Android Advanced Protection: what it turns on, and who it's for

Most security settings on a phone are a trade-off you make one at a time: allow this, block that, ask me first. Advanced Protection takes those decisions off your hands. It’s one switch that turns on the strongest settings Android has, and then keeps them on until you turn the whole thing off. It was designed for journalists, activists and others who might be targeted, but nothing stops anyone from using it.

What it turns on

The official help groups the protections into a few areas. The exact list depends on your phone and Android version, and some need a restart to take effect.

Apps

• The built-in malware scanner stays on and can’t be disabled.
• Apps from unknown sources are blocked, and apps already installed that way can’t be updated.
• Accessibility features, which can read the screen and tap for you, are limited to verified accessibility tools. Spying apps often abuse these features.
• Memory tagging, a hardware feature on supported phones, helps stop apps from corrupting memory. It can make the phone a little slower.

The device

• Theft Detection Lock locks the phone if it senses a snatch-and-run.
• Offline Device Lock locks an unlocked phone that’s been offline for a long time.
• Inactivity Reboot restarts the phone if it stays locked for 72 hours, which makes your data unreadable until the next unlock. See why restarting your phone protects it.
• USB Protection guards against attacks through the charging port while the screen is locked.
• Failed Authentication Lock locks the phone after repeated wrong attempts in apps and settings.
• Watch unlock is restricted, so a nearby watch can’t unlock the phone automatically.

Messages, calls and networks

• Spam and scam warnings are switched on in supported messaging and phone apps, including warnings about links from unknown senders.
• Connections to old 2G networks are blocked on supported phones.

How to turn it on

1. Make sure the phone has a screen lock: a PIN, pattern or password.
2. Open Settings, then Security & privacy. Under other settings, tap Advanced Protection. If you can’t find it, search Settings for “Advanced Protection”.
3. Turn on Device protection.
4. You’ll be offered Intrusion Logging, which keeps an encrypted record of device activity in your online account for later investigation. You can skip it.
5. Restart if the phone asks.

The same page offers Account protection, which strengthens your online account’s sign-in. It uses passkeys or security keys, so read what it needs before you enroll.

What it costs you

The protections are deliberately hard to get around, so expect a few limits:

• No apps from outside the app store. If you rely on one, it won’t install or update.
• No 2G. In places with only 2G coverage, your phone may have no signal.
• Some accessibility apps stop working if they aren’t verified tools.
• A restart after three days locked. Face and fingerprint unlock won’t work until you enter your PIN once.
• You can’t pick and choose. The settings come as a set.

Turning it off takes you back to exactly the settings you had before.

Who should turn it on

It’s worth it if any of these apply:

• someone may want your phone’s data specifically, such as an ex, an employer or anyone with a reason to target you;
• your phone may be taken from you, at a border, in a protest or by a thief;
• you never install apps from outside the app store, so you’d lose nothing.

If you sideload apps or rely on an accessibility app that isn’t verified, weigh that first. The individual protections in Android theft protection are a gentler step.

What it doesn’t do

Advanced Protection hardens the phone. It doesn’t add a lock to anything once the phone is unlocked. A person who knows your PIN, or picks up your phone while it’s open, still sees what you see. It also can’t remove an app that’s already spying on you, though it makes installing one much harder. If you’re worried about that, see checking for stalkerware on Android.

For photos and files that need their own lock, a vault adds a second layer. Silo, coming soon to iPhone and Android, encrypts what you import with a key from its own PIN, separate from the phone’s.