Key Takeaways
Summary
18 items · 30–60 minutes
Why Setup Decisions Matter More Than You Think
Unboxing a new phone, tablet, or laptop feels like a fresh start — and it is. But the first 30 minutes of configuration can shape how private and secure that device remains for its entire lifespan. Manufacturers and app developers set defaults that often favor connectivity and data sharing over user privacy, which means accepting defaults uncritically is itself a choice — just not necessarily one in your favor.
This checklist walks you through the essential steps to take before you start using any new device, organized by priority. Work through it in order when possible; the earlier categories cover fundamentals that later steps depend on. For a deeper look at what good ongoing habits look like after setup, see habits that quietly undermine your online privacy.
Foundational Security
Account and Authentication Setup
Privacy Settings Review
Network and Remote Access
App and Permission Hygiene
Tools and Resources to Have Ready
You don't need special software to follow this checklist, but having a few things on hand will make the process smoother and more effective.
Password Manager
Generates and stores unique, complex passwords for every account and app you connect to the new device.
Authenticator App
Provides time-based one-time codes for two-factor authentication, which are more secure than SMS verification.
Pen and Paper (or Secure Notes)
Used to record account recovery codes and backup access methods in a safe, offline format.
Router Admin Access
Lets you verify your home network's encryption standard and update router firmware if needed.
If you're setting up a device that will be part of a connected home network, the same security principles apply to your other equipment — see security habits for devices on a shared network for guidance that extends beyond a single gadget.
Don't Skip Setup to 'Fix It Later'
It's tempting to rush through setup and circle back to security settings once the device feels familiar. In practice, most people don't return to those menus. Default settings can expose location data, enable broad analytics sharing, and leave remote-wipe features disabled — all before you've sent a single message. Taking 30–60 minutes at the start is far easier than auditing and correcting a device that has been in active use for months.
What to Do After the Initial Setup
Completing this checklist puts you in a substantially stronger position than most users who accept defaults and move on. But device security isn't a one-time event. Schedule a brief account and settings review every few months — your online account security audit checklist is a good companion resource for that ongoing habit.
If the new device is a smartphone, you may want to go deeper on privacy-specific decisions. The guide on setting up a new smartphone with privacy in mind covers the key choices unique to mobile platforms. And if your device is joining a smart home, where to actually begin with a smart home can help you think about how it fits into the broader network.
Lost or Stolen Devices Need Immediate Action
If a device you've set up goes missing before you've enabled remote wipe, your options are severely limited. Any accounts still logged in remain accessible to whoever has the device. Always enable 'Find My Device' or an equivalent feature as part of initial setup, and know how to trigger a remote wipe from another device or a browser — your platform's account management page is the place to start.