Google Turns On Android Theft Locks Only in Brazil

Google now turns Theft Detection Lock and Remote Lock on by default for new Android phones in Brazil, and leaves both off almost everywhere else. The first-boot screens still nudge you onto Wi-Fi before you ever open Security and privacy.

That gap is why a seven-setting lockdown keeps circulating. The tools exist. The unbox flow still treats them as optional homework.

Two Locks On for New Phones in Brazil

On January 27, 2026, Google said two theft features are now enabled by default for new phones in Brazil: Theft Detection Lock, which uses on-device AI to catch a snatch-and-run, and Remote Lock, which works from a web browser even if you never opened the toggle in advance. Offline Device Lock, the third switch in the same menu, did not get that treatment.

For new Android devices activated in Brazil, two of our key theft protection features are now enabled by default.

Nataliya Stanetsky, Fabrício Ferracioli, Elliot Sisteron, and Irene Ang, Google, January 27, 2026

The company framed Brazil as the start of an out-of-the-box push, not the finished map. A Pixel or Galaxy opened in another country still needs a hunt through Settings. Google’s own Help page even notes that some theft features “may be on by default,” then points you to the manufacturer, which is another way of saying the global rule is still opt-in.

The suite itself is older than that Brazil switch. Google announced it in May 2024 and rolled it to most Android 10 and newer phones through Play services that October, with Android Go, tablets, and wearables left out. Failed Authentication Lock and protect sensitive settings, which block a thief who sits there guessing a PIN or trying to kill Find Hub, are already on once you set a screen lock. The motion lock and the browser lock are the ones that still wait.

A PIN still feels like enough until a snatch happens with the screen awake. That is the failure the Brazil default is built to fix, and it is the failure the rest of the unbox flow still leaves in place.

Theft Detection Lock Can Stay Quiet on Wi-Fi

The usual advice is to refuse the nearest network until the security menu is clean. Google’s Help page undercuts that sequence. Theft Detection Lock uses AI, motion sensors, Wi-Fi, and Bluetooth to decide that someone just took the phone and ran. It also may not trigger on stable Wi-Fi or a stable Bluetooth link, and it stays idle if the screen is already locked.

So the cafe network you delayed joining is also the signal that can tell the snatch lock to stand down. Repeated locks in a short span can suppress it too. If the phone does lock while you still have it, Google says to unlock and keep going; the feature is tuned to miss some real grabs rather than freeze you on a jog.

Offline Device Lock is the quieter partner. If a thief kills data so Find Hub cannot see the handset, the screen locks after a short stretch of offline use. The phone has to be unlocked when it loses connectivity, and that lock can fire twice in a 24-hour period. Remote Lock has the same twice-a-day cap.

Remote Lock also needs a live network on the missing phone, or it waits. You go to android.com/lock, enter the verified number, pass a CAPTCHA, and ask for the lock. If you set an optional security question in 2026, a wrong answer fails the request. The page does not wipe the device. For that you still sign in to Find Hub, which Google turns on automatically once a Google Account is on the phone.

How to Turn On Android Theft Protection

On many phones the path is Settings, then Google, then All services, then Theft protection under Personal and device safety. Pixels often surface the same hub under Security and privacy. Search Settings for “theft protection” when the maker has buried it. You need a screen lock first. If Theft Detection Lock is grayed out, the handset does not support it.

THE THREE THEFT LOCKS

Brazil’s default covers two of those three rows. Offline Device Lock still asks to be switched on even there. Identity Check, which is separate, forces a face or fingerprint for sensitive moves when you are away from trusted places, including turning the theft features off. It needs a Google Account, a screen lock, biometrics, and those trusted places before it will arm.

REMOTE LOCK NEEDS THESE FIRST

• A screen lock: Without a PIN, pattern, or password, the remote command has nothing to enforce.
• An active SIM and verified number: The web form keys off the number you confirmed on the phone.
• Find Hub turned on: Google lists it as a requirement, and a Google Account usually turns it on for you.
• A path to the internet: An offline handset queues the lock and applies it when it next comes online.

After that setup, you can lock the screen from any browser without remembering the Google password in the parking lot. The locked phone then only unlocks locally with the screen lock. Google still recommends a PIN of six or more digits, because biometrics are a convenience layer, not the backup if someone watched you type.

Network Alerts Stay Off on Most Pixels

Theft is the loud risk. A fake tower is the quiet one. Google’s Help page is blunt: mobile network security features are turned off by default. That matches a Pixel 9 Pro XL on Android 17, where Network notifications still sit off until someone opens More security and privacy, then Mobile network security.

Android’s source docs describe the Mobile network security page added in Android 16, with a notifications toggle and a 2G control per SIM. The alerts only appear on hardware that can report them. Google’s Help page says some of these steps work only on Android 15 and up, and only on devices with supporting hardware. Samsung One UI still lacks the same alert pane and instead offers Intelligent Wi-Fi with Detect suspicious networks.

WHAT THE ALERTS ACTUALLY SAY

• Unencrypted network: The phone connected to a cell network that is not encrypting traffic.
• Identifier disclosed: The network just took the IMEI or IMSI, which can be normal and can also be a fake tower.
• Back on encryption: The radio returned to an encrypted network after a weak one.

The first attach after a reboot or after airplane mode often throws a “recent disclosure” notice, and Google calls that normal. Dense 2G areas produce a lot of noise; the Help page names Switzerland. A burst of alerts in a short window is the pattern Google flags as worth a closer look. Airplane mode is the blunt reply until you can get onto a network you trust.

The 2G switch is older. Android 12 let users cut 2G at the modem, and Pixel 6 was the first phone to ship that control. Leave Allow 2G off if the menu gives you the choice. Older 2G has weak encryption and no real mutual authentication, which is why IMSI catchers still lean on it. The cost is coverage in pockets that only have 2G for some services. Emergency calls are the exception: if 2G is off and nothing else is around, the phone still tries 2G as a fallback.

Gboard Learns on the First Wi-Fi Charge

The keyboard is the first app that sees passwords, one-time codes, and half-written messages. Gboard Help says federated learning is turned on by default. It does not send the text you type. It sends what the on-device model learned, and only while the phone is charging, on Wi-Fi, and not in use. That is the other reason the first network matters. The learning pass waits for the same Wi-Fi you were told to join during setup.

Share usage statistics is a separate pipe for keyboard diagnostics. Personalize for you and Improve for everyone keep audio and transcripts on the device for recognition tweaks. Audio donations are voluntary snippets, capped at 15 seconds, or 25 if there is silence or unrecognized sound, held no longer than 18 months. Human reviewers may listen to some of those clips. Google says the clips are not tied to your account, which also means you cannot pull them back.

GBOARD PRIVACY TOGGLES

• Share usage statistics: Stops diagnostic and usage data from going to Google.
• Personalize for you: Stops on-device recordings and transcripts from training your own model.
• Improve for everyone: Stops the same class of data from feeding shared recognition models.
• Audio donations: Stops dictation clips from being stored for conventional learning.

Open Gboard, tap the gear, then Privacy, or take Settings to System, Keyboard, Keyboard apps, Gboard. Delete learned words and data if you want the on-device log gone. Turning those switches off does not make Gboard an offline keyboard. It still has network access. People who want a board that cannot call home install something that never held that permission in the first place.

Unknown Tracker Alerts Are Already On

This is the item on the seven-setting list that often does not need a ritual. Unknown tracker alerts grew out of a Google and Apple spec in May 2024 and run on Android 6.0 and newer. On Android 14 and up, AirTag alerts are commonly already allowed. The job is to confirm Settings, Safety and emergency, Unknown tracker alerts, and that Allow alerts is on, then run Scan now if you want a 10-second look at what is nearby.

Automatic alerts need Location. If Location is off, the manual scan still works. A tag that has been moving with you can take hours to surface; some write-ups put that window as long as 24 hours. Household AirTags on keys and bags produce a lot of false pings, which is why people disable the feature and then never turn it back on. That is the wrong trade if the actual risk is a tag in a coat or a car.

When an alert lands, the phone can show a map of where the tag traveled with you, play a sound, and walk through how to disable it. Later updates added a Find nearby view and a way to pause location sharing from your own Find Hub tags for up to 24 hours while you look. None of that fires if Bluetooth is off or the phone is in airplane mode.

Why the Password Peek Still Comes First

Show passwords is the smallest switch and the one that matters in a checkout line. Stock Android and Pixel still enlarge each character in a password field. Turn off Show passwords for touchscreen under Settings, Security and privacy, Privacy controls. On Galaxy phones the same idea lives under Security and privacy, More security settings. Masked dots from the first keystroke are the whole point.

The last pre-Wi-Fi habit is the boring one. Open Settings, System, Software updates, and run both System update and Google Play system update before you sign into banks or mail. The first-boot wizard often offers the patch. Take it. Known bugs are cheaper to close before the phone has accounts on it.

HOW THE DEFAULTS GOT HERE

1. May 2024: Google announces Theft Detection Lock, Offline Device Lock, and Remote Lock, and ships cross-platform unwanted-tracker alerts with Apple.
2. October 2024: Play services carries the theft suite to most Android 10 and newer phones, with the locks still waiting in Settings.
3. Android 16: Settings gains a Mobile network security page; network notifications and the 2G control still start off.
4. January 27, 2026: New Android phones activated in Brazil get Theft Detection Lock and Remote Lock on from day one.

The seven-setting list is a workaround for that timeline. Failed Authentication Lock and Find Hub already come on with a screen lock and a Google Account. Tracker alerts often do too. The motion lock, the offline lock, the browser lock outside Brazil, the cell-tower alerts, the 2G block, Gboard’s sharing switches, and the password peek still do not. Until those defaults move, the unbox job is to flip them before the wizard’s Wi-Fi prompt becomes a habit.

Frequently Asked Questions

Does Remote Lock Work If the Stolen Phone Is Offline?

The request waits. Google’s Help page says the screen locks automatically once the phone is back online. After that lock lands, the handset can only be unlocked locally with the screen lock. The web page cannot unlock it for you, and it cannot factory-reset the phone. A wipe still goes through Find Hub after you sign in.

Will Blocking 2G Stop an Emergency Call?

No. If Allow 2G is off and no 3G, 4G, or 5G network is available, the phone still tries 2G as an emergency fallback. Everyday data and calls stay off 2G. The gap you accept is weaker coverage in places that only have 2G for some services, not a dead radio in a crash.

Which Phones Cannot Use Theft Detection Lock?

Google says the theft suite is not supported on Android Go phones, tablets, and wearables, and that support can vary by model. The toggle is grayed out when the device cannot run it. Android 10 or newer with Play services is the floor for the rest of the lineup. A lock screen is required before any of the theft switches will arm.

What Does Gboard Send When Federated Learning Stays On?

Not the words you type. Gboard Help says federated learning sends what the on-device model learned, and only while the phone is charging, on Wi-Fi, and idle. Share usage statistics is a different toggle. Audio donations are a separate yes/no prompt, with clips of 15 seconds, or 25 with silence, kept no longer than 18 months, and some of those clips can be reviewed by people.

How Do Unknown Tracker Alerts Work With an Apple AirTag?

Android can warn you when an AirTag, or another tag that follows the shared spec, is separated from its owner and moving with you. Location has to be on for those automatic alerts. A manual scan under Unknown tracker alerts still runs if Location is off. Borrowed keys and a roommate’s bag can trip the same notice, so the map and the play-sound button are how you tell a false ping from a tag you need to kill.

Can You Remotely Wipe a Phone From android.com/lock?

No. That site only locks the screen, and only twice in a 24-hour period. To locate, mark as lost, or erase the device you still use Find Hub in a browser or on another phone. Set the Google Account and Find Hub up before the phone goes missing, because that is the path that can actually wipe it.

Brazil already got the default Google says it wants for everyone. Until that spreads, the motion lock, the 2G switch, and Gboard’s sharing toggles still sit where a first-boot Wi-Fi prompt can beat them to the punch.