You open System Settings, click into Privacy & Security, and there it is: a list of apps that have been quietly reading your clipboard, watching your screen, or pinging your location for months. Most people close that window fast. It's easier not to know.
I get asked about this constantly, and the honest answer is that macOS ships with decent defaults and terrible assumptions. Apple protects you from other apps, but it treats Apple's own services as trustworthy by design. That gap is where the real work happens. Here's exactly which privacy settings to enable on your Mac today, in the order that matters most.
Key Takeaways
- FileVault and the firewall are the two settings that protect you from physical theft and network snooping — enable both first.
- Screen Recording and Full Disk Access permissions are the most abused by legitimate-looking apps; audit them monthly.
- You can disable Apple's analytics sharing without losing software updates or warranty coverage.
- Every app permission has an on/off switch, but the "why is this app asking" question matters more than the switch itself.
- Safari's cross-site tracking prevention is on by default, but three sub-settings need manual attention.
The macOS privacy settings you should enable today, in order
Not every setting deserves the same urgency. Some protect you in thirty seconds. Others take real thought because flipping them breaks workflows you actually rely on.
I learned this the hard way. Two years ago I disabled Full Disk Access for a backup utility because the permission name sounded alarming. Three weeks later I discovered my backups had been silently failing the entire time. The permission existed for a legitimate reason. Context beats paranoia.
FileVault: turn it on and forget it
If your Mac is a laptop, this is non-negotiable. FileVault encrypts the entire drive so that someone who steals your machine can't pull data by booting from an external device or removing the SSD.
Go to System Settings > Privacy & Security > FileVault. Click Turn On. You'll choose between an iCloud recovery option or a local recovery key. I recommend the local key — write it down and store it somewhere physical. If you lose both your password and your recovery key, that data is gone permanently. Apple cannot help you.
The firewall: fewer steps than you think
Under System Settings > Network > Firewall, toggle it on. That's it. The advanced options let you block all incoming connections, but you probably don't want that unless you're on a hostile network regularly. Leave the default app exceptions alone unless you have a specific reason.
What most people miss: the firewall does nothing for outgoing traffic. An app phoning home to a server is allowed by default. That's a limitation, not a setting you forgot.
How to change security preferences on Mac to allow unidentified developer apps
Spoiler: since Catalina, Apple removed the old "Anywhere" option from the Gatekeeper settings entirely. You cannot simply click a radio button and let every app through. That was a deliberate change, and I think it was the right call — even if it annoys me roughly once a month.
Here's what actually works in current macOS versions:
- Try to open the app. macOS blocks it with a dialog.
- Open System Settings > Privacy & Security.
- Scroll to the Security section. You'll see a message about the blocked app with an Open Anyway button.
- Click it, authenticate, then confirm on the second prompt.
The button only appears for a limited time after the blocked attempt. If you closed the dialog and walked away for an hour, you'll need to try opening the app again first.
For developers and power users, there's a terminal route using spctl to manage Gatekeeper assessments, but I'd advise against disabling Gatekeeper globally. Do that and you've traded a mild inconvenience for a permanent hole.
Screen Recording and Full Disk Access: the permissions that actually matter
Every permission category in the Privacy & Security panel has a counter showing how many apps have been granted access. Two of them deserve a monthly look.
Screen Recording
A Screen Recording permission lets an app capture everything visible on your display, including windows from other apps. Meeting software needs it. A screenshot utility needs it. Why does a PDF reader need it?
Grant this only to apps you'd trust with a video of your entire workday. When I audit clients' Macs, Screen Recording is consistently the category with the most unnecessary grants — usually accumulated through onboarding screens people click through without reading.
Full Disk Access
This permission bypasses macOS's normal file protection entirely. Backup tools, antivirus, and some development utilities legitimately need it. Almost nothing else does.
An app with Full Disk Access can read your Mail database, Messages history, Safari data, and every document in your home folder. Removing an unnecessary grant here costs you nothing except the app having to ask for specific folders when it actually needs them.
| Permission | What it exposes | Who genuinely needs it |
|---|---|---|
| Screen Recording | Everything displayed on screen | Meeting apps, screenshot tools, some accessibility software |
| Full Disk Access | Mail, Messages, Safari, all documents | Backup software, antivirus, specific dev tools |
| Accessibility | Keyboard input, control over other apps | Window managers, automation utilities, password managers |
| Input Monitoring | Keystrokes system-wide | Rarely anything. Treat every request as suspicious. |
Should I share Mac analytics with Apple?
Analytics data is anonymized diagnostic information — crash logs, usage patterns, general system configuration. Apple uses it to prioritize bug fixes and hardware issues. Turning it off has no effect on your ability to receive software updates, use iCloud, or get warranty service.
My take: turn it off. Not because Apple is doing something sinister, but because the data provides you zero benefit and the aggregate picture is good enough without your contribution. Under System Settings > Privacy & Security > Analytics & Improvements, uncheck "Share Mac Analytics" and "Share with App Developers."
While you're there, check the Apple Advertising section and turn off Personalized Ads. This reduces how much Apple's ad system can profile you across the App Store, News, and Stocks.
One caveat: if you're having a specific hardware problem and want Apple to diagnose it, temporarily enabling analytics gives their engineers more to work with. It's not a permanent decision.
How to change Safari privacy settings on Mac
Safari's defaults are better than Chrome's, but "better than Chrome" is a low bar. Open Safari, then Safari > Settings > Privacy.
- Prevent cross-site tracking — leave this on. It blocks third-party cookies from following you between sites.
- Hide IP address — enable this. It masks your IP from known trackers, which matters more on public Wi-Fi than at home.
- Website data — click Manage and clear anything you don't recognize. I do this every few weeks and always find trackers from sites I visited once.
- Fraudulent website warning — keep it enabled. It's the one form of data sharing with Apple that actively protects you.
The Advanced tab hides a few more switches worth knowing about, including a setting that blocks all cookies. Don't enable that one globally — you'll break logins across every site you use.
The settings people always miss
Beyond the headline items, four smaller switches do more than their size suggests. Each takes under a minute.
- Location Services (Privacy & Security > Location Services): Review the list. Weather apps don't need precise location, and neither does a restaurant finder once you've arrived. Set most of them to Approximate.
- Allow apps to request to track: This toggle controls whether apps can even ask for tracking permission. Leave it on so you get the prompt — that way you decide per app instead of blanket-allowing.
- Lock screen (Privacy & Security > Lock Screen): Set "Require password" to immediately. The default delay means someone can open your unlocked Mac for several seconds after you step away.
- Automatic updates (General > Software Update): Enable security responses specifically. These patch active exploits without requiring a full restart, and they ship faster than point releases.
And here's the thing most guides skip: the audit matters more than the initial setup. New apps request permissions constantly. A setting you approved six months ago for a tool you've since uninstalled is still sitting there doing nothing — or worse, still active if the app remains installed.
How often should I review these settings?
Once a month if you install new software regularly. Otherwise, whenever an app prompts you for a permission you don't understand — that prompt is your cue to open Privacy & Security and check what else has access.
Does turning off analytics sharing affect my AppleCare or warranty?
No. Warranty coverage is tied to your device serial and purchase, not to diagnostic sharing. You can decline analytics entirely and still get full service.
Will disabling app permissions break anything important?
It can. If you revoke Full Disk Access from a backup tool, the backup silently stops working. Revoke Screen Recording from a meeting app mid-call and the screen share dies. Check what an app does before you flip the switch — not after.
The uncomfortable truth is that privacy on macOS isn't a one-time setup. It's a habit of noticing. Every permission prompt is a small negotiation between convenience and exposure, and the defaults almost always favor convenience. You're the only one who can shift that balance.
Start with FileVault tonight. It's the one setting where the cost of skipping it is genuinely irreversible — everything else can wait until the weekend.
