I Checked My Google Account Security — These Settings Needed Attention

Most people assume their Google Account is secure because they haven't been hacked yet. That's a dangerous assumption. Google offers dozens of security and privacy settings that most users never touch — and some of them are quietly exposing your data, leaving old devices connected, or letting third-party apps access information you'd rather keep private.

I recently sat down and went through my own Google Account settings page by page. What I found surprised me. Old phones I hadn't used in years still had access. Apps I'd forgotten about could still read my Gmail. Location history was storing years of my movements. And my recovery information hadn't been updated since 2019.

Here's exactly what I checked, what I changed, and what you should probably look at in your own account before the end of the day.

Start With the Security Checkup

Google's Security Checkup is the best starting point because it surfaces the issues Google itself thinks you should address. Go to myaccount.google.com, click Security, and look for the Security Checkup card. It takes about three minutes and covers the most critical bases.

When I ran mine, it flagged three things immediately. First, my recovery phone number was outdated — I'd changed carriers months ago and never updated it. If I'd lost access to my account, that number wouldn't have helped me get back in. Second, it found an old Android tablet I hadn't used in two years that still had full account access. Third, it noticed I hadn't turned on two-step verification for one of my less-used devices.

Security experts recommend verifying your recovery email and phone number every 90 days. In 2026, that's the benchmark for maintaining account integrity. If your recovery information is wrong, the best password in the world won't save you when you need to reset it. citeweb_search:32#1

The Checkup also reviews your saved passwords through Password Checkup, which scans for credentials that have appeared in known data breaches. I had two passwords that showed up in leaks — one for a shopping site I'd stopped using, and another for a forum I'd forgotten I joined. Both got changed on the spot.

Audit Every Device With Account Access

This was the most eye-opening part of my review. Under Security > Your Devices, Google lists every phone, tablet, laptop, and browser that has accessed your account in the last 28 days. Mine had 14 entries. I recognized about nine of them.

The others were an old work laptop I'd returned to my employer, a phone I'd sold on Facebook Marketplace without factory resetting properly, and a Chromebook I'd lent to a family member two years ago. All of them still had active access to my Gmail, Drive, Photos, and everything else tied to my Google Account.

Removing them is simple — click the device, review the details, and hit "Sign out." But most people never think to look here. If you've ever sold a phone, traded in a laptop, or used a public computer to check your email, this section deserves your attention. citeweb_search:32#4

While you're there, check the location data for each device. If you see a login from a city you've never been to, that's a red flag worth investigating immediately.

Third-Party Apps: The Hidden Backdoor

Under Security > Third-Party Access, Google lists every app and service you've granted permission to use your account. Mine had 47 connections. Forty-seven. Some were obvious — Spotify, Zoom, Notion. Others were apps I'd tried once and deleted months ago. A few I'd never heard of.

Each of these apps retains varying levels of access to your data. Some can read your emails. Some can access your Drive files. Some can see your calendar and contacts. When you granted that permission, it probably made sense. But permissions don't expire automatically. That fitness app you tried for a week in 2023 might still be able to read your Gmail.

I revoked access for 31 apps. The process takes about ten seconds per app. The only ones I kept were services I actively use and trust. Everything else got cut off. Consumer Reports has flagged this as one of the most important privacy steps Google users overlook — those connections are convenient, but they're also a privacy trade-off that accumulates over time. citeweb_search:32#5

Two-Step Verification: Upgrade From SMS

If you haven't enabled two-step verification yet, stop reading and do it now. It's the single most effective way to prevent account takeover. But here's the thing: not all 2SV methods are equally secure.

SMS-based codes — the ones texted to your phone — are better than nothing, but they're vulnerable to SIM swapping attacks. The National Cyber Security Centre recommends moving away from SMS-based MFA for business-critical systems, and that advice applies to personal accounts too. citeweb_search:32#3

I upgraded my setup to use an authenticator app for most logins and a physical security key for my most sensitive accounts. Security keys — USB devices that confirm your identity through cryptographic signatures — can't be phished, can't be intercepted, and work even if your phone is compromised. Google's Advanced Protection Program uses them by default for high-risk users like journalists and political campaigns, but they're affordable and accessible for everyone. citeweb_search:32#13

If a security key feels like overkill, at minimum switch from SMS to Google Authenticator or another authenticator app. It takes five minutes and meaningfully improves your security posture.

Location History: The Setting That Never Fully Turns Off

Google's location tracking has a complicated history. In 2018, the company was caught collecting location data even when users had explicitly disabled Location History. Internal emails revealed that even Google employees worried this was inappropriate. Since then, the company has renamed the setting to "Timeline" and changed how it works — but the underlying collection hasn't stopped entirely. citeweb_search:32#5

When I checked my Timeline, Google had stored years of my movements. Every restaurant I'd visited, every road trip I'd taken, every late-night drive to the pharmacy — all of it was there, timestamped and mapped. You can delete this data and pause future collection under Data & Privacy > History Settings > Timeline. But here's the catch: even with Timeline paused, Google can still infer your location from cell tower data, IP addresses, and app usage patterns if Web & App Activity remains enabled.

To actually minimize location tracking, you need to disable both Timeline and Web & App Activity. That second setting is Google's master privacy control — it governs whether the company saves your searches, browsing history, app usage, and yes, location signals. Turning it off means less personalized recommendations in Maps and Assistant, but it also means Google stops building that detailed behavioral profile. citeweb_search:32#5

Web & App Activity: The Master Switch

This is Google's most powerful privacy setting, and most people have never touched it. Web & App Activity controls whether Google saves your search history, Chrome browsing data, YouTube watch history, app usage, and even voice recordings from Google Assistant interactions.

When I reviewed my own data, the level of detail was unsettling. Not just what I'd searched for, but how long I spent on each result, which videos I paused and rewatched, which apps I opened at what times, and voice clips of me asking my phone for weather updates. All of it was being stored indefinitely by default.

You have three options here. You can turn Web & App Activity off entirely, which stops collection going forward. You can leave it on but set auto-delete to remove data after 3, 18, or 36 months. Or you can keep it on but exclude Chrome browsing history and voice data specifically. I chose the middle path — auto-delete after 18 months — which preserves recent activity for convenience while preventing an indefinite archive of my digital life. citeweb_search:32#5

Ad Personalization: Opting Out of the Profile

Google uses everything it knows about you to target ads. Under Data & Privacy > Ad Settings, you can see the interests Google has inferred from your activity — and there were some surprisingly accurate ones in my profile, along with a few that were completely wrong.

You can turn off personalized ads entirely, which means Google will still show you ads but won't use your profile to target them. You can also disable "Partner Ads Settings," which limits how your data is used for ads on non-Google websites. I turned off personalization and noticed no meaningful change in my browsing experience — the ads became slightly less relevant, but they didn't disappear. citeweb_search:32#5

For most people, this is a low-effort, decent-privacy-win setting. It doesn't stop data collection, but it does reduce how aggressively that data is monetized.

Comparison: Security vs. Privacy Settings — What Each Protects

Setting Category	What It Protects	Priority Level	Time to Fix
Security Checkup	Recovery info, breached passwords, device access	Critical	3 minutes
Device Audit	Prevents old/sold devices from accessing your account	Critical	5 minutes
Third-Party Apps	Removes forgotten app permissions and data access	High	10 minutes
2-Step Verification	Blocks unauthorized logins even if password is stolen	Critical	5 minutes
Location History	Stops indefinite storage of your physical movements	Medium	2 minutes
Web & App Activity	Controls collection of searches, browsing, voice data	High	2 minutes
Ad Personalization	Reduces how aggressively your data is used for ads	Low	1 minute

Pros & Cons of Tightening Your Google Account

Pros:

• Significantly reduces risk of account takeover and unauthorized access
• Removes old devices and forgotten apps that could leak data
• Limits how much of your behavior Google stores indefinitely
• Improves awareness of what data you're sharing and with whom
• Most changes take under five minutes and require no technical skill

Cons:

• Some Google features become less personalized or stop working
• Turning off Web & App Activity disables some Assistant conveniences
• You'll need to re-authenticate devices more frequently
• Security keys and authenticator apps add a small step to logins
• Location-dependent features like "find my parked car" won't work if Timeline is off

💡 Expert Tip

Schedule a quarterly 15-minute account review. The biggest mistake people make is treating security as a one-time task. I set a recurring calendar reminder for the first Sunday of every quarter. In those 15 minutes, I run the Security Checkup, review any new third-party apps, check for unfamiliar devices, and verify my recovery information is still current. It's faster than changing your oil and arguably more important. The apps and devices connected to your account change constantly — new services you try, old phones you replace, passwords you reuse on sketchy sites. A quarterly review catches these changes before they become problems.

Frequently Asked Questions

How do I access my Google Account security settings?

Go to myaccount.google.com and click the Security tab on the left sidebar. From there, you can access the Security Checkup, manage devices, review third-party apps, and configure two-step verification. The Data & Privacy tab handles location history, Web & App Activity, and ad settings. citeweb_search:32#11

Will turning off Web & App Activity break Google services?

Some features will become less personalized. Google Assistant may not remember your preferences as well, and search results won't be tailored to your history. Maps won't show your Timeline or location-based recommendations. But core functionality — Gmail, Drive, Search, YouTube — continues working normally. Most people find the privacy trade-off worth the slight reduction in convenience. citeweb_search:32#5

What's the safest form of two-step verification?

Physical security keys are the most secure option because they can't be phished, intercepted, or bypassed by malware. Authenticator apps are the next best choice. SMS-based codes are the least secure due to SIM swapping vulnerabilities, though they're still better than no 2SV at all. citeweb_search:32#13

How often should I check my connected devices?

Security professionals recommend reviewing your connected devices at least every 90 days. If you've recently sold a phone, used a public computer, or traveled, check immediately afterward. The Device Audit under Security > Your Devices shows the last 28 days of activity and lets you sign out anything suspicious with one click. citeweb_search:32#1

Can I recover data after deleting my Google activity history?

No. Once you delete activity history from Google's servers, it's gone permanently. If you want to preserve some data — like a record of places you've visited — download it first through Google Takeout under Data & Privacy > Download Your Data. This lets you keep an archive on your own storage before clearing Google's copies.

Final Thoughts

Going through my Google Account settings took about 45 minutes total. I removed 14 old devices, revoked access for 31 third-party apps, updated my recovery information, switched from SMS to an authenticator app for 2SV, set my activity data to auto-delete after 18 months, and turned off ad personalization. None of it was complicated. Most of it was just... boring administrative work that I'd been putting off.

That's the thing about digital security. It's not dramatic. There were no hackers to fight off, no urgent breach notifications, no malware to remove. Just a slow accumulation of forgotten permissions, outdated information, and default settings that served Google's interests more than mine.

The good news is that the fixes are equally undramatic. A few clicks here, a setting change there, and your account is meaningfully more secure and private than it was yesterday. You don't need to be a cybersecurity expert. You just need to spend the time looking.

If you haven't reviewed your Google Account settings in the last six months, make it this weekend's small project. Start with the Security Checkup. Audit your devices. Cut off apps you don't recognize. Update your recovery info. These aren't exciting tasks, but they're the ones that matter when something goes wrong — and by then, it's usually too late to wish you'd done them sooner.

━━━━━━━━━━━━━━━━━━
🎥 Recommended Video
https://www.youtube.com/results?search_query=Google+Account+security+settings+privacy+checkup+2026
━━━━━━━━━━━━━━━━━━