There is a mistake that privacy-focused communities make so consistently that it has become almost invisible. It is the assumption that a product marketed as privacy-respecting is also more secure. This assumption is not just wrong. It is dangerous. Privacy and security are different properties, they require different organisational capabilities, and they frequently conflict in ways that leave users worse off than if they had never switched at all.

The distinction is not subtle once you state it plainly. Privacy is about who can access your data: does the company behind the product collect your location, scan your messages, or build an advertising profile from your behaviour? Security is about who can break your system: can an attacker exploit a vulnerability to take over your device, at which point they can read your messages and record your calls without the company’s help? The two properties are independent. You can have privacy without security — a de-Googled phone that never receives security updates still does not send your location to Google, but it runs a kernel with publicly known exploits that any competent attacker can use to take complete control. You can also have security without privacy — Google’s Pixel phones receive monthly security updates and have a dedicated security chip, but the operating system is still instrumented to collect data for Google’s advertising business. The security protects the phone from attackers. The privacy invasion abuses your trust in a different way.

The Android ecosystem is the clearest illustration of this trade-off. Google maintains the Android Open Source Project as an open foundation, but the tracking lives in Google Play Services, the proprietary layer on top. This architecture has created a market for de-Googled distributions — operating systems that use the AOSP foundation but strip out Play Services. They all promise the same thing: Android without Google’s surveillance. The question is what they give up in return, and the answer, for most of them, is Google’s security infrastructure. The Android Security team has hundreds of engineers. The monthly bulletin patches dozens of vulnerabilities, many discovered by Google’s own Project Zero researchers. Play Protect scans over a hundred billion apps daily. The Titan M chip in Pixel devices provides hardware-backed verified boot and secure key storage. The bug bounty programme pays researchers millions for critical exploits, ensuring vulnerabilities are reported rather than sold. This is one of the largest security programmes in the history of consumer software.

When you switch to a privacy-focused Android distribution, you opt out of the tracking. In most cases, you also opt out of this security infrastructure. Consider /e/OS, one of the most popular de-Googled distributions. It replaces Play Services with microG, ships with privacy-respecting defaults, and is built by a small dedicated team. But it is built on LineageOS, which depends on volunteers to port security patches to each device. The patch delay can be weeks or months. For some devices, patches never arrive. The bootloader is often unlocked, which disables verified boot — the mechanism that ensures the operating system has not been modified by malware. Without it, an attacker who gains temporary access can install a persistent backdoor that survives factory resets. Exploitation brokers sell Android exploits to governments and law enforcement. An unlocked bootloader with a kernel six months behind on patches is an invitation. The privacy you gain by removing tracking is real. But when security fails, privacy fails with it. A compromised device belongs to the attacker, not to you.

GrapheneOS is the rare exception. It hardens the kernel beyond AOSP, ships patches on the same day as Google, supports verified boot with its own signing keys, and runs Play Services in an unprivileged sandbox that provides app compatibility without tracking. It proves that privacy and security can reinforce each other when the team has deep expertise. But it supports only Pixel phones, because its security model depends on hardware features only those devices provide. For the vast majority of Android users — who buy Samsung, Xiaomi or Oppo devices — the choice is between the manufacturer’s heavily modified Android and something like LineageOS or /e/OS, where the security story is far weaker.

The pattern extends beyond phones. Proton Mail encrypts your mailbox with keys it does not possess, so it cannot read your emails. This is privacy done right. But Proton’s security infrastructure is operated by a few hundred people. Gmail’s security is operated by Google, with over a hundred and eighty thousand employees and security engineers who face constant, sophisticated attacks. If an attacker wants to compromise an email provider, Proton is a smaller target with fewer defenders. The privacy protection — that Proton cannot read your emails — does not protect you from an attacker who compromises Proton’s infrastructure and intercepts mail before encryption, or from a web application vulnerability that exposes session tokens. Privacy is trust in the provider’s intentions. Security is trust in the provider’s competence. They are not the same thing.

What should you do? Not avoid privacy-respecting software, but evaluate it honestly. Ask two separate questions. First: does this product actually respect my privacy — is its business model free of data monetisation and is its architecture designed to avoid unnecessary data exposure? Second: is it secure enough for my threat model — given its team size, funding, patch cadence and track record? Do not assume a yes to the first implies a yes to the second. The relationship, if it exists, runs in the opposite direction. Smaller teams with fewer resources tend to have worse security, not better.

The most dangerous phrase in this space is “Google tracks you, so anything else is safer.” It is dangerous because it collapses two dimensions into one. Google tracks you, and this is bad. But Google also protects you from threats most alternatives cannot match. When you leave Google’s ecosystem, you stop being tracked. You also stop being protected. The question is not whether the tracking is worse than the loss of protection. It is whether the specific alternative can provide enough protection on its own. The answer is sometimes yes — GrapheneOS proves it is possible. It is more often no, or at least not clearly yes, and you should want clarity on this before you make your phone less secure than it was before.

This is not a defence of Google. Google’s surveillance model is corrosive, and the fact that it spends billions on security while undermining privacy is an indictment of its incentives. But the correct response is not to flee to alternatives whose security you have not verified. Start with your threat model. If you face targeted attacks, GrapheneOS on a Pixel is the right answer. If you are an ordinary person tired of being tracked, start with partial improvements that do not compromise security — disable location history, switch to Firefox, use an ad blocker, run DuckDuckGo. Partial privacy improvements that leave security intact are better than a dramatic switch to a system whose defences you cannot assess.

Above all, stop using “privacy” as a synonym for “good” without asking what else is changing. A product is not good because it respects your privacy. It is good if it respects your privacy and is also secure, reliable and honest about its limitations. Privacy is one property among many. Treating it as the only one that matters will lead you to decisions that leave you less safe than before, and the first thing to go when your device is compromised is the privacy you compromised security to protect.