Lock Down a Samsung Galaxy

One UI settings to cut Galaxy AI, Bixby, SmartThings Find, and carrier bloatware tracking

State of Surveillance

TL;DR

A stock Samsung Galaxy has at least four tracking layers general Android hardening guides do not cover. Galaxy AI sends some features to Samsung's cloud and some stay on-device, controlled by a "Process data only on device" toggle inside Settings. Bixby records voice commands and sends them to Samsung servers unless you turn that off in Bixby settings. SmartThings Find (Find My Mobile) reports your location to Samsung's network unless you disable it. US-carrier variants ship with carrier apps that collect device identifiers and, on older MediaTek chipsets, have been documented transmitting GPS coordinates over an open TCP port. The settings below are the documented paths from Samsung's own support pages and the Samsung privacy policy, paired with a primary research finding on the carrier-bloatware risk.

Which Tracking Layers a Galaxy Phone Actually Has

The starting point is the list itself. A modern Samsung Galaxy on One UI 6.1 or later has at least four overlapping tracking surfaces that a generic Android hardening guide will not touch:

  • Galaxy AI, the on-device-plus-cloud feature set introduced with the S24 generation, including Live Translate, Note Assist, Browsing Assist, Photo Assist, Chat Assist, Now Brief, Now Bar, and Health Assist. Some of these run on the phone's NPU; others send data to Samsung's cloud servers.
  • Bixby, Samsung's voice assistant. Bixby Voice wake-up listens continuously when it is on, and Samsung's privacy policy describes "recordings of your voice that we make and collect on our servers" when voice commands are used.[3]
  • SmartThings Find, Samsung's device-finder service (formerly Find My Mobile). When on, it lets Samsung locate, lock, or wipe your phone remotely, and uses BLE and UWB to help other Galaxy phones find yours.
  • Carrier bloatware, the apps Verizon, AT&T, T-Mobile, and other US carriers ship pre-installed on carrier-sold Galaxy phones. They have been documented to obtain persistent device identifiers without permission and, in older MediaTek chipsets, to expose GPS coordinates over an open debug port.

The next four sections walk through each layer in turn, with the menu paths that control it.

Galaxy AI: The "Process Data Only on Device" Switch

Samsung ships a master control that determines whether AI features process data on the phone or in Samsung's cloud. Samsung's own support page describes the path as "Settings > Galaxy AI" on One UI 6.1 and later (on some older models the same panel is at "Settings > Advanced features > Intelligent features").[1]

Inside that panel there is a toggle Samsung calls "Process data only on device" that, when enabled, disables cloud processing for AI features.[1] Samsung's September 2025 privacy statement frames the choice as a user-facing privacy guarantee, saying "with Advanced Intelligence settings, managing your privacy is as simple as tapping a button" and that "personal data is never stored long-term or used for AI training, whether processed on-device or on the cloud."[2]

The on-device versus cloud split is not abstract. Samsung's support page lists the features that run locally: Translation, the time and weather Ambient Wallpaper, and Google Messages Magic Compose (message suggestions and rewrite suggestions).[1] The same page lists the features that go to Samsung's cloud: Auto Format, summary generation, false-correction detection, and image-editing features.[1]

The practical interpretation is that disabling cloud processing cuts the second list while leaving the first list working. Samsung's framing of the trade-off is that cloud processing is what handles the more processing-intensive tasks like photo edits and summaries, while on-device processing handles lighter tasks like live translation and message suggestions.[1][2]

Per-feature toggles also exist. The same Galaxy AI panel contains sub-menus for individual features (Call Assist, Chat Assist, Note Assist, Photo Assist, Browsing Assist, Transcript Assist) where each can be disabled independently.[1] If you only want to keep Live Translate local but stop the cloud-assisted photo edits, this is where you do that.

The full supported-device list, per Samsung's support page: Galaxy S26 FE, S26 Ultra, S26+, S26, S25 Ultra, S25 Edge, S25+, S25, S25 FE, S24 Ultra, S24+, S24, S24 FE, Tab S12+, Tab S12 Ultra, Tab A11+, Tab S11 Ultra, Tab11, Tab S10+, Tab S10 Ultra, Tab S10 Lite, Z Fold8 Ultra, Z Fold8, Z TriFold, Z Fold7, Z Fold6, Z Flip8, Z Flip7, Z Flip7 FE, Z Flip6, A57 5G, A56 5G, A37 5G, A36 5G, A27 5G, A26 5G, A17 5G.[1]

Bixby: Voice Uploads and the Wake Word

Bixby is the voice-assistant layer that runs even if you never touch Galaxy AI. Samsung's account Privacy Policy (effective July 20, 2026) describes what Bixby collects when voice commands are used: "recordings of your voice that we make and collect on our servers when you enable this function and use voice commands."[3] The same section adds that "if we work with a third party service provider that provides speech-to-text conversion services or call center services on our behalf, this provider may also receive and store certain voice commands."[3]

The voice-wake biometric is handled differently. Samsung's privacy policy states that "your voiceprint data to create a customized Bixby Voice wake-up command" is biometric data that "remains on your device and is not transferred to or accessed or obtained by Samsung."[3] That is one piece of Bixby data that does not leave the phone, but it is the only one.

Three settings paths to know:

  1. Turn off Voice wake-up entirely. Samsung documents Voice wake-up as a separate toggle from Bixby itself in its Voice wake-up support page; that page walks through disabling the wake word on devices that support it.
  2. Disable the Bixby key. On phones that have a dedicated Bixby hardware key (older S and Note models), remap it to do nothing or to open another app.
  3. Clear predictive-text data. Samsung's privacy policy points to "Predictive text" settings as the path to clear "the data" Bixby keeps for typed personalization.[3]

You can also turn Bixby itself off. The path is Settings > Apps > Bixby > Disable, or for many models Settings > Advanced features > Bixby key, where the same panel gives a Disable option. That ends any Bixby data flow. The cost is that voice activation, Bixby routines, and any Bixby-dependent features (some camera modes, Bixby Vision in Gallery) stop working.

SmartThings Find: The Network That Reports Where You Are

SmartThings Find (called Find My Mobile in older One UI versions) is Samsung's device-locator, lock, and remote-wipe service. When it is on, your Galaxy phone is locatable through Samsung's servers and can be locked or wiped remotely through your Samsung account. The network itself uses BLE (Bluetooth Low Energy) and UWB (Ultra-Wideband) to help locate phones that go offline, by having nearby Galaxy devices relay a beacon.

The settings path to turn it off is Settings > Biometrics and Security > Find My Mobile, then toggle the switch at the top.[4] You will be asked to verify with your Samsung account password or biometrics before the toggle actually flips, which is Samsung's anti-tamper control so that a thief cannot turn off Find My Mobile on a stolen phone.

The same panel contains additional toggles that affect what SmartThings Find does, including the option to allow your phone to be used as a "Find My Mobile" scanner for other people's lost devices. If you do not want your phone participating in that mesh, turn that off in the same panel.

What you give up: remote lock, remote wipe, remote ring, and the offline-locator mesh. For many readers that trade is acceptable. For readers worried about theft or loss, the trade is harder, and the choice should be deliberate.

Enhanced Data Protection: Encrypt Your Samsung Cloud Backups

A separate Samsung control, often missed in general hardening guides, is Enhanced Data Protection for Samsung Cloud. Samsung's own support page describes it as "end-to-end encryption when backing up and restoring data with Samsung Cloud."[5]

The menu path: Settings > Security and privacy > More security settings > Enhanced data protection.[5] Inside that screen, two toggles: "Encrypt backup data" and "Encrypt synced data." Both should be on.

What gets encrypted per Samsung's documentation: "Call log backups, Messages backups, Clock backups, Settings backups, Apps backups."[5] The same page notes "some large files, including attachments in messages, may not be encrypted."[5]

When you enable Enhanced Data Protection, Samsung generates a 28-character recovery code that "cannot be viewed again after being generated, and Samsung does not store recovery codes."[5] The recovery code must be "recorded and stored in a secure space."[5] Samsung's warning is direct: "If both the device that provides the Enhanced data protection feature and the recovery code are lost, there is no way to access the encrypted data."[5]

Enhanced Data Protection is "available on devices running One UI 5.1.1 or later" and "may not be available on some carrier devices, or in some regions."[5] If the menu is missing on a carrier variant, that is why.

What Knox Already Does For You

Samsung's hardware-backed Knox security platform runs below the application layer, which is why most of the toggles in this guide sit above it. Knox's data-at-rest protection uses two separate encryption layers, what Samsung calls DualDAR (Dual Data-at-Rest Encryption). Samsung's own documentation describes the architecture as "Layer 1: hardware-based AES-256 encryption (standard Android FBE)" plus "Layer 2: a customizable encryption layer using either the preinstalled Linux crypto module or a third-party crypto vendor's module."[6] Each layer "uses different crypto modules, keys, passwords, and source code," and "when the phone locks, the decryption key is evicted, blocking access to CE (Credential Encrypted) storage, even background apps can't read it."[6]

DualDAR is a managed-enterprise feature, not a consumer toggle, and it only protects container data inside an Android Work Profile.[6] What it means for a consumer is that the underlying file-level encryption already on a stock Galaxy phone is hardware-backed, and that the encryption keys are evicted on lock. That is the layer that protects your photos, messages, and app data if the phone is locked and a forensic tool tries to read the storage directly. The settings above cut what leaves the phone over the network; Knox cuts what an attacker with physical possession can pull off the storage.

US-Carrier Bloatware: The Hardest Layer to Defeat

US-carrier-sold Galaxy phones ship with carrier apps pre-installed. The apps are signed with elevated system signatures, and on older devices they were able to obtain persistent device identifiers and to communicate with each other without permission checks. A primary research investigation of prepaid carrier Android devices found that "in eighteen out of the twenty-one tested devices, the pre-installed software obtains a non-resettable device identifier that a malicious third-party app can grab without any permissions," and that "in 17 of the examined devices, powered by a MediaTek chipset, a pre-installed binary opens a TCP port 7000 and transmits the GPS coordinates to any clients connected to the debug port."[7]

That investigation covered Tracfone, AT&T, Verizon, T-Mobile, Boost Mobile, and Visible, with specific models including the Samsung Galaxy A13 5G and Galaxy A03S.[7] The MediaTek GPS-leak issue is documented for that chipset family on those models, which is the older end of Samsung's range; current Galaxy S and Z series flagships ship on Qualcomm Snapdragon and are not in scope for that specific finding. The persistent-identifier finding is broader: any pre-installed carrier app signed with system privileges can grab it.

What you can do on a current device:

  1. Disable, do not uninstall. Long-press the carrier app, tap App Info, then Disable. Android keeps the app's data but stops it running. Uninstall is blocked for many system apps on a non-rooted device.
  2. Revoke permissions. For carrier apps that cannot be disabled, open App Info > Permissions and turn off anything that looks excessive: Location, Microphone, Contacts, Phone. The app will still show up in Settings but cannot call those APIs.
  3. Buy unlocked. A Galaxy phone bought from Samsung.com or another non-carrier channel ships with no carrier bloatware. If you are buying a new phone, this is the simplest fix.

What you cannot do without root or a custom ROM is remove the system-signed carrier app entirely. The phone's bootloader is locked, the app's signature grants it system privileges, and the standard Android uninstall flow is blocked.

Samsung Account: Marketing and Customization Service

The last layer is the Samsung account itself. The account has a privacy panel in Settings, reachable from the Samsung account name at the top of the Settings list, with a Personalization section that controls Customization Service and Marketing information.

Two toggles in the Personalization panel matter most:

  • Customization Service: enables Samsung's use of your account data for "personalized ads and recommendations" in Samsung's own apps.
  • Marketing information: enables push notifications, emails, and SMS about offers from Samsung.

Turn both off. Each Samsung service also has its own consent toggles (Samsung Health, Samsung Pay, Samsung Members, Samsung Free) that appear in the same panel. Walk through each and turn off anything you do not actively use.

The Minimal Lockdown Recipe

For readers who want the smallest set of taps with the largest privacy payoff, in order:

  1. Settings > Galaxy AI > Process data only on device: on. Live Translate and the Ambient Wallpaper still work; cloud-dependent photo edits and summaries do not.[1][2]
  2. Settings > Biometrics and Security > Find My Mobile: off. Verify with Samsung account password. You lose remote lock and wipe.[4]
  3. Settings > Security and privacy > More security settings > Enhanced data protection: on. Encrypt backup data and Encrypt synced data both on. Write the 28-character recovery code to paper.[5]
  4. Settings > Advanced features > Bixby key: Disable. And separately, in the Bixby Voice wake-up settings, turn the wake word off.[3]
  5. Settings > [Samsung account] > Personalization: turn off Customization Service and Marketing information.
  6. Disable each carrier app, or revoke its Location, Microphone, Contacts, and Phone permissions.

That list takes about ten minutes on a stock Galaxy and removes the bulk of the Samsung-specific tracking surface general Android guides never mention. The general Android hardening (advertising ID, in-app browsers, app SDKs) still applies on top. That guide lives elsewhere on this site.

The Bottom Line

Galaxy phones have at least four Samsung-specific tracking surfaces general Android hardening guides miss. The "Process data only on device" toggle in Galaxy AI settings cuts the cloud half of the AI feature set. SmartThings Find and Find My Mobile both report your location through Samsung's servers and both can be disabled, with the trade-off of giving up remote lock and wipe. Bixby's voice recordings go to Samsung's servers per Samsung's own privacy policy, and the wake word, the Bixby key, and the predictive-text store are three different toggles. US-carrier variants ship with apps that have been documented to read persistent identifiers and, on older MediaTek chipsets, to expose GPS coordinates over a debug port. None of those require rooting or a custom ROM to fix, and most take a single tap to disable.

Related Coverage

Sources

  1. Samsung Support: Use features with Galaxy AI on your Galaxy phone and tablet
  2. Samsung Mobile Press: Your Privacy, Secured: How Galaxy AI Empowers You to Take Control of Your Data (September 9, 2025)
  3. Samsung Privacy Policy (effective July 20, 2026), Voice Information section
  4. Samsung Support: How to locate your lost Samsung Galaxy phone or tablet
  5. Samsung Support: What is Enhanced data protection on Galaxy phones?
  6. Samsung Insights: Knox DualDAR: Solving the encryption 'gap'
  7. CyberInsider: Prepaid U.S. Carrier Android Phones Sold with Risky Bloatware