There is no untrackable phone. There is a set of trade-offs.
The right phone depends on who is looking for you and what it would cost you to be found. Every choice trades among four things that pull against each other: privacy, anonymity, security, and whether you will actually live with the result. The options at the far end of the anonymity scale exist. They also demand a discipline that very few people can sustain, and this guide is honest about that.
Your phone is a tracking device that also makes calls.
This is not a flaw. It is how the network works. To ring when someone calls you, your phone has to tell the nearest tower where it is, continuously, with two permanent identifiers: one for the handset and one for the subscriber. Everything else, the apps, the advertising identifiers, the Wi-Fi and Bluetooth chatter, the accounts you sign into, is layered on top of a device that announces its presence by design.
So the question is never "How do I get an untrackable phone?" There is no such object. The useful questions are: tracked by whom, linked to what, at what cost to you if the link is made, and what are you willing to give up to break it. Most people asking about private phones are not being hunted by a government. They are being profiled by advertisers, located by data brokers, and exposed to whoever buys the result. That problem has a good, livable answer. The other problem, the one where a well-resourced adversary is specifically looking for you, has an answer too. It is just much more expensive than a phone.
What this guide replaces
Our earlier material on this subject ran to three separate documents and a twenty-row comparison matrix. It gave too many details and not enough overview: carrier names, DNS providers, menu paths, a ten-item list of ways people get caught. Most of it was accurate. Almost none of it helped a client decide. This edition keeps the decision and drops the procedure. The procedure still exists. Clients who need it get it, with an analyst, because that is the only way it works.
Privacy protects your data from being harvested. Anonymity protects your identity from being linked to the device. A private phone is not necessarily an anonymous one, and the reverse is also true.
Four axes, not one.
Most phone advice ranks devices on a single line from "tracked" to "private." That line does not exist. Two examples from our own matrix make the point.
A Pixel running GrapheneOS is the best privacy and security device most people can buy: no telemetry to Google, a hardened operating system, sandboxed everything. Buy it with your credit card, activate it on your home Wi-Fi, and use it for your normal life, and its anonymity is roughly zero. It is an excellent private phone that is entirely yours.
A cheap prepaid handset bought for cash in a town you never visit has high anonymity potential on the day you buy it. It also runs stock software that reports to its manufacturer, its carrier, and every app on it, cannot be meaningfully hardened, and loses its anonymity the first time you carry it home. It is an anonymous phone that leaks like a sieve, until it is neither.
| Axis | What raises it | What it costs you |
|---|---|---|
| Privacy | A hardened operating system, minimal apps, permissions cut to the bone, radios off when not needed, no cloud sync. | Convenience. Some apps will not run. Some features vanish. |
| Anonymity | No purchase record, no account, no activation near your life, no contact with people who know you, no pattern, no co-location with your real phone. | Nearly everything you use a phone for. This axis is bought with behavior, not hardware. |
| Security | Current software, verified boot, a strong passcode, a vendor that patches fast, features like Lockdown Mode. | Usually the cheapest axis. Its enemy is old hardware that no longer gets updates. |
| Usability | Mainstream hardware, mainstream software, your accounts, your contacts, your maps. | The other three axes. |
Who is looking decides which phone.
Before choosing a device, name the adversary. The capabilities below are cumulative: each row can do everything above it. The phone that defeats the top row does nothing against the bottom one, and the phone that is built for the bottom row is a poor fit for a life lived in the top three.
| Who is looking | What they can reach | What answers it |
|---|---|---|
| Advertisers and data brokers | Advertising identifiers, app location data, Wi-Fi and Bluetooth proximity, whatever apps report. Bought and sold, then joined to your name through other records. | A hardened phone and disciplined permissions. This is the problem most clients actually have, and it is solvable. |
| An opportunistic or obsessive individual | People-search sites, social media, a shared account, a tracker slipped into a bag or car, a stolen or borrowed unlocked phone. | Account hygiene, a strong passcode, no biometrics if seizure is plausible, a tracker sweep, and the exposure reduction that keeps your number and address out of circulation. |
| A professional investigator or hostile researcher | Everything above, plus commercial location data, carrier lookup services, breach data, pattern analysis across your accounts and your family's. | Compartmentation: a separate device for the sensitive activity, set up and used apart from your life, plus monitoring for the moment your number surfaces somewhere it should not. |
| Law enforcement with legal process | Carrier records, tower dumps, subscriber and device histories, account records from platforms, and forensic extraction of any phone they can hold. | Nothing on this page. Lawful process reaches carrier and platform records regardless of your handset. The answer is counsel. |
| A nation-state or its proxies | Everything above, without needing your consent or a warrant, plus zero-click exploits against the phone itself. | Lockdown Mode or GrapheneOS reduces the exploit surface. Only the full anonymity discipline in section 06 addresses attribution, and it is a way of life, not a purchase. |
How a phone gets traced to its owner.
We include this section not because someone is watching you, but because the myth of the anonymous burner is the single most expensive misunderstanding in this field. People buy a phone for cash, feel invisible, and then use it in the one way that identifies them. Understanding how attribution actually works tells you what "anonymous" would really require, and lets you decide whether you need it at all.
If a phone is ever used in connection with a crime, or if someone with enough resources and a legitimate reason needs to know who was behind it, there are generally ways to find out. When law enforcement or a state is involved, there almost always are. The seven links below are how.
Retailers log serial numbers and device identifiers at the register. Cameras cover the counter and the parking lot. A card payment names you outright; cash narrows it to the footage and whatever else you carried into the store, including your real phone. Kiosk and refurbisher sales log identifiers by design.
The first time the phone connects, the network records which tower it used, when, and which handset identifier is paired with which subscriber identifier. Activate it at home and the very first record places it there. Activate it over Wi-Fi and the network operator's logs do the same job.
If your real phone and the "anonymous" one travel together, they light up the same towers at the same times. Two devices that move as one are one person. This is the most common way a burner fails, and it happens the first day.
A phone that sleeps where you sleep and works where you work is you, whatever name is on the account. Carrier records over weeks make the home tower obvious. No content is required. Location history is enough.
Who you call and message, and how often, is a fingerprint. A new number that contacts your spouse, your assistant, and your lawyer is your number. Encrypted apps protect what you said, not the fact that you said it to them.
One sign-in to an existing email, app store, cloud, or social account joins the device to your identity permanently. So does restoring a backup. So does a familiar Wi-Fi network the phone remembers.
A phone in someone's hands is a different problem. Forensic tools in wide use by agencies and, increasingly, by private examiners extract far more than the screen shows, including deleted material and app data. A strong passcode with biometrics off is the only meaningful defense, and it is not absolute.
What this means for you
Full anonymity means defeating all seven links at once, every day, for as long as the phone exists. Miss one and the rest were wasted effort. That is achievable. It is also a second, deliberately impoverished life, and the phone that lives it cannot be the phone you actually use. For nearly every client, the correct response to this section is not to attempt it. It is to be realistic about which rows of the threat table you are in, and to buy the phone for those.
Four postures, instead of twenty phones.
Our old matrix scored twenty devices on six criteria. Several no longer exist, several were never buyable by a normal person, and the scores implied a precision the subject does not have. What actually matters is which of four postures you are adopting. The hardware follows from that.
Posture 01 · Most clients
Your own phone, hardened
A current iPhone or Pixel, kept updated, with a long passcode, permissions cut back, advertising and analytics off, cloud sync trimmed, and Apple's Lockdown Mode or Android's equivalent hardening enabled. Signal for anything sensitive. Your number, your accounts, your life.
Buys. Strong security, materially better privacy, full usability. Does not buy. Any anonymity. Answers the first two rows of Fig. 3.
Posture 02 · Elevated privacy
A privacy phone, still yours
A Pixel running GrapheneOS, bought through a vendor who ships it installed if you do not want to flash it yourself, or a de-Googled alternative if you accept a security step down. No Google account, no telemetry, a hardened OS. It can still carry your number and your identity.
Buys. The best privacy and security available to a private buyer. Does not buy. Anonymity, and some app compatibility. Answers rows one through three.
Posture 03 · Compartment
A second phone for one purpose
A separate device, ideally a hardened one, acquired and set up with care and used for a single sensitive purpose: a source relationship, a legal matter, a period of heightened risk. It is still traceable to you with effort. It is separated from your everyday accounts, contacts, and locations so that a compromise of one does not reach the other.
Buys. Compartmentation and a smaller blast radius. Does not buy. Anonymity against a serious adversary. Answers row three; softens row four.
Posture 04 · Extreme threat
The fully anonymous phone
A device with no purchase, activation, location, contact, or account link to you, maintained that way indefinitely. This is what the old guides described. It works when it is done perfectly and fails completely when it is not. We have the full procedure. We do not publish it, and we do not recommend anyone attempt it alone.
Buys. Anonymity, if the discipline holds. Costs. Almost all usability, and a permanent operational burden. See section 06.
| Posture | Privacy | Anonymity | Security | Usability | Ongoing effort |
|---|---|---|---|---|---|
| Own phone, hardened | Good | None | Strong | Full | An afternoon, then updates |
| Privacy phone | Best available | None to low | Best available | Good, with gaps | A weekend, then updates |
| Compartment phone | Good to best | Low to moderate | Strong | Narrow by design | Constant separation discipline |
| Fully anonymous phone | Depends on hardware | High, if perfect | Often weak | Minimal | A second life |
What full anonymity actually costs.
We are not going to walk you through it. We are going to tell you what it involves, so that the decision is made with open eyes. A phone that is anonymous against a capable adversary has to be:
- Selected for hardware that can be bought without identification and, ideally, hardened afterward. Those two requirements conflict, and the compromise is usually worse security.
- Bought for cash, away from anywhere you are known, without your real phone on you, with the same care applied to the service and to any payment cards used later.
- Set up somewhere you will not return to, on a network with no link to you, with new accounts created for it and never touched from anything else.
- Used only away from your home, your work, and your routine; never alongside your real phone; never to contact anyone who already knows you; never signed into anything you already own.
- Maintained by rotating the device and the number before patterns form, wiping and replacing rather than keeping, and treating a single mistake as the end of that phone.
- Retired deliberately, because a phone that has done sensitive work and then drifts into ordinary use retroactively links everything it ever did to you.
Read that list again as a description of a life. You cannot take the phone home. You cannot call your family on it. You cannot check your email. You cannot charge it in your car. You cannot use it in the same coffee shop twice. Journalists protecting sources and people under credible threat do live this way for the duration of a specific need, with support, and they still make mistakes. The old guides quoted a public case in which the mere possession of a "burner" was argued in court as evidence of intent. The phone that is supposed to protect you can, in the wrong context, become the thing that indicts you.
For clients whose situation warrants it, we run this as an engagement: device selection, acquisition, configuration, a written operating discipline, and a retirement plan, with an analyst on call for the mistakes. It is not a product. It is a protocol, and it is the only way we have seen it hold.
The devices that matter in 2026, and the ones that no longer do.
Our 2025 matrix listed twenty options. Most of that field has consolidated, and several entries were never realistic for a private buyer. What a client should know now:
The reference: a Pixel running GrapheneOS
Still the strongest combination of privacy and security available to an individual. Still Pixel-only. GrapheneOS announced a Motorola partnership in March 2026, but the first supported non-Pixel devices are aimed at Motorola's 2027 lineup; nothing else is supported today. Vendors exist who sell Pixels with GrapheneOS pre-installed, which trades a little anonymity for a lot of convenience. Note that Google stopped publishing Pixel device source code in 2025, which made every alternative operating system harder to maintain and thinned the field.
The mainstream alternative: an iPhone in Lockdown Mode
Apple's security is excellent and Lockdown Mode meaningfully raises the cost of the exploits used against high-value targets. Anonymity is the weak axis: an iPhone wants an Apple ID, and U.S. models have been eSIM-only since 2022, which complicates the cash-and-SIM approach that old guides assumed. For a client who lives in Apple's world and is not trying to be anonymous, this is the right answer.
The de-Googled middle
Vendors selling pre-configured de-Googled Android phones offer real privacy gains over stock with less setup than GrapheneOS, at some cost in security rigor and with the anonymity hit of an online purchase. CalyxOS, which our old guide recommended for budget buyers, paused all development and security updates in August 2025 after its leadership left, advised users to uninstall, and returned only in July 2026. Anyone who followed the old advice spent a year on an unpatched phone. That is the risk of recommending small projects.
Feature phones
A minimalist phone with no app store leaks far less than a smartphone and is easy to buy. It is still a carrier-tracked radio with the same permanent identifiers, and its security is usually poor. Good for reducing the app problem; irrelevant to the network problem.
Dropped from the list
Enterprise and government secure handsets that are procured, not bought at retail. Boutique "ultra-secure" phones that were discontinued or never shipped in quantity. Linux phones that remain hobbyist hardware. Modified iPhones from third parties whose modifications cannot be audited. None of these are wrong to own. None of them belongs in a guide for clients making a decision.
Nine things people believe about private phones.
Several of these appeared, in some form, in our own earlier guides. Each sounds reasonable. Each produces false confidence at the moment you rely on it.
"A burner phone is anonymous."
A burner is a phone with no name on the account. Its owner is identified by the purchase, the activation, the towers it shares with your real phone, the places it sleeps, the people it calls, and the accounts it touches. Most burners are attributed within days of ordinary use.
"Cash makes the purchase untraceable."
Cash removes one record. The register still logs the device identifier, the store still has cameras, and the phone in your pocket still logged you into the cell nearest the store at the time of sale.
"The most secure phone is the most private phone."
Different axes. Security is resistance to intrusion. Privacy is what leaks by design. An iPhone in Lockdown Mode is extremely secure and reports to Apple. A cash feature phone is hard to link to you and trivial to break into.
"A VPN hides my phone."
A VPN hides your traffic from the network you are on. It does nothing about the cellular identifiers, the tower records, the apps reporting through it, or the account you paid for it with. It is a useful layer and a poor foundation.
"Signal makes the phone private."
Signal protects content. It does not hide that a device exists, where it is, or who it is talking to at the carrier level. Encrypted content on an attributed phone is still an attributed phone.
"Older phones track less."
Older phones patch less. Our earlier guide said to buy a model a few years old. An unsupported handset is the easiest thing on this page to compromise, and its radios report exactly what a new one does. Buy current hardware and remove the tracking in software.
"Airplane mode, or powering off, makes it invisible."
Powering down does stop ordinary cellular reporting. Some devices keep limited find-my features alive, and the records right before shutdown and right after restart still place you. Airplane mode is a software promise; verify the radios in settings.
"A Faraday bag solves it."
A working, closed, correctly rated Faraday bag blocks radio while the phone is inside it. It does nothing about the records made before it went in and after it comes out, and an untested bag is a hope, not a control.
"A factory reset removes everything."
A reset clears the handset. The carrier's records, the platform's records, the store's records, and the device identifiers themselves are untouched. The phone forgets. The network does not.
Three threat levels, three answers.
Most clients
- Keep your current iPhone or Pixel. Update it.
- Long passcode. Biometrics off if seizure is plausible.
- Lockdown Mode or equivalent hardening on.
- Cut permissions. Kill advertising and analytics. Trim cloud sync.
- Signal for anything sensitive.
- Get your number and address out of the broker ecosystem, because that is where the real exposure lives.
Elevated threat
- Move to a Pixel running GrapheneOS, or an iPhone in Lockdown Mode if you must stay in Apple's world.
- Consider a compartment phone for the sensitive matter, kept apart from your accounts, contacts, and routine.
- Sweep vehicles and bags for trackers.
- Monitor for your number appearing where it should not.
- Brief the people around you. Family and staff are how compartments leak.
- Talk to us before buying anything.
Extreme threat
- Do not build the anonymous phone from a guide. Including this one.
- Accept that it is a protocol with a lifespan, not a device.
- Expect to give up home use, family contact, and every existing account on that device.
- Plan its retirement before its purchase.
- Pair it with counsel if legal exposure is part of the picture.
- Run it as an engagement, with an analyst on call.
The standard
Buy the phone for the adversary you actually have. Harden it as far as your life allows. Treat anonymity as a discipline you adopt for a specific purpose and a specific period, not a feature you purchase. And remember that most of what identifies you is not in the phone at all. It is in the records that surround it.
What this guide stands on.
Reviewed against current first-party and independent material in September 2026. Devices, operating systems, and vendor policies in this space change on a timescale of months, and small projects can pause without warning. Confirm the status of any product before relying on it. Nothing here is legal advice, and nothing here is intended to defeat lawful process.
Civil society and independent research
- Electronic Frontier Foundation, Surveillance Self-Defense: "The Problem with Mobile Phones" and the guidance on attending protests. The clearest public account of why a phone announces itself by design.
- Citizen Lab, University of Toronto. The research record on mercenary spyware and zero-click exploitation of phones, and the reason Lockdown Mode exists.
- Amnesty International Security Lab, Mobile Verification Toolkit. Open-source forensic checks for compromise indicators.
- Upturn, Mass Extraction (2020). The scale and reach of mobile device forensic tools in U.S. law enforcement.
- Freedom of the Press Foundation, digital security guides. Compartmentation practice for people who protect sources.
Law
- Carpenter v. United States (2018). Warrant generally required for historical cell-site location records; the ruling's own limits.
- Riley v. California (2014). Warrant generally required to search a seized phone.
- National Lawyers Guild reporting on the 2024 Fulton County proceedings in which possession of a "burner" phone was argued as evidence of intent.
Vendor and project statements
- Apple, Lockdown Mode documentation and the Personal Safety User Guide.
- GrapheneOS Foundation. Supported-device list; March 2026 Motorola partnership announcement, with support targeted at 2027 devices.
- Calyx Institute. August 2025 hiatus letter and July 2026 return to active releases.
- Google. 2025 changes to Android open-source publication affecting Pixel device trees.
ObscureIQ material
- Anonymous Phone Comparison matrix (2025) and the three 2025 phone guides. Superseded by this edition; the detailed acquisition and configuration procedure is available to engaged clients.
- Field Guide 01, Privacy in Public. Device posture for a single high-visibility event, which is a different problem from this one.
This edition consolidates and replaces the 2025 guides "Ultimate Guide to an Untrackable Phone," "How to Set Up a Phone That Can't Be Tracked," and "How to Buy a Used Phone for Privacy," along with the twenty-device comparison matrix. Carrier, retailer, and service recommendations were removed; they date fast and they belong in an engagement, not a public page.
Where this guide opens into the work.
Field Guide 01
Privacy in Public
Visible is not the same as identified. What to do with the phone for one event, rather than for a life.
Program
Tactical Privacy Training
Six modules, three formats. Device posture is one of them, taught rather than told.
Program
Obscurity
Most of what identifies you is not in the phone. Exposure Discovery finds it; Exposure Reduction removes it.
Program
ThreatWatch
When a number, a device, or a name surfaces where it should not, you hear what it means while you still have options.
Tell us who is looking. We will tell you which phone.
Most clients need a hardened version of the phone they already own and a serious reduction of the records around it. A few need a compartment. Very few need the full protocol, and for those we run it as an engagement rather than hand over a checklist. A confidential call establishes which of those you are.