Best Google Account Settings for Security and Privacy

Passwords alone are no longer sufficient to protect sensitive accounts. Phishing campaigns and credential leaks frequently compromise static passwords, which is why configuring modern authentication methods should be your top priority. Google natively supports FIDO2 passkeys, which use your device's biometric sensors or hardware security keys to authenticate sessions without transmitting a secret that can be stolen remotely.

To configure your sign-in methods, navigate to your account dashboard and follow this path:

1. Go to Security > How you sign in to Google > Passkeys and security keys.
2. Select Create a passkey to register your current computer, phone, or a dedicated hardware key like a YubiKey.
3. Return to How you sign in to Google and select 2-Step Verification.
4. Verify that your backup options avoid SMS text messages whenever possible, as cellular numbers are vulnerable to SIM-swapping attacks. Instead, select an authenticator app (such as Google Authenticator or an encrypted password manager) or hardware tokens.
5. Scroll down to Backup codes and generate a fresh ten-pack of single-use codes. Print these out or store them inside an encrypted offline vault so you are never locked out if your primary device breaks.

Over several years of browsing, you have probably used the "Sign in with Google" button on dozens of websites, online games, productivity utilities, and forgotten mobile apps. Each connected service retains varying levels of access to your profile data, and if a third-party developer suffers a server breach, your authorization token could be exploited.

Cleaning up legacy authorizations eliminates background access privileges you no longer need. Open your Google account and go to Data & privacy > Apps and services > Third-party apps with account access (or check Security > Your connections to third-party apps & services). Carefully review every entry in the list.

If you see a service you have not used in the past six months, click its entry and select Delete all connections. Pay strict attention to services that claim broad scopes such as "Read, compose, send, and permanently delete all your email from Gmail." Unless that third-party tool is a dedicated email client you actively rely on daily, revoke its credentials immediately.

Google defaults to logging extensive records of your online behavior to refine recommendations and serve personalized advertisements. This includes your YouTube watch history, Google Maps location tracking, voice audio recordings, and web searches across Chrome and Android. Keeping years of granular activity logs creates an unnecessary privacy liability if an unauthorized party ever gains temporary access to your session.

You do not have to turn off all features entirely to protect yourself; instead, set up automatic purging schedules:

• Go to Data & privacy > History settings.
• Click Web & App Activity, confirm whether you want sub-options like audio recordings and Chrome browser history enabled, then select Auto-delete. Choose 3 months from the dropdown menu and confirm.
• Return to History settings, open Timeline (formerly Location History), and set the retention limit to 3 months or pause it completely if you do not rely on travel histories.
• Select YouTube History and set its auto-delete threshold to 3 months as well.

Applying automated deletion ensures that your personal records expire continually without requiring manual monthly maintenance.

Web browsers are the primary entry point for drive-by malware downloads, rogue extensions, and fake login portals. Google includes a proactive protective feature known as Enhanced Safe Browsing, which inspects suspicious URLs and downloads in real time against known threat databases.

To turn this on, navigate to Security > Enhanced Safe Browsing for your account > Manage Enhanced Safe Browsing, then toggle the slider to the On position. While Standard Protection only checks cached lists of dangerous sites, the Enhanced setting actively analyzes unexpected page behavior and warns you before you enter credentials on brand-new deceptive domains.

This setting also alerts you instantly if a saved password inside Chrome has been detected in a public data breach, giving you an immediate prompt to rotate the compromised credentials before malicious actors can exploit them.

Old phones, loaner laptops, school computers, and obsolete tablets often retain active Google authentication tokens long after you stop using the physical hardware. If one of those older devices is sold, handed down, or compromised, whoever controls it may still have direct access to your account data.

To audit your active hardware:

1. Go to Security > Your devices > Manage all devices.
2. Review the full inventory of computers, phones, smart displays, and TVs logged into your profile.
3. Look for suspicious geographical locations, duplicated device names, or systems that have not synced in weeks.
4. Click on any outdated or unfamiliar device entry and select Sign out.

If you see a device you definitely did not authorize, sign it out immediately, update your master password, and generate a new set of passkeys to invalidate all existing authentication cookies across the board.

Hardening an account also means preparing for worst-case scenarios, such as lost devices or unexpected emergencies. If you lose your primary phone while traveling, recovery options are the only bridge between you and your critical files. Without updated recovery routes, strict two-step verification can inadvertently lock you out permanently.

Navigate to Security > How you sign in to Google > Recovery phone and Recovery email. Verify that your recovery email address is completely independent of Google (such as an encrypted Proton or iCloud mailbox) and that the recovery phone number is current.

Finally, scroll to the bottom of Data & privacy and select Make a plan for your digital legacy (Inactive Account Manager). This tool lets you decide when Google should consider your account dormant (for instance, after 3, 6, or 12 months of inactivity) and allows you to nominate trusted contacts to receive an archive of your photos, documents, and emails if you become incapacitated.