The macOS privacy settings almost nobody turns on

There is a reliable pattern in privacy advice: people install three tools before touching the settings already on their machine. Several of the most valuable controls in macOS ship off, default to permissive, or live somewhere nobody looks.

None of the following requires third-party software.

1. Analytics and improvement sharing

System Settings → Privacy & Security → Analytics & Improvements.

Four separate switches — Mac analytics, iCloud analytics, sharing with app developers, and improvement data for individual services. On a clean install these are typically accepted during setup because the setup assistant presents them at the moment nobody is reading.

Turning them all off costs you nothing you will notice. Crash reports are the only genuine trade-off, and only if you are the sort of person who follows up on bug reports.

2. Encrypted DNS

macOS supports DNS over HTTPS and DNS over TLS natively via configuration profile, without any app. This is the single highest-value change on this page: it prevents your ISP and anyone on the local network from logging every domain you look up.

Combine it with a filtering resolver and you get tracker blocking as a side effect. Full walkthrough in the DNS privacy guide.

3. Local network access

Privacy & Security → Local Network.

The permission almost nobody audits. Applications request it to discover printers, casting targets and other devices — and also, in some cases, to fingerprint your home network for advertising purposes. Most of the apps in this list have no legitimate reason to be there.

Revoke anything that is not a media, printing or development tool. If something breaks, you will know immediately and can re-enable it.

4. Accessibility and Screen Recording, audited

These two grant the most power of any permission on the system. Screen Recording allows an app to see everything on your display; Accessibility allows it to read and drive other apps' interfaces.

Both lists deserve a quarterly review. The right question is not "is this app trustworthy" but "does this app still need this". Screenshot tools you stopped using, a conferencing app you installed for one call, a window manager you removed — the grants persist after the need does. We go through how to evaluate a specific grant in what Accessibility actually allows.

5. Advertising identifier and personalised ads

Privacy & Security → Apple Advertising. One switch, off by default on recent installs but on for anyone who upgraded from an older release without checking.

6. Find My network participation

Useful if you lose hardware, and a continuous background beacon if you never do. Worth a deliberate decision rather than a default.

7. Lockdown Mode, for the small group who need it

An extreme setting that disables link previews, certain fonts, some web technologies and unsolicited connection types. It makes the machine noticeably less pleasant to use, and it is aimed at people facing targeted, well-resourced attackers. If you are not sure whether you are in that group, you are not.

A note on what this does not cover

All of the above constrains Apple and the permission model. None of it stops a third-party application from talking to its own servers about your usage, because macOS has no control for that. That gap is exactly what outbound filtering exists to fill, and it is covered in why visibility matters.

Frequently asked questions