You have many options:

First things first, disable biometrics and turn on lockdown.

Turn on automatic updates and stay up to date. The 26.3 update had significant security fixes in it!

Install your privacy respecting VPNs app and mdm shim. Use their dns (especially if it has an adblocker (mulvad)).

Figure out how to keep a backup code on paper and use that to turn on advanced data protection (adp). This will allow you to have e2ee with no backdoor on your iCloud stuff.

Go to settings > privacy and security and do a security checkup. It’ll walk you through which apps have access to what and when.

Don’t install extra shit. There’s good sandboxing in iOS but every app is another tracking vector.

Turn off location services unless you need it.

Turn off siri, also in Face ID and passcode scroll to the bottom and turn off access control center when locked (or just remove the airplane mode control). That keeps someone from turning on airplane mode and defeating stolen device protection when they snatch your phone.

Settings > privacy > all the way at the bottom: wired devices allow when unlocked

There’s probably more I’ll remember later. It’s easier if I know what you’re trying to get privacy from. Big difference between 4th amendment stuff and the advertisers you unknowingly invite into your home.

1. Disable Siri for literally everything.
2. Most stuff here.

1. Don't sync anything to icloud you wouldn't want the government being able to get it or generally want to keep private.
2. Go through privacy settings, especially location settings and check what you're allowing including system services, adjust as you feel comfortable while still meeting your needs.
3. Pay attention to what apps you're installing. Most profiling data is not sold by say Google directly off your phone but based off ad-networks incorporated in third party apps you install. The app store has a scorecard on all apps showing you how much if at all they profile and spy on you, make use of it, make wise choices, don't install bad apps.
4. Install a privacy respecting adblocker to help limit tracking while using the web browser
5. Limit permissions for apps. If you must use an app that has location tracking consider only allowing it while you're using the app, this may have implications for some extended functionality like updating while in the background or via Apple's little info tiles.
6. Disable siri or limit it, turn off "hey siri" mode in settings.
7. Enable lock-down mode (this is an extreme step and will result in some loss of functionality, Apple details the implications themselves so take a look at their page on it before doing so)
8. Disable radios such as bluetooth and wifi while outside your house to prevent any possibility of their use in tracking you. You can actually make a "Shortcut" using app of the same name from Apple to automate this anytime you leave home and I believe there are existing ones you can find if you search around.

Apple phones are fairly private as long as you don't use icloud for anything sensitive, apply common sense privacy settings, and pay attention to what apps you install and what permissions you give. Also don't send them crash or debugging data as that can contain personal info potentially so uncheck that option.

Use the six digit pin. Pick one that’s not widely used, here’s a chart for reference

Turn off notification previews. This will make notifications no longer show the content of the thing they’re notifying you of.

If you’re concerned, turn off push notifications altogether. They’re a problem.

Treat sms (texting with a green bubble) as if it’s public. It is. There is no clear indication that the lawful intercept backdoor hack has been reversed and its nature makes that hard to imagine.

Treat rcs as sms. It was never designed to be encrypted, only to add functionality to sms. Encrypted rcs relies on transmission between two users of rcs services that support encryption. Currently the other encrypted rcs supporting users you’ll see are Samsung and google.

iMessage, the blue bubble texts, should be fine especially if you and your cohort have adp turned on. If it worries you then add them to the below.

Use signal or something to communicate privately with green bubble texters or everybody.

Your phone, no matter the brand or service provider, is a tracking device. It needs to be in order to effectively use the cell network. The phone must have a unique identifier, must figure out the best signal from different available towers and must be able to authenticate and identify itself as part of a valid users subscription to a service. When you are uncomfortable with this, turn the phone off and walk away from it.

Practice the 5x button iOS emergency press. In addition to giving you quick access to emergency calls, it will disconnect devices, requires pin entry to unlock the phone even if you have biometrics on and gives you the option to turn your phone off.

Turning your phone off means that someone attempting to get into it will need to get past the much higher bar of “before first unlock” before they can access it. Get comfortable turning your shit off.

Is this for work? Then only use it for work. Don't out anything private on it. No exceptions.

Don't put anything personal in it. That's what I sued to do using my iPhone and what I still do now, using an Android.

Android users are fucked too unless we run something like GrapheneOS. It's a tall mountain to climb for most people. My phone is not supported.

Surprised nobody has mentioned this yet but Enable Advanced Data Protection

You can change whatever settings you like but ultimately it's closed software so you can't trust it. Do what you need to practice privacy with the intent of getting a Graphene phone when possible for you

Put it in flight mode. If it's not communicating then it's not leaking information.

You should not log in an apple account then you can take full control of your iPhone but apps won't be installed without an iCloud account. iCloud mail? Forget it. You still can check it on safari. Still iPhone is the best for privacy. Otherwise, a pixel phone on graphene OS is very good.

Brave browser has built in adblocking .