DEV Community

Cover image for Google Is Linking Your Phone Number to Every Android Account. How to Turn It Off
Alan West
Alan West

Posted on Originally published at blog.authon.dev

Google Is Linking Your Phone Number to Every Android Account. How to Turn It Off

#android #privacy #security #google

If your work account, your personal account and that throwaway account you made for testing OAuth flows are all signed in on the same Android phone, Google may have already attached your SIM's phone number to all three. You didn't type it in, and nothing asked you to confirm it. The most you'll get is an email after it has happened.

The feature is Android's automatic phone number verification, and it ships enabled. Below is where to switch it off. That toggle won't remove a number that's already attached, though, so if you keep identities apart on purpose you'll also have some manual cleanup to do.

What Google's own docs say now

Google doesn't hide it. The Android Help page Manage phone number verification on your device says verification is on by default, that verified numbers are added to every Google Account signed in on the device, and that this covers future accounts and future numbers too. It also says you can only manage this in device settings. There's no switch for it in the web account dashboard.

According to Android Authority, Google changed that support page between August and October 2025 so the opt-out behaviour became the documented default. Kaspersky's write-up puts the visible rollout after a September 2025 Google system update, which runs verification during device setup and then again in the background from time to time.

It came back up in October 2026 because people started getting emails from noreply-phone-verification@google.com with the subject "Making sure you can stay connected", telling them their number had been verified. Android Sage quotes one of them: "Verified numbers are added to all Google Accounts signed in to your [Device]."

How Android verifies your number without asking

Per Kaspersky, Android has two ways to verify the number:

  • The older method sends a hidden technical SMS to Google's servers in the background. Google's help page warns that your carrier may charge for periodic reverification.
  • The newer, now primary method sends an encrypted token with device and SIM identifiers to your carrier, and the carrier returns the confirmed number. It takes a few seconds and you won't notice it.

Google's help page adds that Google and your carrier will "periodically" reverify the numbers, so you can't just wait it out.

Why this hurts if you run more than one Google account

Google lists sensible reasons for the feature: phone number sign-in, account recovery, Find My Device, emergency location (including satellite SOS on Pixel 9 and later), RCS in Google Messages, and Quick Share. If you only have one account, you probably want most of that.

Plenty of us don't have one account, though. A typical dev phone has:

Account Why it exists What a shared number does
Personal Photos, mail, family stuff Nothing new
Work / client Workspace Employer-managed Your personal number now sits on an account your employer can see
Test account Play Console testing, OAuth, Firebase Your real identity ends up on a test fixture
Throwaway / pseudonymous Forums, side projects, HN That separation is gone, at least on Google's side

You split those accounts so they couldn't be correlated. One verified number on all of them is the cheapest possible correlation key. On HN, declan_roberts called the phone number the "social security number of the internet", and that's not much of an exaggeration when every account on the device gets the same one.

Kaspersky makes the same point more dryly: "The operating system does not offer built-in tools to separate numbers for different accounts on a single device."

Is it actually "silent"?

The HN thread argued about this a lot. Some people did get notification emails, and jeffbee joked that "silently" now means "we know this because of the emails it sends." Fair enough, but an email that shows up after the number is already attached is a notice. Nobody asked you anything. A Slashdot commenter, thegarbz, summed it up: "The silent part is where they stopped requesting and just did it for you."

Reports also aren't consistent. On HN, barrkel said their secondary accounts still didn't have any phone numbers. Gadget Hacks notes that Google's docs confirm the association but the reporting doesn't establish that the number shows up in each account's visible settings. That's one more reason to check your own accounts rather than trust a headline, including mine.

How to turn off automatic phone number verification on Android

Menu names move around between Pixel, Samsung and other skins, but the path is basically the same:

  1. Open Settings.
  2. Tap Google.
  3. Open the All services tab.
  4. Under Privacy & security, tap Phone number verification.
  5. Turn off Verify phone numbers automatically. 
Settings > Google > All services > Privacy & security > Phone number verification
Enter fullscreen mode Exit fullscreen mode

Kaspersky says to repeat this for each Google account on the phone, so switch the account at the top of the Google settings screen and check again.

While you're in Privacy & security, look at Phone number sharing too. Slashdot commenters flagged it as a separate setting; its description reads "Allow Google to show you a screen that lets you choose a phone number to share". On GrapheneOS, another commenter said it lives under Autofill & passwords.

Turning it off doesn't remove the number from your accounts

Android Authority is explicit: "turning off the phone number verification toggle only prevents future linking." Numbers already attached stay attached until you remove them, one account at a time:

  1. Go to myaccount.google.com/personal-info.
  2. Check the avatar in the top right so you know which account you're editing.
  3. Under Contact info, open Phone.
  4. Look for your number under Device phone numbers.
  5. Tap the trash icon and choose Remove number.
  6. Switch accounts and repeat for every account that was ever signed in on that phone.

If the number is your real recovery number on your main account, think before you delete it there. Remove it from the accounts that shouldn't have it.

There's also Better sharing on Google. Google says turning on verification also turns this on, but only for one account if you're signed into several. To turn it off: Settings > Google, choose your account, then Manage your Google Account > Personal info, and under Contact info tap Phone. Pick the number and switch off Better sharing.

What you lose when you turn it off

Kaspersky lists two costs: RCS chats in Google Messages stop working (you fall back to SMS or another messenger), and you lose quick number-based account recovery.

Kaspersky also says opting out doesn't guarantee that data Google already collected gets deleted, and that verification can turn itself back on with no reliable way to stop that on stock consumer phones. A Slashdot commenter, devslash0, went further: "Google won't forget that association no matter what, even if you delete the number from an account." So the cleanup above protects you going forward, but it may not touch what Google has already stored.

What I've changed on my own setup:

  • Check that toggle again after every major system update.
  • Keep test and throwaway accounts on a device without a SIM. HN user bsammon described setting up devices that didn't have a SIM card in them.
  • Use a work profile or a separate device for client Workspace accounts.

My opinion: the features behind this are useful, and defaulting them on for a phone with one account is defensible. Applying the same default to every account on the device, future ones included, and sending an email afterwards suits Google far more than it suits anyone running a work account next to a pseudonymous one. If there's more than one account on the phone, Google should ask first.

So, did you check? How many of your accounts already had your number on them, and did you get the email first or only find out from this post? And if you think this is a non-issue because Google already knows who you are, tell me why in the comments.

Sources

Top comments (0)