Smartphone Data Privacy Checklist: Before You Unlock, Sell, or Repair

By Consumer Rights Council

Giving a third-party technician physical access to an unlocked phone, or packaging a device to ship to a trade-in facility, is one of the highest-risk data privacy vulnerabilities a consumer can face. Devices contain active session cookies for financial accounts, private photographic metadata, stored two-factor authentication tokens, and autofill credentials. If a malicious actor handles the device for even five minutes, they can clone local files, extract browser histories, or install silent background tracking profiles.
Treat device handoffs like a formal data sanitization process by completing this exact physical and digital security protocol:
  1. Perform an Encrypted Local Backup: Do not rely strictly on automated cloud syncs. Plug your device into a computer. For iPhones, use a local backup with a custom password (which forces the backup to encrypt saved keychain passwords). For Android, run a full local backup via an external storage drive.
  2. Sever the Master Token Connections: Manually sign out of your global structural accounts. On iOS, go to settings and sign completely out of iCloud/Apple ID. On Android, go to Accounts and remove all Google and Samsung/manufacturer accounts. This action breaks the cryptographic token tie to the hardware.
  3. Trigger a Structural Factory Data Reset (FDR): Navigate to your system reset menu. Choose "Erase All Content and Settings." This does not just delete files; it permanently destroys the file system's storage encryption keys, turning your leftover data into unreadable, unrecoverable digital noise.