Six iPhone Privacy Switches That Control What Apps Can See

Your iPhone asks one deceptively simple question every time a new app wants to follow you around the internet: “Allow this app to track your activity across other companies’ apps and websites?” Most people tap “Ask App Not to Track” and move on, which is the right instinct. But that single tap only covers one layer of a tracking system that runs far deeper than most iPhone owners realize.

App Tracking Transparency in iOS 26 blocks apps from accessing your device’s advertising identifier, a unique code that lets advertisers build a profile of everything you do across dozens of unrelated apps. Turn it off, and that code goes dark. The catch is that ATT only governs one tracking method, and companies like Meta have found workarounds that operate in the gaps Apple left open. The difference between “mostly private” and “actually private” on your iPhone comes down to five additional settings buried across three different menus.

I want to walk through each one, starting with the toggle that gets all the attention and ending with the ones that quietly do more heavy lifting.

The One Toggle Everyone Knows About

Open Settings, tap Privacy & Security, then tap Tracking. At the top of the screen sits “Allow Apps to Request to Track.” When this toggle is off, every app that tries to request tracking permission is automatically denied. The app never even gets to show you the prompt. Apple returns a string of zeros in place of your advertising identifier, which is the digital equivalent of handing someone a blank business card.

When the toggle is on, apps can ask, and you decide case by case. Below the master toggle, you will see a list of every app that has previously requested permission. Each one has its own switch. I prefer keeping the master toggle off entirely. It does, though, mean that you lose the ability to selectively allow tracking for apps where personalized ads might actually be useful to you, like a shopping app that surfaces relevant deals. That tradeoff is worth it for most people.

One edge case worth knowing: if this toggle appears grayed out, your Apple ID might be managed by a school or workplace, or the account belongs to someone under 18. Apple locks the toggle to off for child accounts with no way to override it.

What App Tracking Transparency Actually Blocks

ATT prevents apps from reading your iPhone’s Identifier for Advertisers. That sounds narrow, and it is. But the IDFA was the backbone of mobile advertising for a decade. It let an ad network see that the person who searched for running shoes in one app also browsed hotel prices in another, then served ads accordingly.

When you deny tracking, the app is also prohibited from using your email address, phone number, or any other identifier to track you across third-party apps and websites. Apple enforces this through App Store review, as documented in Apple’s App Tracking Transparency developer framework. Developers who violate the policy risk removal.

Here is what ATT does not block. An app can still track everything you do inside that app and across other apps owned by the same company. Meta can follow your activity from Instagram to Facebook to Threads to WhatsApp without triggering ATT at all, because those are all first-party properties. This is the gap that frustrates privacy advocates, and it is by design rather than oversight. Apple defines tracking as cross-company data sharing, not cross-app data sharing within a single company’s ecosystem.

If you want a broader look at how Apple’s privacy architecture protects your iPhone, our guide to locking down your iPhone privacy with iOS 26.3 settings covers carrier tracking, AirDrop verification, and background security patches.

The Safari Settings That Do the Real Work

ATT handles apps. Safari handles the web. And in iOS 26, Apple quietly made Safari’s anti-tracking tools significantly more aggressive.

Open Settings, scroll down to Apps, tap Safari, then look for Prevent Cross-Site Tracking. This should already be on by default. It blocks third-party cookies, which are the web equivalent of the IDFA. But iOS 26 added something more interesting underneath.

Scroll further in Safari’s settings to Advanced, then tap Advanced Tracking and Fingerprinting Protection. By default, this is set to Private Browsing only. Change it to All Browsing. This is the single most impactful privacy toggle most iPhone owners never touch.

What it does: Safari now injects noise into the data that websites use to fingerprint your device. Your screen resolution, your installed fonts, your graphics card output, your audio processing characteristics — all of these are slightly randomized so that tracking scripts see a different “you” on every website. Apple also strips click-tracking parameters from URLs. When you tap a link that includes Meta’s fbclid, Google’s gclid, or TikTok’s ttclid, Safari removes those identifiers before loading the page.

The practical effect is substantial. Fingerprinting was the tracking industry’s answer to ATT. With Advanced Tracking and Fingerprinting Protection set to All Browsing, you close the biggest remaining gap in your iPhone’s privacy stack.

Hide Your IP Address and Block Email Tracking

Two more toggles round out the picture.

Still in Safari settings, tap Hide IP Address and select “From Trackers and Websites.” This routes your Safari traffic through Apple’s iCloud Private Relay, which requires an iCloud+ subscription. The relay system is clever: it splits your request across two separate servers so that neither Apple nor the relay operator can see both your identity and the website you are visiting. If you don’t have iCloud+, choosing “From Trackers” still hides your IP from known tracking domains without the full relay.

For email, open Settings, tap Mail under Apps, then tap Privacy Protection. Turn on Protect Mail Activity. This blocks invisible tracking pixels that tell senders when you opened an email, how many times, and from what IP address. It also prevents senders from knowing whether you have opened the message at all. Newsletter senders and marketing teams rely heavily on open-rate tracking, and this toggle cuts them off completely.

For a complementary approach to search privacy, setting DuckDuckGo as your default search engine on iPhone stops search-engine-level profiling in Safari.

The Privacy Feature Apple Barely Mentions

Buried in Settings under Privacy & Security, you will find App Privacy Report. Turn it on, and your iPhone starts logging every time an app accesses your location, camera, microphone, photos, or contacts. It also records which internet domains each app contacts.

I also really like the reassurance I get from scrolling through the Most Contacted Domains section. It shows, in plain language, which servers your apps are talking to behind the scenes. You might discover that a flashlight app contacts six advertising networks. That context turns a vague suspicion into an informed decision: delete the app, or at least revoke its permissions.

App Privacy Report does not block anything. It watches and records. But the information it surfaces is exactly what you need to decide which apps deserve your trust.

Quick-Action Checklist

For anyone who wants to lock down tracking in under five minutes:

1. Settings › Privacy & Security › Tracking — toggle off “Allow Apps to Request to Track”
2. Settings › Apps › Safari — confirm “Prevent Cross-Site Tracking” is on
3. Settings › Apps › Safari › Advanced — set “Advanced Tracking and Fingerprinting Protection” to All Browsing
4. Settings › Apps › Safari — set “Hide IP Address” to “From Trackers and Websites” (requires iCloud+) or “From Trackers”
5. Settings › Apps › Mail › Privacy Protection — turn on “Protect Mail Activity”
6. Settings › Privacy & Security — turn on App Privacy Report and check it weekly