financial services, and administrator accounts.

Do not wait for the annual date when something changes. Revisit settings after installing a new phone or browser, joining a new platform, accepting a major app redesign, changing jobs, moving, adding a household member, losing a device, or receiving a privacy-policy notice. Review immediately after a suspected account compromise, unexpected login alert, or confirmed breach; a breach recovery tracker can help separate privacy, password, credit, and identity-protection tasks.

At the end of each review, record three items: what you changed, what remains uncertain, and the date you will check again. Then remove unused apps, revoke unnecessary access, and confirm one recovery method while the account is open. Small, documented reviews are easier to repeat—and more reliable—than a rushed attempt to change every setting at once.