The three-layer backup model that actually covers everything
Android backup is not one switch; it is three layers, and every data-loss tragedy traces to assuming one layer covered another's job. Layer one, the system backup (Settings, Google, Backup): app list, call history, SMS, contacts, device settings, and app data for apps that support it. Layer two, media backup: Google Photos for the camera roll, which the system backup does NOT duplicate. Layer three, app-specific backups: WhatsApp's own Google Drive backup, authenticator app transfers, game-account logins, each independent, each with its own switch.
Understanding what layer one skips prevents the classic surprises. The system backup does not include your photos and videos (layer two's job), does not include most app internal data (only apps whose developers opted in restore their state; many games and chat apps do not), does not include files sitting in Downloads or custom folders, and does not include anything on an SD card. It restores your app LIST, but signing back into 60 apps is on you, and any app whose account you cannot remember is data already lost, just not yet discovered.
The model gives you a five-minute audit you can run right now. Layer one: Settings, Google, Backup, is it on, and when did it last run? Layer two: Google Photos, profile icon, does it say backup complete? Layer three: WhatsApp, Settings, Chats, Chat backup, timestamp recent? Authenticator: do you have backup codes or a transfer plan? Those four questions, answered honestly, are your entire exposure map, and the sections below close each gap in turn.
Layer one done right: the Google system backup
Turn it on properly: Settings, Google, Backup, enable 'Backup by Google One' (the name varies slightly by version), and tap Back up now once to seed it. From then on it runs automatically when the phone is idle, charging and on Wi-Fi, which means a phone that never charges overnight on Wi-Fi may quietly run stale backups; the timestamp on this screen is the truth, glance at it monthly. The backup consumes your Google storage quota shared with Gmail, Drive and Photos; system backups are small, but the quota pressure usually comes from layer two.
Know the expiry rule, because it deletes backups on a schedule nobody reads: a device backup expires after the device is inactive for roughly two months (57 days in current policy, with warnings). The practical consequence: when you retire a phone into a drawer, its backup will eventually vanish; and when a phone dies, restore its backup to the replacement within the window rather than someday. The backup screen lists all your devices' backups with dates; prune ancient ones deliberately rather than letting the policy surprise you.
SMS deserves its own line because people care about it disproportionately: the system backup includes SMS/MMS threads on modern Android, restored during new-phone setup, but does NOT include RCS chat history in all cases, and third-party SMS apps may keep their own databases outside the backup. If your messages are precious, the belt-and-suspenders move is periodic export from your messages app where offered, and for the truly archival (a thread with someone gone), screenshots or exports into Drive, because platform backups are for continuity, not for archives.
Layer two: photos, the backup that matters most
For most humans, the photos ARE the phone, and photo backup deserves the care that implies. Google Photos: profile picture, Turn on backup, then the quality decision made once. Original quality preserves every pixel and counts fully against your quota; Storage saver compresses (very well) and stretches the free 15 GB years further. For irreplaceable work, original; for everyday life, storage saver is a rational choice millions make. Verify the first full upload completed, days for big libraries, by checking photos.google.com from a computer: what appears there is what is safe, and that check is the only proof that counts.
Configure the two settings that bite people later: backup over mobile data (off by default; leave off unless your plan is generous, but then remember vacation photos wait for Wi-Fi to be safe), and which device folders back up (Photos, Library, folders on this device): WhatsApp Images, Screenshots and camera folders each have their own toggle, and the default excludes some. If your WhatsApp photos matter, toggle that folder on knowingly, with the quota consequence in mind. Our storage converter helps translate 'nine thousand photos' into gigabytes when planning quota.
Then adopt the deletion discipline that cloud backup enables: the 'Free up space' button removes local copies of backed-up photos, which is exactly how a 128 GB phone lives comfortably with a 400 GB library. And the mirror-image warning: deleting inside Google Photos deletes from the cloud too (into a 60-day trash); Photos is a synced library, not a copy. For the subset beyond precious, a child's first year, a late parent's pictures, one cloud is one point of failure, so add a second location: periodic export via takeout.google.com, a yearly copy to a computer drive, or a shared album with a partner whose account independently holds the contributions.
Layer three: the app-specific backups that catch everyone
WhatsApp is the biggest heartbreak generator in Android data loss, because its backup is entirely its own: Settings, Chats, Chat backup, backed up to Google Drive on the schedule you choose, restorable only during a fresh install's setup, and tied to your phone number plus Google account. Before any reset or phone switch, run a manual backup and read the timestamp. Media adds bulk; include videos knowingly or exclude them to keep backups fast. And know the restore choreography: new phone, install WhatsApp, verify the SAME number, accept the restore prompt immediately; skipping it and chatting first complicates recovery permanently.
Two-factor authenticator apps are the silent catastrophe: Google Authenticator codes historically lived only on the device, and a wiped phone without a transfer meant being locked out of every account the codes protected. Current Google Authenticator can sync codes to your account, verify that toggle, and the app offers an export/transfer QR flow for phone switches. Whatever authenticator you use, hold printed backup codes for your critical accounts (Google, banking, work) in a physical drawer. This paragraph, acted on, prevents the worst week of many people's digital lives.
The remainder is a quick sweep of self-owned data: games (is progress tied to a login? open the game, check the account screen, because 'level 400 in a guest account' dies with the phone), voice recorders and note apps with local-only storage (export or sync them), music and podcast downloads (re-downloadable, ignore), and the Downloads folder plus any folder you created (copy to Drive or a computer; the system backup ignores them). Samsung users get a parallel universe, Samsung Cloud and Smart Switch, which are excellent, just keep straight which system holds what rather than assuming each covers all.
The restore test, the switch-day playbook, and the habit
A backup that has never been restored is a hope, not a plan, and there is a zero-risk way to convert hope into knowledge: the next time you or a family member sets up any phone, restore from backup instead of setting up fresh, and observe what actually comes back, and what does not. Failing that opportunity, at least dry-run the inventory: photos.google.com shows layer two's truth; the Backup screen shows layer one's date and size; Drive's backups section shows WhatsApp's snapshot. Fifteen minutes of verification beats any amount of assumed safety.
Phone-switch day, run the playbook in order: on the old phone, manual system backup, manual WhatsApp backup, Photos backup complete, authenticator transferred or synced, and a glance through the folder sweep from the previous section. On the new phone: restore the system backup during setup (it offers the most recent; check the date it shows), sign into Photos (library simply appears), install WhatsApp and restore before first use, re-add your authenticator, then let the Play Store reinstall the app list over Wi-Fi. Keep the old phone alive and un-wiped for a week as the safety net for anything forgotten, THEN wipe it for sale with our factory-reset guide's checklist, and generate a condition report with the PDF tool if selling.
Finally, the habit that makes all of this ambient: once a month, three glances, backup timestamp, Photos status, WhatsApp timestamp. Ninety seconds. Everything else in this guide is one-time setup; the glances are the maintenance, and they catch the silent failures (a full quota stopping Photos, a changed setting stopping WhatsApp) while they are trivia instead of tragedy. A phone can be lost, stolen, drowned or shattered this afternoon; with the three layers verified, that is an inconvenience measured in hours, which is the entire point.