The Complete Mac Privacy Checklist

Most Mac privacy advice is either too vague to act on or so paranoid that nobody follows it. This is the middle path: a concrete checklist you can work through in an afternoon, ordered roughly from highest impact to lowest. You do not need all of it. Do the top few and you have already closed the gaps that matter most.

1. Turn on FileVault

This is the single most important setting. FileVault encrypts your entire disk, so a lost or stolen Mac is a useless brick to whoever finds it rather than an open archive of your life.

Go to System Settings, Privacy and Security, and turn on FileVault. Save the recovery key somewhere safe and offline. This protects you when the Mac is off or logged out. It does not protect you while you are logged in, which is what the later items handle.

2. Set a short auto-lock and require a password

A Mac that never locks itself is a Mac that anyone can use the moment you walk away. In System Settings, Lock Screen, set the screen to require a password immediately or after a short delay, and set the display to sleep after a few minutes of inactivity. Learn the keyboard shortcut to lock on demand, Control Command Q, and use it every time you stand up.

3. Review app permissions

Apps accumulate permissions you forgot you granted. Open System Settings, Privacy and Security, and walk through each category: Camera, Microphone, Screen Recording, Full Disk Access, Location. Revoke anything that does not obviously need the access. Pay special attention to Full Disk Access and Screen Recording, which are the most powerful and the most often over-granted.

4. Lock the apps that hold your private life

FileVault and auto-lock both assume the threat is someone using your Mac without your session. They do nothing about the everyday case: you are logged in, you step away for two minutes, and someone opens your messages or your email.

This is where app-level locking comes in. Put Touch ID in front of the handful of apps that would cause real harm if opened: email first, then messaging apps, your browser, your notes. Our guide on how to lock apps on your Mac walks through it, and tools like Cloak add this gate that macOS itself does not provide.

If you turn on intruder photos in Cloak, it also takes a picture with the built-in camera of anyone who gets the password or Touch ID wrong, so you know who tried.

5. Encrypt your most sensitive files

For documents that would be genuinely damaging in the wrong hands, tax records, identity documents, anything financial, whole-disk encryption is not enough because everything is readable once you log in. Keep these in an encrypted folder that stays sealed even while your Mac is on. See how to encrypt files on your Mac for what AES-256 protects against and how to set it up.

6. Tidy up notifications

Notifications leak. A locked app means little if its messages still flash full previews on your lock screen and in the corner of your display. In System Settings, Notifications, turn off previews for sensitive apps or set them to show only when unlocked. This stops two-factor codes and private messages from appearing where anyone can read them.

7. Check what is syncing to the cloud

Privacy on your Mac is undone if a plain copy of everything is sitting in a cloud drive with weaker protection. Review what iCloud, Dropbox, Google Drive, or OneDrive are syncing. Make sure sensitive folders are either excluded or encrypted before they leave your machine. An encrypted file stays encrypted in the cloud; a plain one does not.

8. Use a password manager and unique passwords

Reused passwords mean one breach unlocks everything. A password manager lets every account have a long, unique password you never have to remember. Apple’s built-in Passwords app is a fine start. Whatever you use, lock the manager itself, because it is the one app that genuinely is the keys to the kingdom.

9. Be deliberate about browser sign-ins

Your browser is probably signed into more accounts than any other app. Decide whether you want it to stay logged into banking and email all the time, or whether those deserve a separate, locked browser or a sign-out habit. At minimum, lock the browser if you share the Mac at all.

Do the top half first

If you only have twenty minutes, do items one through four. FileVault, auto-lock, permission cleanup, and locking your most sensitive apps cover the large majority of real-world risk for an ordinary person. The rest is worth doing, but those four are the ones that change your exposure the most.

Privacy on a Mac is not one big switch. It is a handful of small, deliberate settings that together mean a lost laptop, a borrowed laptop, or a curious bystander learns nothing they should not. If you want help with the app-locking and file-encryption pieces, Cloak handles both locally with Touch ID and a one-time purchase.