Operating systems

• Diagnostic data (telemetry). Reports about your hardware, crashes and app usage sent to the vendor. Windows Home and Pro cannot switch it off completely; the Linux distributions below send nothing unless you opt in.
• Accounts and cloud sync. Signing in with a Microsoft, Apple or Google account ties the device to an identity and can move backups, photos and even disk-encryption recovery keys onto the vendor's servers.
• Screen and AI features. Features such as Windows Recall keep a searchable history of what was on your screen. Recall is opt-in and stored on the device, but it is one more store of sensitive data to protect.
• Your network identity. An ordinary system connects with your real IP address. Only Tor-based systems such as Tails and Whonix hide it by design.
• Physical access. A lost, stolen or seized device is protected by disk encryption and a strong passphrase, not by privacy settings. Phones are hardest to extract data from when they are off or have restarted and not been unlocked since. See the digital forensics guide.
• Updates. A system that no longer receives security updates collects known, unpatched holes. Check how long both the software and the hardware will be supported.

Which system for which job

These systems are open source, send no telemetry and are built around isolation, anonymity or hardening. They protect against different things: Tails and Whonix hide your IP address by sending everything through Tor, Qubes OS limits the damage when one program is compromised, and Kicksecure hardens an ordinary Debian desktop.

Mainstream distributions do not route traffic through Tor and add little hardening, but the three below send no usage statistics unless you opt in. They are a reasonable everyday choice if you encrypt the disk at installation, keep the system updated and use a privacy-focused browser.

Windows is closed source, sends diagnostic data by default and increasingly expects a Microsoft account. The steps below reduce what it sends; they do not make it comparable to the systems above.

What changed in 2025 and 2026

• Windows 10 is out of support. Free security updates ended on 14 October 2025. Enrolled PCs can receive Extended Security Updates until 12 October 2027, but enrolment requires signing in with a Microsoft account (Microsoft).
• Setup expects a Microsoft account. In October 2025 Microsoft started removing, in Windows 11 test builds, the known ways to create a local account during setup, so users must finish setup online with a Microsoft account (Windows Insider blog).
• Telemetry cannot be fully switched off on Home or Pro. Their lowest level is Required diagnostic data, which includes device details and a list of installed apps. The Diagnostic data off level exists only on Enterprise, Education and Server editions (Microsoft Learn).
• Recall is opt-in. On Copilot+ PCs, Recall takes periodic snapshots of the screen and stores them encrypted on the device. Saving snapshots is off by default, and you can remove the feature under Turn Windows features on or off (Microsoft support). Since May 2025 Signal Desktop on Windows 11 blocks screenshots of its window by default, which keeps chats out of Recall (Signal).
• Recovery keys go to your account. When you set up a PC with a Microsoft account on supported hardware, device encryption turns on and the recovery key is stored in that online account (Microsoft support).

Reducing what Windows sends

1. Pick the edition. Windows 11 Enterprise LTSC 2024 receives security fixes without feature updates until October 2029, ships without most in-box apps and, as an Enterprise edition, can switch diagnostic data off. Microsoft sells Enterprise and LTSC only through commercial licensing; shop and preinstalled copies are Home or Pro (licensing overview, LTSC overview).
2. Install with a local account and data sharing off. Christoph Schneegans' unattend generator builds an answer file that creates local accounts, turns off optional data sharing and removes chosen built-in apps during installation.
3. Set diagnostic data by policy. In the Group Policy editor, open Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Allow diagnostic data, and choose Diagnostic data off (Enterprise, Education) or Required (Pro). On Home, use Settings > Privacy & security.
4. Limit other connections. Microsoft documents the settings that stop Windows components from contacting its services and publishes a restricted-traffic baseline for Enterprise editions. Some settings weaken security: leave Windows Update, Defender and root certificate updates on (Microsoft Learn).
5. Remove Edge if you do not use it. In the European Economic Area, Edge can be uninstalled from Settings > Apps (Microsoft). Elsewhere, a community removal script is maintained for current versions; it runs with administrator rights, so read it first, and expect the WebView2 runtime to stay.
6. Block tracking domains on the network. A filtering DNS resolver or network-wide blocker covers every device and is easier to maintain than a hand-edited hosts file; see the DNS guide.

Apple systems are closed source and many features need an Apple Account. Three settings are worth knowing:

• Lockdown Mode is for people who may be personally targeted by mercenary spyware. It blocks most message attachments and link previews, complex web technologies, FaceTime calls from people you have not contacted in the last 30 days, wired connections while the device is locked, and configuration profiles. It is available on iOS and iPadOS 16 and macOS Ventura or later, and must be turned on separately on each device in Privacy & Security settings (Apple).
• Advanced Data Protection end-to-end encrypts most iCloud data, including backups, iCloud Drive and Photos. iCloud Mail, Contacts and Calendars stay readable by Apple (Apple). Apple no longer offers it to new users in the United Kingdom (Apple).
• Analytics. Turn off device analytics under Settings > Privacy & Security > Analytics & Improvements (Apple).

A custom Android distribution replaces the system the manufacturer installed. The privacy gain is losing Google's and the manufacturer's built-in services; the risk is losing security the manufacturer provided. Two questions matter most: does the system still get monthly security patches and firmware updates, and can you relock the bootloader afterwards? A relocked bootloader keeps verified boot working, which means the phone checks at every start that the system has not been tampered with.

When Google published Android 16 in June 2025, it left out the Pixel device code it used to release with each version, so projects that support Pixels have had to maintain that code themselves (CalyxOS, GrapheneOS). Since 2026 Google also publishes Android source code only twice a year, in the second and fourth quarters, so independent systems can wait months for changes that Pixels already have (Android Open Source Project).

If you do not have a Pixel, these systems remove Google services but offer less security hardening than GrapheneOS. Before installing one, check two things for your exact phone model: whether the bootloader can be relocked, and whether the manufacturer still ships firmware updates. A system cannot fix closed-source firmware the manufacturer has stopped updating.

DivestOS, a security-focused LineageOS fork, is no longer maintained; its build repository was archived on 23 December 2024 (GitHub).

Google is introducing a rule that apps on certified Android devices must come from developers who have registered with Google, including apps installed from outside the Play Store. The first phase began on 30 September 2026 in Brazil, Indonesia, Singapore and Thailand and covers only installs from seven large app stores, including Google Play and Samsung Galaxy Store; direct downloads and other stores are not checked yet. Google plans to extend the checks to all apps on certified devices worldwide in 2027 (Android Developers, guide).

• The checks apply to Google-certified devices running Android 7 or later and are delivered through Google Play services (FAQ).
• Apps installed over USB with ADB, the Android developer tool, are not checked.
• An "advanced flow" lets experienced users allow unverified apps: turn on developer options, restart, wait one day, then confirm with your PIN or biometrics (Google).
• Students and hobbyists can share apps with up to 20 devices without an ID check or fee.

F-Droid, the main store for open-source Android apps, has argued that the rule threatens free and open-source app distribution (F-Droid). GrapheneOS and other custom systems are not Google-certified, so they fall outside the stated scope, but developers who want their apps to install on ordinary phones will still have to register or rely on users completing the advanced flow.

• Encrypt the whole disk when you install (LUKS on Linux, FileVault on macOS, BitLocker or device encryption on Windows) and use a long passphrase. See the encryption guide.
• Check support before buying hardware. Pixel 8 and newer get at least seven years of updates from launch; the Pixel 6 and 6 Pro reached the end of their guaranteed support in October 2026 (GrapheneOS FAQ). GrapheneOS does not support the Pixel 11 series as of October 2026; in August 2026 it advised buying a Pixel 8, 9 or 10 instead (GrapheneOS).
• Buy a Pixel that is not a carrier variant. Carrier versions can block bootloader unlocking, which GrapheneOS needs (install guide).
• Keep identities apart. Use separate qubes, virtual machines, user profiles or Tails sessions for activities that should not be linked, and restart Tails between them.
• Power off a device that may be seized, for example before a border crossing. A phone that has restarted and not been unlocked since is much harder to extract data from. Laws on refusing to unlock a device or wiping it differ by country, and GrapheneOS itself warns that using its duress wipe can have legal consequences (GrapheneOS forum).
• Verify what you download. Tails, Qubes OS and Whonix publish signed images, and GrapheneOS lets you compare the verified boot key hash shown at startup.
• Move off end-of-life releases. Qubes OS 4.2 and Whonix 17 no longer receive security updates; upgrade to Qubes OS 4.3 and Whonix 18.
• Skip the usage statistics. On Arch, do not install pkgstats; on Debian, answer No to the package usage survey (popularity-contest).

• Expecting a Linux distribution to make you anonymous. Debian, Arch and Gentoo still connect with your real IP address. Use Tails, Whonix or Tor Browser for anonymity, and see the VPN guide for what a VPN does and does not hide.
• Logging in to personal accounts during an anonymous session. One login can link everything else you do in that session to you.
• Running scripts you have not read as administrator. Debloaters, activators and removal tools can change anything on the system.
• Leaving the bootloader unlocked after installing a custom Android system, which leaves verified boot switched off.
• Picking a "de-Googled" system that has stopped getting updates. Removing Google services does not help if the system misses months of security patches.
• Staying on an end-of-life system, such as Windows 10 without Extended Security Updates or a phone past its last patch.

• Tails: warnings and limitationstails.netWhat an amnesic Tor system can and cannot protect against.
• Privacy Guides: Android overviewprivacyguides.orgVerified boot, firmware updates and why most custom Android systems are not recommended there.
• GrapheneOS: protections against data extraction from locked devicesdiscuss.grapheneos.orgHow auto-reboot, secure element rate limiting and USB controls work together.
• Microsoft Learn: manage connections from Windows to Microsoft serviceslearn.microsoft.comThe settings Microsoft documents for limiting what Windows contacts.
• Apple: About Lockdown Modesupport.apple.comFull list of what Lockdown Mode restricts on iPhone, iPad and Mac.