Does turning off Allow Apps to Request to Track stop apps from tracking me?

It reduces cross-app tracking through Apple's identifier, and it is worth leaving on. But it is not a wall. Apps still learn plenty from what you do inside them, from your IP address, and from any account you sign into. Treating that switch as full protection is the mistake — it is one reduction among several, not a boundary.

Is Lockdown Mode overkill for normal users?

For almost everyone, yes. It exists for people who are specifically targeted — journalists, activists, people under state-level surveillance. It hardens the device against entire classes of attack, and the cost is real: many message attachments, some web technologies, and incoming FaceTime from unknown callers stop working. Turning it on because it sounds safer trades everyday function for protection against a threat most people do not face.

What does the App Privacy Report actually do?

It is a diagnostic, not a defence. It shows which apps accessed location, camera, microphone, contacts and photos in the last seven days, and which domains they contacted. It changes nothing by itself — its value is that it lets you catch an app doing something you did not expect, and then revoke that permission. Read it once a month; do not expect it to protect you on its own.

iPhone Privacy Settings: Which Ones Actually Change Anything

Short answer: three settings genuinely change what an app can see — where you are, which photos it can reach, and (if you pay for iCloud+) whether your traffic exposes your IP. Everything else in the usual privacy checklist is mostly reassurance.

The reason is structural. iOS already sandboxes apps: one app cannot read another's data, and it cannot see your files unless you hand it access. So privacy on iPhone is not about blocking a flood of requests — it is about who you grant access to, and how much.

The three that actually matter

1. Location: give "While Using" and mean it. When an app has "Always", it can read your location in the background, all day, without you opening it. That is the single largest ongoing exposure on a phone. Go to Settings → Privacy & Security → Location Services, and walk the list. Weather and maps can justify "Always"; almost nothing else can. For the ones that only need it occasionally, set While Using and turn on Precise Location off where a rough area is enough — the app gets your city instead of your street.

2. Photos: hand over the pictures, not the library. Since iOS 14 an app can be given *selected* photos instead of your whole library. Settings → Privacy & Security → Photos shows each app that has asked — set the ones that do not need the whole library to Selected Photos. A photo editor that only ever touches the one image you pick has no reason to hold your entire library.

3. Private Relay: hides your IP from the sites you visit. With iCloud+ (Settings → your name → iCloud → Private Relay), Safari traffic goes through two relays, so no single party sees both who you are and what you are visiting. It is the one setting here that addresses the network layer rather than app permissions.

Settings that reassure more than they protect

App Privacy Report (Settings → Privacy & Security → App Privacy Report) is a diagnostic tool, not a defence. It shows what apps reached for in the last seven days. Its value is catching something unexpected and then revoking it — it protects nothing by itself.
Private Browsing hides history from *this device*. It does not hide your visit from your network, your employer, or the site itself. If the concern is being seen by the site, it does not help at all.
Clearing cookies and website data affects Safari's web browsing. Native apps do not use cookies for their own tracking, so this does nothing for them.
Third-party "privacy" apps cannot read other apps' data — iOS does not permit it. Anything claiming to audit or block other apps is describing something the platform does not allow.

Lockdown Mode: the right tool for a specific threat

Settings → Privacy & Security → Lockdown Mode hardens the device against entire classes of attack: message attachments are restricted, some web technologies are disabled, incoming FaceTime calls from unknown callers are blocked, and wired connections require unlocking.

It is built for people who are personally targeted — journalists, activists, researchers facing state-level surveillance. For everyone else the trade is bad: you lose daily functionality to defend against a threat you are unlikely to face. If you are not the specific target of a sophisticated attacker, the ordinary settings above matter far more than this one.

Four pieces of privacy advice that do not hold up

"Turn off location services entirely." You will break maps, weather, ride-hailing and Find My, and you will not have addressed a defined threat. Set per-app access instead — that is the actual control.
"Reset your advertising identifier regularly." Apple already limits what that identifier is used for; resetting it is a ritual, not a defence.
"Delete the apps that ask for too much." The better move is to deny the permission. Most apps work fine with location, camera or contacts refused — they ask for everything on the chance you say yes.
"You need an antivirus." iOS does not permit apps to scan other apps or the system. What is sold as antivirus on iPhone is either a VPN, a browser, or a subscription that does nothing a setting cannot.

What to actually do tonight

Settings → Privacy & Security → Location Services — change every "Always" you cannot justify to "While Using"
Settings → Privacy & Security → Photos — switch apps that only need a few pictures to Selected Photos
Settings → Privacy & Security → Tracking — leave Allow Apps to Request to Track off
If you have iCloud+, confirm Private Relay is on
Open App Privacy Report once a month and revoke anything surprising

That is the whole list. The rest of the internet's privacy advice is mostly about feeling careful rather than being harder to observe.