Install canta then you can remove hidden telemetry apps they have badges for which are safe to delete and which are not
Privacy
Icon base by Lorc under CC BY 3.0 with modifications to add a gradient
I have a friend who wants to get more privacy aware but is not yet ready to commit to a new ROM based solution
I’m with IceFoxX on this issue. Your friend isn't aware how Google's ROM bypasses whatever privacy setting you made because it's their entire business model to invade your privacy. You're better off installing the full ROM instead and working backwards on what the friend wants to divulge.
Well will end with magisk So he can remove all the google stuff ( + facebook stuff etc hidden as non-gui system apps ) using zygist-detach, needs replacing webview and so much more. Anyway xda-developers is still alive.
In the end, he will be frustrated and may end up with a completely unprotected cell phone. The developers of custom roms have much more experience in this area. They don't have to deal with individuals and have a much lower chance of ending up in bootloops or anything else
I am also using a rom so i cant help with apps & stuff
I use the lineage based e/os. Booth are degoogled and suited for like 13+ year old devices (except apple) so if you manage to find an old phone you can test it out without tampering with his currenw phone
Random Stuff:
F-Droid is for open source apps
Ensuring a not google email
You can check/look for new apps here but its not really made to look for categories like games
EDIT: reports.exodus-privacy.eu.org/
Techlore has a video on Android hardening, worth a view. There are definitely possible steps to take beyond the scope of this video, but its a good place to start.