What actually happens when you let apps track your activity?

Anna Barclay/Getty Images

No, your phone isn't listening to you without your permission. The idea that it might be is a shockingly difficult myth to dispel, given the fact that the alternative would seem to be that your phone is reading your mind. How else can you explain the ads you're seeing for that thing you never looked up online but did mention offhand to your coworker?

In fact, mind-reading is closer to what's actually happening. Your phone might not be listening to your voice nonconsensually, but speech isn't the only way you communicate your thoughts and desires. Over many years, the tech industry has built a staggeringly sophisticated mechanism that captures those nonverbal signals and converts them into ungodly amounts of profit. How fast are you scrolling on this page as you read? To which Wi-Fi or cellular network are you connected while you read? Did you find this article from a Google search, or was it shared by a friend on social media? All of these signals build a much more robust profile of who you are and, more importantly, which products and services you're likely to be tempted by than any amount of secret recording ever could.

So, what's actually happening when you do allow apps to track your activity, and what can you do to thwart their efforts? It's a complex question, and the answer differs depending on which specific activity type we're talking about. Breaking down the different permissions apps request to track you and how you manage those permissions on your device can help to simplify the issue.

Max Miller for Engadget

Vampires are famously incapable of entering a private space without invitation. Data-collecting apps are far less polite  — on the plus side, they drink your personal data rather than your blood, but on the other hand, they don't like to take no for an answer and are much less likely to look like Robert Pattinson. So, how do you tell Google and Meta, and other data-hungry companies, not to make themselves at home on your devices? The most effective (though far from only) solution is to block device-level tracking.

Every device you own, from your phone to your laptop, has some kind of unique identifier that data harvesters can tie to your advertising profile. This allows them to aggregate the data collected across multiple apps on your device. Both Android and iOS use identifiers to track ad performance and user behavior across a given device. The difference is that you're opted in by default on Android, whereas iOS uses Apple's App Tracking Transparency (ATT) framework under which apps must ask you before accessing that ID.

Most people are at least vaguely aware that their activity is being tracked, even if they can't name all of the various signals they're giving off. Most people also don't like being tracked in this manner, even if they cannot articulate the specific consequences. To substantiate that claim, look no further than Meta's admission in 2022 that it incurred a $10 billion loss after Apple implemented an ATT pop-up that gave iPhone owners the option to opt out of device activity tracking when an app is launched. Unsurprisingly, the vast majority of iPhone users chose to slap Mark Zuckerberg's hand away from their digital cookie jars.

On Android, you'll need to go to the Google section of your settings app, then tap on Ads and delete your advertising ID. The good news is you only have to do this once, as the ID will not be replaced without further action on your part. iOS will not actually allow you to delete the equivalent ID from your iPhone or iPad, but you can lock it down by going to the Privacy and Security section of the Settings app, tapping Tracking, and turning off the Allow Apps to Request to Track toggle, then turning off Personalized Ads from the Apple Advertising section of the Privacy and Security page.

Max Miller for Engadget

While tracking permissions link activity to your specific device, sensor permissions provide data from your device's onboard sensors, such as the GPS, camera or microphone. These are thorny permissions. Plenty of apps need them for legitimate reasons, but that's no guarantee they aren't using the collected data in other ways. Google Maps won't be much use without access to your location, but Google is also using that data to "show you more relevant ads" per its policy documentation. And although Instagram needs camera access before you can use it to snap a photo for your Story, it is also scanning objects, faces and text in those photos to (take a wild guess) show you more targeted ads.

But some apps are using your data in shadier ways than others. That random weather app might genuinely need your location to let you know the weather as you travel (you can just give it your zip code to get more generalized weather at your location), but its real business may not be delivering the forecast. Instead, it might be selling user location data to as many brokers as possible. What happens to that data is far beyond your control. For example, law enforcement in states where abortion is now illegal after the fall of Roe v Wade can acquire cell phone tracking data to prosecute pregnant people who traveled across state lines seeking reproductive care or otherwise sought an abortion. In one case, a Mississippi woman who suffered a stillbirth was charged with murder because she had searched for abortion pills online (charges were later dropped), and an Indiana woman whose text messages discussed the possibility of abortion were used as evidence of feticide after a miscarriage. She was sentenced to 20 years in prison.

Again, your phone isn't passively using these permissions to spy on you, but that doesn't mean your apps won't happily gorge themselves on the data you willingly create by using your microphone, camera, and other sensors while using the app. Modern versions of mobile operating systems will even show you when your microphone and camera are being used. On Android, you'll see a small green dot in your status bar when either the mic or camera is in use (for example, during a phone call or while shooting video in Snapchat), while on iOS, the indicator dot is green when the camera is in use and orange when only the microphone is hot.

Unfortunately, location can't be reduced to a single sensor. Your whereabouts can be triangulated based on a number of signals  — nearby Wi-Fi networks, cell towers and even Bluetooth devices can be almost as effective as a GPS signal. In 2022, Meta settled for $37.5 million with no admission of fault after a class action lawsuit was filed on behalf of 70 million users who claimed the company's apps tracked their locations even with location permission disabled.

Yarrrrrbright/Shutterstock

Now we come to the more esoteric forms of data tracking  — those so invisible to us that some people choose to believe their phone is recording them rather than to accept how granular the real tracking has become. There are too many to cover here, so to take one example, you might know that your phone has an accelerometer. That's the sensor that tells it whether you're holding it in portrait or landscape, or lets you control cars in racing games by tilting the phone back and forth. But no accelerometer is calibrated with 100% precision, and years of research have shown that these small discrepancies could be used to infer a number of things about a device and its user, including demographics, behavior and activity, and even mood. In one study, Gait detection was found to be possible using those same sensors, so the unique way you walk with your phone in a bag or pocket may be used to track you.

All of this is on top of standard device fingerprinting, which nearly all major apps and websites make use of. The unique combination of hardware that comprises your device, in combination with your software state, is a remarkably reliable tracking metric.

I'm writing this article in Google Docs, which means my typing tics could be tracked (though it's unclear whether this sort of data is actually collected; Google's privacy policy for Docs notes that "performance data" is collected, but does not give further specifics). How quickly I type, how often I make mistakes, the hesitancy before I choose a particular verb or noun and other such personal behaviors can not only identify me; they can also tell Google about my state of mind. Am I typing hurriedly or leisurely? Angrily pounding away at my keyboard or thoughtfully constructing a turn of phrase? These factors may determine what I see the next time I open an app or website.

Unfortunately, there's not much you can do to prevent this sort of tracking because it doesn't rely on any device permissions. Getting rid of advertising ID-based device tracking can help, but these kinds of heuristics-based tracking techniques can help to create a profile on you that may exist independently. To reduce their efficacy, you can do things like use a VPN, configure private DNS with built-in blocklists, browse the web through privacy-focused browsers, install ad blockers and so on. To be clear, you should probably do all of those things, but you shouldn't expect them to fully anonymize you when interacting with apps.

Max Miller for Engadget

With all this talk of targeted advertising, some argue that privacy advocates are tilting at windmills. After all, they ask, what's so bad about more relevant ads? If I have to see ads online regardless, isn't it better for them to show me things I might actually want? While that's an understandable line of thought, the dangers are more to do with what happens when your data is combined from multiple sources and used in combination with data from billions of other people. These knock-on effects extend beyond any individual.

Targeted ads aren't about helpfully homing in on your general needs and desires. They're just as often about manipulating your emotions or behaviors. If the data collected from you shows that you're more likely to make a big purchase when you're sad or angry, then getting you into that agitated state becomes a desirable goal.

In aggregate, data collected from billions of devices can enable society-wide changes. By now, the average person is likely familiar with some of the ways big data has been used to influence politics in the US and around the world, with the most notable such example being the Cambridge Analytica scandal in which the eponymous data firm used data collected from millions of users to sway the 2016 US presidential election. That data was collected by convincing users to give a survey platform access to their own profiles and those of their friends.

Beyond all of that, there's just no upside to having your name, home address, email and other identifying information available for purchase. It's not only advertisers who want that information. From stalkers to hackers to law enforcement, you can't control who the buyer will be. 

As mentioned, law enforcement has used location data from brokers to prosecute people for exercising their reproductive rights. Under the direction of Kash Patel, the FBI has been purchasing user data en masse from commercial brokers. Speaking of abortion, activists were found in 2024 to have purchased data on users who visited Planned Parenthood locations in order to target them with abortion misinformation. These are but a couple of the countless ways your data can be used against you.

Ultimately, the best advice is to resist giving your data to apps. Even if you can't prevent apps from tracking you entirely, you can make it much more difficult. Routine privacy checkups are also a good idea  — go through your app permissions once in a while and see which can be revoked. If you must give an app permissions in order for it to function, ask yourself whether your life would be significantly harder without that app. And, in general, you should delete any app you do not use, as you never know which of them may be silently collecting data.