Upon enrollment, the phone illuminates your face with a grid of dots, and creates a three dimensional depth map of your face from multiple angles.
The results of that are stored in the secure enclave, and when an unlock is requested the device re-scans the face that is in front of it. If the two maps match "close enough" the phone is unlocked.
You cannot recreate a face from the data, and the phone has no idea what you look like unless you actually look like this in real life: https://i.imgur.com/fNBiIUU.jpg
If you're worried about the very low resolution biometric map of your face being used to impersonate you, that can already be accomplished with just a couple of seconds of video, or a photograph and the only known defense against that is never venturing outside a secure perimeter into which camera lenses cannot see.
Face tracking for faceId you can turn off but I agree it can be creepy. So far it's been limited to only on the device and encrypted so I've been ok with it but that's obviously a very personal choice.
Adguard works rather well, but Apple doesn't seem too keen on their product:
https://adguard.com/en/blog/adguard-pro-discontinued/
Of course, there's ad blocking in Safari but tracker blocking in apps also concerns me.
As for the FaceID I would indeed turn it off and use a PIN, but it would be a bit of a faff; a fingerprint plus a means to quickly turn that off is quite convenient.
I then have content rules on the firewall between the OpenVPN server and the Internet.
As an added benefit, this makes the monitoring done by all cellphone providers (not just Verizon!) irrelevant because all they see is a constant, 24x7 stream of encrypted traffic to the same IP address.
Charles: https://itunes.apple.com/us/app/charles-proxy/id1134218562?m...
Another that I have heard of but not used (your milage may vary and all that): Alice https://itunes.apple.com/us/app/alice-network-proxy-utility/...
You can also run a proxy on a server remotely and intercept all the network calls from your phone, something burp is common in the security industry. It's under your network settings, HTTP Proxy. It's more limited than an app like Charles that inspects all traffic but it's another option.
I think it's come up here a few times, with various anecdotes about surfacing badly behaving apps.
Apple do seem to have some respect for privacy at the moment, but it's still a phone that scans the user's face (far too creepy for me) or makes it difficult to restrict outgoing connections (I'm not keen on apps connecting to flurry, facebook and so on).