What actually happens when you let apps track your activity?

What actually happens when you let apps track your activity? And does it even matter? No, your phone isn't listening to you without your permission. The idea that it might be is a shockingly difficult myth to dispel, given the fact that the alternative would seem to be that your phone is reading your mind. How else can you explain the ads you're seeing for that thing you never looked up online but did mention offhand to your coworker? In fact, mind-reading is closer to what's actually happening. Your phone might not be listening to your voice nonconsensually, but speech isn't the only way you communicate your thoughts and desires. Over many years, the tech industry has built a staggeringly sophisticated mechanism that captures those nonverbal signals and converts them into ungodly amounts of profit. How fast are you scrolling on this page as you read? To which Wi-Fi or cellular network are you connected while you read? Did you find this article from a Google search, or was it shared by a friend on social media? All of these signals build a much more robust profile of who you are and, more importantly, which products and services you're likely to be tempted by than any amount of secret recording ever could. So, what's actually happening when you do allow apps to track your activity, and what can you do to thwart their efforts? It's a complex question, and the answer differs depending on which specific activity type we're talking about. Breaking down the different permissions apps request to track you and how you manage those permissions on your device can help to simplify the issue. Device-level identifiers and tracking Vampires are famously incapable of entering a private space without invitation. Data-collecting apps are far less polite - on the plus side, they drink your personal data rather than your blood, but on the other hand, they don't like to take no for an answer and are much less likely to look like Robert Pattinson. So, how do you tell Google and Meta, and other data-hungry companies, not to make themselves at home on your devices? The most effective (though far from only) solution is to block device-level tracking. Every device you own, from your phone to your laptop, has some kind of unique identifier that data harvesters can tie to your advertising profile. This allows them to aggregate the data collected across multiple apps on your device. Both Android and iOS use identifiers to track ad performance and user behavior across a given device. The difference is that you're opted in by default on Android, whereas iOS uses Apple's App Tracking Transparency (ATT) framework under which apps must ask you before accessing that ID. Most people are at least vaguely aware that their activity is being tracked, even if they can't name all of the various signals they're giving off. Most people also don't like being tracked in this manner, even if they cannot articulate the specific consequences. To substantiate that claim, look no further than Meta's admission in 2022 that it incurred a $10 billion loss after Apple implemented an ATT pop-up that gave iPhone owners the option to opt out of device activity tracking when an app is launched. Unsurprisingly, the vast majority of iPhone users chose to slap Mark Zuckerberg's hand away from their digital cookie jars. On Android, you'll need to go to the Google section of your settings app, then tap on Ads and delete your advertising ID. The good news is you only have to do this once, as the ID will not be replaced without further action on your part. iOS will not actually allow you to delete the equivalent ID from your iPhone or iPad, but you can lock it down by going to the Privacy and Security section of the Settings app, tapping Tracking, and turning off the Allow Apps to Request to Track toggle, then turning off Personalized Ads from the Apple Advertising section of the Privacy and Security page. Device sensor permissions While tracking permissions link activity to your specific device, sensor permissions provide data from your device's onboard sensors, such as the GPS, camera or microphone. These are thorny permissions. Plenty of apps need them for legitimate reasons, but that's no guarantee they aren't using the collected data in other ways. Google Maps won't be much use without access to your location, but Google is also using that data to "show you more relevant ads" per its policy documentation. And although Instagram needs camera access before you can use it to snap a photo for your Story, it is also scanning objects, faces and text in those photos to (take a wild guess) show you more targeted ads. But some apps are using your data in shadier ways than others. That random weather app might genuinely need your location to let you know the weather as you travel (you can just give it your zip code to get more generalized weather at your location), but its real business may not be delivering the forecast. Instead, it might be selling user location data to as many brokers as possible. What happens to that data is far beyond your control. For example, law enforcement in states where abortion is now illegal after the fall of Roe v Wade can acquire cell phone tracking data to prosecute pregnant people who traveled across state lines seeking reproductive care or otherwise sought an abortion. In one case, a Mississippi woman who suffered a stillbirth was charged with murder because she had searched for abortion pills online (charges were later dropped), and an Indiana woman whose text messages discussed the possibility of abortion were used as evidence of feticide after a miscarriage. She was sentenced to 20 years in prison. Again, your phone isn't passively using these permissions to spy on you, but that doesn't mean your apps won't happily gorge themselves on the data you willingly create by using your microphone, camera, and other sensors while using the app. Modern versions of mobile operating systems will even show you when your microphone and camera are being used. On Android, you'll see a small green dot in your status bar when either the mic or camera is in use (for example, during a phone call or while shooting video in Snapchat), while on iOS, the indicator dot is green when the camera is in use and orange when only the microphone is hot. Unfortunately, location can't be reduced to a single sensor. Your whereabouts can be triangulated based on a number of signals - nearby Wi-Fi networks, cell towers and even Bluetooth devices can be almost as effective as a GPS signal. In 2022, Meta settled for $37.5 million with no admission of fault after a class action lawsuit was filed on behalf of 70 million users who claimed the company's apps tracked their locations even with location permission disabled. Heuristic tracking is very cool, very creepy Now we come to the more esoteric forms of data tracking - those so invisible to us that some people choose to believe their phone is recording them rather than to accept how granular the real tracking has become. There are too many to cover here, so to take one example, you might know that your phone has an accelerometer. That's the sensor that tells it whether you're holding it in portrait or landscape, or lets you control cars in racing games by tilting the phone back and forth. But no accelerometer is calibrated with 100% precision, and years of research have shown that these small discrepancies could be used to infer a number of things about a device and its user, including demographics, behavior and activity, and even mood. In one study, Gait detection was found to be possible using those same sensors, so the unique way you walk with your phone in a bag or pocket may be used to track you. All of this is on top of standard device fingerprinting, which nearly all major apps and websites make use of. The unique combination of hardware that comprises your device, in combination with your software state, is a remarkably reliable tracking metric. I'm writing this article in Google Docs, which means my typing tics could be tracked (though it's unclear whether this sort of data is actually collected; Google's privacy policy for Docs notes that "performance data" is collected, but does not give further specifics). How quickly I type, how often I make mistakes, the hesitancy before I choose a particular verb or noun and other such personal behaviors can not only identify me; they can also tell Google about my state of mind. Am I typing hurriedly or leisurely? Angrily pounding away at my keyboard or thoughtfully constructing a turn of phrase? These factors may determine what I see the next time I open an app or website. Unfortunately, there's not much you can do to prevent this sort of tracking because it doesn't rely on any device permissions. Getting rid of advertising ID-based device tracking can help, but these kinds of heuristics-based tracking techniques can help to create a profile on you that may exist independently. To reduce their efficacy, you can do things like use a VPN, configure private DNS with built-in blocklists, browse the web through privacy-focused browsers, install ad blockers and so on. To be clear, you should probably do all of those things, but you shouldn't expect them to fully anonymize you when interacting with apps. What's wrong with more personalized ads? With all this talk of targeted advertising, some argue that privacy advocates are tilting at windmills. After all, they ask, what's so bad about more relevant ads? If I have to see ads online regardless, isn't it better for them to show me things I might actually want? While that's an understandable line of thought, the dangers are more to do with what happens when your data is combined from multiple sources and used in combination with data from billions of other people. These knock-on effects extend beyond any individual. Targeted ads aren't about helpfully homing in on your general needs and desires. They're just as often about manipulating yo