Chrome on Android isn't marketed as a private browser, but the Privacy and Security menu gives you real switches for tracking, HTTPS, and saved data. Tightening them takes a few minutes and stops a surprising amount of background leakage.
You'll move through Safe Browsing, HTTPS-First, Do Not Track, preloading, payment autofill, and data clearing. Some settings are worth leaving alone, and we flag those as you go.
In this guide, I have covered:
Contents
Enhance the Privacy Settings in Chrome browser on Android
Chrome on Android gives you a dedicated Privacy and Security section, but the layout around it changed in late 2025 with the Material 3 Expressive refresh. The new layout groups items under clear headers: You and Google, Basics, Passwords and Autofill, Advanced, and Privacy and Security.
A few controls also moved with the redesign. Payment autofill now lives under Passwords and Autofill → Payment methods instead of Privacy and Security. HTTPS-First Mode, shown as Always use secure connections in the menu, is on by default for incognito tabs and public Wi-Fi starting with Chrome 150.
You should still walk through the menu yourself, because Do Not Track and Preload Pages stay in Privacy and Security. The new grouping makes a few useful switches easier to miss, especially if you last opened these menus on an older Chrome build. If you run Chrome on iPhone or iPad as well, the menus are different enough that a separate run-through helps. See Enhance Privacy Settings in Chrome on iPhone & iPad.
Open Chrome Android Privacy and Security settings
This is the starting point for every change below. If you only do one thing, do this and then pick the sections that matter to you.
- Launch the Chrome app on your Android phone.
- Tap the More
menu in the top-right corner and choose Settings. - Scroll to the Privacy and Security section. On the 2025 redesign, it sits below Basics and Passwords and Autofill.
- Tap Privacy and Security to open the full list of options.
You should now see entries like Clear browsing data, Safe Browsing, Always use secure connections, Preload Pages, and Send a ‘Do Not Track’ request. The order varies slightly by Chrome version.
Pick a Safe Browsing level
Safe Browsing is the menu that decides how aggressively Chrome warns you about phishing, malware, and dangerous downloads. There are three levels, and the right pick depends on how much warning overhead you can tolerate.
- From Privacy and Security, tap Safe Browsing.
- Read the three options: Enhanced Protection, Standard Protection, and No Protection.
- Pick Enhanced Protection if you want real-time URL checks, deeper scanning of downloads, and warnings about password breaches. It sends browsing data to Google, so skip it if that is a deal-breaker.
- Pick Standard Protection for a middle option that checks sites against a periodically updated list kept on your device.
- Avoid No Protection unless you have another safety layer in place.
Success check: the radio button next to your chosen level is filled, and Chrome shows the corresponding summary under it.
Turn on Always use secure connections
Any site you visit can still answer over plain HTTP unless Chrome forces HTTPS. Always use secure connections (Chrome’s HTTPS-First Mode) upgrades http:// URLs to https:// before connecting and warns you when a site only supports plain HTTP.
- In Privacy and Security, find Always use secure connections.
- Toggle the switch to On.
On Chrome 150 and newer, this toggle is on by default for public sites only. Google has confirmed that Chrome 154 (planned for late 2026) will switch it on for every site. Turning it on manually today lines up with where Chrome is heading and protects you on networks that still happily downgrade to HTTP.
Decide what to do with ‘Send a Do Not Track request’
If you turned on Do Not Track hoping sites would respect it, the news is not great. The Send a ‘Do Not Track’ request toggle still ships in Privacy and Security, and you can flip it on, but Google has publicly said DNT is ineffective, and most sites ignore it.
- In Privacy and Security, tap Send a 'Do Not Track' request.
- Toggle it On if you want to send the signal anyway.
- Toggle it Off if you would rather not announce a preference that nobody honors.
Chrome on Android now also sends the newer Global Privacy Control (GPC) signal alongside DNT when Privacy Sandbox features are enabled. GPC has legal force in California and a few other jurisdictions, so it carries more weight than DNT alone.
Stop sites from preloading pages in the background
Preload Pages tells Chrome to speculatively load pages it thinks you will visit next, so they open instantly. That is fast, but it also means Chrome fetches pages you never opened and burns mobile data behind the scenes.
- In Privacy and Security, tap Preload Pages.
- Pick No preloading to stop the background fetches entirely.
- Choose Preload pages on supported networks only if you only want it on Wi-Fi.
Success check: the No preloading option has the radio dot next to it. Your home and back pages will feel a touch slower, but you stop telling Chrome what you might click next.
Stop Chrome from saving and filling payment methods
This setting used to live under Privacy and Security as Access Payment methods. After the 2025 layout change, it moved to Passwords and Autofill and now controls Save and fill payment methods instead of a generic access toggle.
If you want Chrome to stop suggesting cards at checkout and stop syncing new cards to your Google account, turn the master switch off.
- Open Chrome and tap More , then Settings.
- Tap Passwords and Autofill, then Payment methods.
- Toggle Save and fill payment methods on or off.
- (Optional) Toggle Verify it's you to autofill payment methods to require your screen lock before Chrome fills a saved card.
Success check: open a checkout page you have used before. Chrome no longer offers to fill the card number, and any cards already stored can only be revealed through the Verify it’s you to autofill payment methods step if you left it on.
Clear cookies and cached data
Even with strong defaults, leftover cookies and cache can still pin you to old sessions and trackers. A periodic wipe keeps that in line.
- Open the Chrome app on your Android phone.
- Tap on the More for options and select the Settings menu.
- Open the Privacy and Security settings and select the Clear Browsing Data option.
- Select the Time range from the drop-down and enable the checkboxes for the 'Cookies and site data' and 'Cached images and files' options.
- Hit on the button.
Success check: revisit the site you just cleared and confirm you have to sign in again. If you want a recurring cleanup, you can also run Clear browsing data from the same Privacy and Security menu on demand.
Silence notification spam and review site permissions
Notification prompts are the single most common privacy leak in Chrome on Android. Sites that get a yes once can pester you forever, and the Safety Check tool in Settings will quietly revoke permissions on sites you have not touched in months.
The fastest fix is to turn off the global prompt so Chrome stops asking, then use the Allowed and Blocked lists to fine-tune the sites you have already approved. For a step-by-step walkthrough, see How to Configure Notification Settings in Chrome on Android. That gets you most of the way back to a quiet phone.
- Open Chrome on your phone.
- Tap the menu in the top right and choose Settings.
- Scroll to Advanced and tap Site settings.
- Tap Notifications.
- Toggle off Sites can ask to send notifications to block every new request going forward. Then use the Allowed sites and Blocked sites lists below to fine-tune what you have already decided.
You’ll know it worked when Chrome stops showing notification prompts from sites you haven’t approved. For deeper permission control (camera, microphone, location, sensors, USB), open Site settings from the main Settings page. The article View Site Settings and Site Information in Chrome on Android walks through that screen.
Quick wins you can finish in two minutes
If the full walkthrough feels like a lot, these three switches do most of the heavy lifting on their own:
- Set Safe Browsing to Enhanced Protection.
- Turn on Always use secure connections.
- Set Preload Pages to No preloading.
That trio stops most phishing, forces HTTPS where possible, and turns off background fetches. Everything else in this guide is the cherry on top.
Bottom Line
Chrome on Android gives you enough levers to be meaningfully safer, as long as you know which ones matter. The 2025 redesign put a lot of useful controls in plain sight: Safe Browsing, HTTPS-First Mode, Preload Pages, and a clear path to clear browsing data all sit under Privacy and Security. Payment methods shifted to Passwords and Autofill, so check there if you want Chrome to stop offering cards at checkout.
For a deeper pass, head to Site settings to review camera, microphone, and location access on a per-site basis. Run Safety Check from the main Settings page to let Chrome revoke permissions on sites you have not visited in a while.
If a specific site is being annoying, the block website URL guide for Android walks through site-level blocking. The same ideas apply on a Chrome computer, although the menu labels differ, and we cover iOS in the Chrome iPhone and iPad privacy settings guide.
Frequently Asked Questions
Where did the ‘Access Payment methods’ checkbox go in Chrome Android?
It moved. The current setting is Save and fill payment methods, and it now lives under Settings → Passwords and Autofill → Payment methods. You can also turn on Verify it’s you to autofill payment methods if you want your device PIN, pattern, or fingerprint required before Chrome fills a saved card.
Does turning on ‘Send a Do Not Track request’ actually do anything?
It sends the signal to every site you visit, but most sites ignore it. Chrome now also sends the newer Global Privacy Control (GPC) header when Privacy Sandbox is active, which has legal force in California and a few other regions. Treat DNT as a courtesy signal and treat a content blocker or a private browser as the real defense.
Why is Chrome forcing HTTPS on more sites now?
Google has been rolling HTTPS-First Mode out in stages. On Chrome 150 for Android it is on by default for public sites only (incognito tabs and public Wi-Fi), and Google has confirmed Chrome 154 will switch it on for every site. Turning the toggle on manually today lines up with where Chrome is heading and protects you on networks that still happily downgrade to HTTP.
Should I choose Enhanced or Standard Safe Browsing?
Pick Enhanced Protection if you want real-time phishing and malware checks and are okay with Chrome sending URLs and small page contents to Google for analysis. Pick Standard Protection if you would rather keep that data local and accept slightly slower detection of brand-new threats. Avoid No Protection unless you have another safety net running.
How often should I clear cookies and cache on Chrome Android?
There is no single right answer. Clearing once a month is a reasonable default for most users, more often if you share the phone, and right after you sign out of a shared account. The Clear browsing data entry inside Privacy and Security lets you pick a time range and choose exactly which categories to wipe.
