Hey there đ
One thing I see people talk about all the time is their phone listening to them.
For example: you mention that you need new shoes in a conversation, and suddenly Instagram shows you a shoe ad.
Or maybe you text a friend about a restaurant, and then Google starts showing you reviews for it.
The obvious explanation is that your phone heard you.
But is that really whatâs happening?
I wanted to look into that because there is a bigger question underneath it: How much does your phone actually know about you, and how much information are the apps on it collecting without you realizing?
Thatâs what I want to explore today.
But first, letâs clear up the biggest myth.
Is Your Phone Listening to You?
The short answer is no, because there is no good evidence that phones are constantly recording conversations and sending them to advertisers.
One of the strongest tests came from researchers at Northeastern University. In a 2018 study, researchers tested 17,260 Android apps to see how they used their microphones and other media permissions.
They found no evidence of phones activating the microphone and sending recordings to third parties.
However, the study did find that some apps were recording what happened on your screen and sending that information to third parties. The GoPuff app, for example, sent screen recordings to the analytics company Appsee. Those recordings included the userâs ZIP code and other information displayed on the screen.
There is also something else worth considering: If an app were constantly recording everything around you and sending that audio back to its servers, that activity would consume tons of resources. And that would create activities that researchers could detect easily.
That doesnât mean microphones have never been part of privacy problems.
In 2024, 404 Media reported on a pitch from Cox Media Group (CMG) that promoted Active Listening. The company claimed it could use microphone data to understand what people were talking about and help advertisers target them. Google later removed CMG from its advertising Partners Program after the reporting.
The claims raised obvious privacy concerns, but the FTCâs May 2026 settlement revealed a different picture.
According to the FTC, Active Listening never used voice data. The agency alleged that CMG and two partner firms had misled customers, while the service relied on purchased email lists for ad targeting.
The companies agreed to pay nearly $1 million to settle the charges.
The case offers a useful reminder that companies can build detailed advertising profiles using data they already buy and collect, without needing to listen to private conversations.
Companies already have other ways to learn about peopleâs interests and use that information for advertising. They can draw on peopleâs online activity and interactions with their own services.
For example, recently Meta announced that, from December 16, 2025, it would use peopleâs interactions with Meta AI as another signal for personalizing the content they see. So if you chat with Meta AI about, letâs say, hiking, Meta says that interaction can help it infer that youâre interested in hiking and show you related content or ads.
That is a lot closer to the experience people describe when they say, âI talked about this and then I saw an ad for itâ.
The difference is that you gave the information to the service directly.
What Your Phone Tracks About You
Location
Your phone can use GPS, Wi-Fi, cell towers and Bluetooth to work out where you are. That can create a detailed record of places you visit, from where you work and shop to other sensitive locations.
There is strong evidence that this data can cause real-world privacy problems.
One example involves Gravy Analytics and Venntel, two data brokers targeted by the FTC in December 2024. Weâll return to that case later.
Metadata
Metadata can be defined as the information about your communication rather than the content itself. Who you contact, when you contact them and how often are all examples of metadata, and together they can reveal a surprising amount about your life.
A 2016 Stanford study involving 823 volunteers showed how much could be inferred from call and text metadata alone. Researchers were able to identify patterns connected to medical services and other sensitive activities. The study is more than 10 years old, but it shows how revealing metadata can be.
If you want to learn more about metadata and how to protect yourself online. You can check out this piece:
App Usage and In-App Behavior
Your phone also tells apps what you do inside them. Two people can have the exact same Instagram app and end up with completely different feeds. One might see gym content while another sees gaming, because the platform learns from what each person interacts with.
That can include how long you watch something, what you skip, what you interact withâŚetc. Meta says these behavioral signals help its systems predict what content youâre likely to find interesting.
With the passage of time, your behavior becomes a detailed map of your interests, even if you never explicitly tell the app what you like.
Browsing and Search
Your searches and the websites you visit can reveal a lot about your interests, habits and the things youâre trying to learn or buy.
A lot of people also assume that using incognito or private browsing makes them invisible. That is not true, it mainly stops your browser from saving local browsing history. Websites can still see your activity, and technologies such as cookies and browser fingerprinting can help them recognize and track you.
Iâve covered all of this in more detail in my Privacy Fundamentals series if you want to understand how this works and how to reduce the amount of information you give away:
Purchases
Your phone and the apps you use can also build a picture of what you buy. Online stores can see what you search for, what you look at, what you add to a cart, when youâre logged in and so much more.
That data can also be used for personalized pricing. Research has shown that browsing history can help companies estimate how much a customer may be willing to pay, although that doesnât mean every website is secretly raising prices for repeat visitors.
Your Connections and Surroundings
Your phone is also constantly interacting with the world around it. Wi-Fi networks, Bluetooth devices and nearby signals can provide information about where you are and what is around you.
Researchers have even tested Bluetooth beacon systems that can track shoppers as they move through a store. One study tested this in a real two-floor retail store and used Bluetooth signals from smartphones to estimate shoppersâ indoor locations.
Basically, if the right infrastructure is around you, the signals between your phone and that infrastructure can also reveal a surprising amount about where you move.
What You Type
Your keyboard is another interesting one.
If youâve used Gboard, youâve probably noticed that it learns the words and phrases you commonly use. Thatâs because Gboard keeps a learned vocabulary to improve spelling and predictions.
Google says those saved words stay on the device, but that doesnât mean keyboard data is harmless. A keyboard is sitting between you and almost everything you type, which can include passwords and other sensitive information.
Citizen Labâs 2024 research found vulnerabilities in several cloud-based keyboard apps that could expose usersâ keystrokes while they were being transmitted. The researchers examined nine keyboard vendors, including Baidu, Tencent, Samsung, and Xiaomi. Gboard was not part of the investigation.
The point is that typing itself is another source of information that can become sensitive depending on how a keyboard handles it.
And these are only some of the categories.
There are many other things as well, which can all reveal different pieces of your life. Put enough of those pieces together, and the puzzle becomes so much more detailed.
How This Data Makes Ads Feel Like Mind Reading
Letâs say you visit a sports store and look at running shoes. A few weeks later, you search for marathon training plans, follow some athletes and buy a pair of shoes online. A couple of months later, you start seeing ads for running gear.
This points to the fact that advertising systems can combine signals from different places to build a picture of what you might be interested in.
One way this happens is through real-time bidding, the system used to sell many online ads. When you load a website, information about your device and other signals can be included in an ad auction and sent to companies bidding for that ad space.
The FTC alleged that data broker âMobilewallaâ collected more than 500 million advertising identifiers linked to precise location data through real-time ad auctions and third-party aggregators between January 2018 and June 2020.
The Irish Council for Civil Liberties has also documented how real-time bidding can broadcast information such as location, browsing activity and tracking IDs to large numbers of advertising companies.
Ad systems can also connect devices that appear to belong to the same household. The FTC has described how matching IP addresses can allow an ad platform to infer that a device using the same network belongs to the same household.
That helps explain some of the situations where you mention something to a friend and then start seeing ads related to it. The system may already have signals connecting you, your friend, your devices, your location or your recent activity.
Who Has Access to This Data
So where does all this data go? It can pass through several different parts of the technology and advertising industry, and each one can have access to a different piece of the puzzle.
The Operating System Maker
Apple and Google sit at the operating-system level, so they can collect certain information about how your device and its services are used.
Apple says that, if you opt in to analytics, your iPhone can send Apple information about the device, its performance and how you use apps.
Android also has an optional Usage & Diagnostics setting that can send Google information such as battery levels, app usage and the quality of your mobile, Wi-Fi and Bluetooth connections.
My main point is that operating systems can control a major part of how apps access and share data.
App Developers
Every permission you give an app can give its developer access to another part of your phone.
Ever noticed that when you download a flashlight app, it suddenly asks for access to your services it doesnât even need? Most people probably hit Allow just to get past the setup screen.
That same Northeastern University study, I mentioned earlier, also found that many Android apps requested more media permissions than they needed. Around 9,000 had the technical ability to capture screen activity, although only a small number were found to transmit screenshots, with GoPuff among the examples
The study shows how excessive permissions can create opportunities for data collection, even when an app doesnât need that access to perform what itâs supposed to do.
Ad Networks
Ad networks connect advertisers with apps and websites that have space to show ads. Google AdMob and Meta Audience Network are two examples.
When an app integrates one of these networks, it can include the networkâs software development kit (SDK). This allows the network to serve ads inside the app and receive information from the app as part of that process.
Depending on the integration and permissions, this information can include many technical and other details about how people use the app. Ad networks can use these signals to build advertising profiles and decide which ads to show.