The Phone Isn't Listening

The question comes up whenever people find out what I do for a living, and it always arrives in the same lowered voice, the one reserved for saying something that sounds mad. The story has the same shape every time. We were talking about a holiday. Nobody looked anything up. An hour later, an advert for flights. So it is listening, isn't it?

For years I gave the technical answer, and for years it did not work. Part of that is the form of the thing: a technical answer to a question about being watched sounds like a brush-off, and people can hear when they are being managed. The rest of it is my fault. I was defending the position with arguments I had never sat down and checked. When I finally checked them, my favourite one fell apart in about ten minutes of arithmetic, and the best paper on the subject turned out to say something less comfortable than either side of this argument usually admits.

The conclusion survives. Your apps are almost certainly not recording your conversations to sell you things. But the reasons people like me give for that are mostly wrong, and what happens instead is worse than the thing you were worried about. And while I was checking all this, the frightening version came true in the one form nobody was watching for: not by sneaking past the permission, but by being handed it.

Seventeen thousand apps on a wiretap

The study everyone cites, including me, is called Panoptispy. A team from Northeastern University and UC Santa Barbara took 17,260 Android apps, analysed all of them statically, then picked the 9,100 likeliest suspects, the ones whose permissions and code suggested they could touch audio or video, installed those on real phones and drove them while capturing every packet that left the device through a VPN and a proxy that could open TLS connections, hunting for media leaving the phone.

They found none. Their words: "no apps appeared to exfiltrate audio in our tests."

What they found instead is the part nobody quotes. Twenty-one transmissions of media were caught, from twenty apps, twelve of which the authors judged leaks, nine going to third parties the user, in their words, "may not be aware of". The clearest case was a delivery app that recorded video of the user's own screen from the moment it opened and uploaded it to an analytics company, exposing the user's postcode. Screen recording on Android at the time required no permission at all and produced no indicator. While everybody argued about the microphone, the screen was being filmed from the inside, and nothing had to ask permission to do it.

Now the limits, because they matter more than the headline.

The study's threat model says, in plain words, "We do not examine media exfiltration from apps' background activity." The belief we are testing is a belief about background activity. The apps were driven by Android's Monkey tool, which fires 5,000 pseudo-random user events, ten screens with five hundred pokes each, for at most sixteen minutes per app, with no typed text and nobody logged in. No human being spoke a word during the experiment. And the limitations section concedes the loophole that matters most: an app could "transform an audio recording into a different format (e.g., a text transcript or musical features such as beat and notes) that our system does not detect."

That is not hypothetical. In the same paper the researchers watched two voice assistants do exactly that, transcribing speech on the phone and uploading only the text. A competent eavesdropper would never send audio. It would listen locally and send a word, and a few kilobytes of text an hour looks like any other telemetry.

The corpus was Android only, collected in 2017, and, as far as I can find, no comparable audio-and-video exfiltration study of iOS has been published in the eight years since. The work was funded by the US Department of Homeland Security, the National Science Foundation, a Comcast Innovation Fund grant, a Data Transparency Lab grant, and a Security, Privacy and Anti-Abuse award from Google. That last one does not make the negative result false, but you should hear it from me rather than find it yourself.

When two researchers at TU Berlin sat down in 2019 to review the whole question, their conclusion was not the one the popular debunkings imply. "We challenge the widespread assumption that the spying fears have already been disproved," they wrote. "While confirming a lack of empirical evidence, we cannot rule out the possibility of sophisticated large-scale eavesdropping attacks being successful and remaining undetected."

The most careful experiment we have looked hard, came up empty, and was clear about what it could not see. That is a real finding. It is not proof, and anyone who tells you it is has not read past the abstract.

The argument I gave up

Here is the one I used to reach for first, because it sounds unanswerable. Streaming audio all day would eat your data allowance and flatten your battery, so it cannot be happening.

I ran the numbers. Opus, the codec anything modern would use, supports "all bitrates from 6 kbit/s to 510 kbit/s", and the specification lists 16 to 20 kbit/s as the "sweet spot" for wideband speech. At the sweet spot, uploading a microphone feed twenty-four hours a day costs about 5 to 6.5 gigabytes a month, and at the codec's 6 kbit/s floor it is closer to 2. That is a heavy phone bill and an unremarkable one, and silence detection would cut it further. Only raw uncompressed audio gives you the absurd number, around 80 gigabytes a month, and nobody would ever send raw audio.

The battery half is worse for my case, because always-on listening is a shipped consumer feature, not a dark art. Apple has published how "Hey Siri" works: a small detector, five layers of thirty-two hidden units, runs continuously on a low-power coprocessor and only wakes the main chip when a score crosses a threshold. The Apple Watch shows the limit of the trick as much as its cheapness: there the detector runs only once the motion coprocessor notices you raising your wrist, and Apple puts its share at roughly five per cent of an already tight compute budget. Your phone listens constantly, all day, for one word, and you have never noticed the cost.

The impossibility argument is dead, then. Three better ones are still standing, and a fourth only becomes visible once you see what gets bought instead.

The first is that covert use of the microphone stopped being invisible, and the dates are worth knowing. Since iOS 14 in September 2020 an orange indicator appears whenever any app uses the microphone, drawn by the operating system in the status bar where no app can paint over it. Android 12, in October 2021, added the same indicators plus a Privacy Dashboard showing the last twenty-four hours of microphone, camera and location access, and a system-wide microphone switch. Flip that switch and, per Google's own documentation, apps do not get an error, they get silent audio, and motion sensors are rate-limited whether or not the app holds permission for them. That second detail closes a side channel the TU Berlin paper had flagged, where an accelerometer can be pushed into service as a crude microphone. Then in December 2021 iOS 15.2 added the App Privacy Report, which logs how many times and when each app touched the microphone over the past seven days, along with each app's network activity and the domains it contacted most often. If you have never switched it on, it is worth ten seconds of your evening.

None of that is airtight. An indicator only helps someone who is looking at the screen, it covers the standard interfaces and not every possible path, and commercial spyware has been documented suppressing it on iOS. But notice what it does close. The serious version of the fear, the one where a phone listens locally and ships a single word, still needs the microphone to open, and opening the microphone is the event the indicator shows and the audit log records. Whether what leaves the device afterwards is an audio file or one word makes no difference to that. A covert campaign at advertising scale would have to survive an indicator, a log, and years of both.

The second is the population of people trying to catch exactly this. AppCensus instruments the operating system and the network, and its co-founders' papers have twice won the CNIL-Inria privacy award. Lumen inspects app traffic on unrooted phones. Exodus Privacy pulls apart permissions and embedded trackers. Finding an ad network shipping ambient speech would make a career. Nobody has. That argument inherits Panoptispy's blind spot, since all of them look at traffic and manifests, and none would see a locally-derived keyword, which does not make the silence worthless.

The third is money. In the United States, intercepting a private conversation is a federal felony, and California's penal code sets the civil recovery at the greater of five thousand dollars per violation or three times actual damages, and says plainly that an action may be brought by a person who has sustained no actual damage. Multiply by a user base. That exposure stopped being theoretical in August 2025, when a San Francisco jury found Meta liable under that statute for eavesdropping under section 632 of the same code, the violation those damages attach to, for intercepting data from a period-tracking app. The verdict gets garbled in retelling, so the limits matter: no microphone was involved, the data was typed, the jury was not asked to set damages in that phase, the judge has since refused to disturb the verdict, and Meta says it will appeal. What it establishes is that the statute can be made to bite a company of that size at all.

Then there is the fourth reason, the one I now find hardest to argue with. They do not need speech. What they already buy is cheaper, legal and good enough, and that is the rest of this essay.

When it really was the microphone

The microphone has been switched on for money, in a mainstream app store, more than once. Each of these cases is narrower than the fear in a different way, and one of them is not narrow at all.

In December 2017 the New York Times described a company called Alphonso whose software sat inside more than two hundred and fifty games and used the phone's microphone to identify what was playing on your television, building a viewing profile that could be sold to advertisers. The company said it worked with the phone in a pocket. It matched audio fingerprints rather than transcribing speech, and it asked for the permission. Alphonso said the purpose was spelled out in the app descriptions, where, when it appeared at all, it sat behind the kind of link almost nobody opens.

Before that there was ultrasound. Researchers at TU Braunschweig scanned 1,320,822 Android apps and found 39 carrying SilverPush's listener code, which waits silently for inaudible high-frequency beacons, a technique for linking the same person across a phone, a browser and a shop. Working through a malware-scanning service as well, they had counted 234 such apps by January 2017. On 17 March 2016 the staff of the American regulator wrote warning letters to twelve app developers over it. The detail that got dropped from the coverage is the other half of the same paper: the researchers recorded television streams pulled over the internet from seven countries and found no ultrasonic beacons in any of them, while noting they could not rule out that beacons run elsewhere. The listeners had been deployed. The signal was not there.

Europe has one clean case. The official Spanish LaLiga app switched on the microphone to work out whether bars were showing pirated matches, and the Spanish regulator fined it €250,000 in 2019. Five years later the Spanish Supreme Court annulled the fine, not because it doubted the microphone use, but because the regulator had punished the company for failing a standard it only articulated during the case. So the one European app caught listening in your pocket ends with the watchdog being told off for overreach.

Then there are the assistants, where the recordings are real and so were the people listening to them. In July 2019 the Flemish broadcaster VRT obtained more than a thousand Google Assistant excerpts, of which, in the broadcaster's words, "153 of which were conversations that should never have been recorded": bedroom conversations, arguments, medical questions, addresses. Contractors were transcribing them for speech recognition. Amazon was running the same arrangement with thousands of workers. Apple eventually paid $95 million to settle claims about unintended Siri activations over a ten-year class period, with money reaching class members during 2026, while denying the allegations and stating that "Apple has never used Siri data to build marketing profiles, never made it available for advertising, and never sold it to anyone for any purpose." Google settled the equivalent Assistant case for $68 million in January 2026, with final approval still pending.

Covert microphone recording from a mainstream app store is not a thought experiment. A screen-recording app called iRecorder sat on Google Play for a year doing nothing wrong, then took an update in August 2022 that started capturing sixty seconds of microphone audio at intervals and shipping it out. More than fifty thousand people had installed it. ESET read it as part of an espionage campaign, without being able to say whose, and the app had a legitimate reason to hold the permission, which is why it went unnoticed for months.

None of that is an ad network mining your conversation, and all of it happened.

Somebody sold the rumour back to us

The strongest-looking proof arrived in December 2023, when 404 Media reported that Cox Media Group was marketing a product called Active Listening, built on the claim that smart devices "capture real-time intent data by listening to our conversations". The company's own marketing said: "It's True. Your Devices Are Listening to You." Eight months later the reporters obtained the pitch deck itself, which put a price on the thing, a hundred dollars a day for a ten-mile radius and two hundred for twenty, and named Facebook, Google, Amazon and Bing as partners.

The reaction was quick. Google removed the company from its partner programme, Amazon said it had never worked with them on it, Meta repeated its standing line that it "does not use your phone's microphone for ads and we've been public about this for years", and the pages came down. Headlines ran as vindication anyway, which is understandable when a marketing company has put the conspiracy in writing and attached a price to it.

In May 2026 the American regulator finished the story. Cox Media Group and two partner firms were required to pay $930,000 in redress to the advertisers they had sold to, because, the regulator alleged in its complaint, "smart devices with voice collection capabilities did not transmit voice data to Respondent's Active Listening service, and Respondent did not use 'AI to detect pertinent conversations.'" What they had actually been selling was email lists bought from other data brokers and resold at a significant markup. These are proposed consent orders and the company neither admits nor denies the allegations, and the finding covers one product, not the industry. Within those limits it is still the funniest fact in this whole subject: the single most cited proof that your phone listens was a firm being fined for pretending to listen.

The intent, though, is genuine, and the patent record is where you see it. Amazon holds a patent granted in 2014 describing a "sniffer" that monitors speech for trigger words, captures the audio around them, extracts keywords and passes them to advertisers. That is the feared mechanism, written down, with an inventor's name on it. Amazon kept the family alive through continuation after continuation, so it is no museum piece: the latest grant is dated 13 January 2026. Meta holds a granted patent, still active, for working out what a household watched by having an app record the room and then look for an inaudible high-frequency tone hidden at the start of the broadcast. The tone is the fingerprint rather than the trigger, and the purpose is checking whether you sat through the advert.

A patent is a claim on an idea, not a product, and large companies file defensively in enormous volume. The correction that matters here runs the other way. When Ford's in-car advertising application surfaced in 2024, proposing to gauge whether the occupants were mid-conversation before deciding how many adverts to show, the press reported it as a listening plan. The file records the application as abandoned in December 2025, after Ford stopped responding.

What they have instead of your voice

In December 2024 the American regulator brought a case against a company called Mobilewalla, and if you want one file to explain this essay, it is that one.

When an advert loads, your device's details go out to potential bidders in an auction. Mobilewalla was alleged to have collected data from those exchanges and from other aggregators, amassing more than 500 million unique advertising identifiers paired with precise location in two and a half years, and separately to have kept the personal data inside bid requests for auctions it did not win. From that it built an audience segment of pregnant women, identified from visits to pregnancy centres. In June 2020 it produced a report analysing people who had protested against George Floyd's death, working out their racial backgrounds and whether they lived in the cities where they marched.

Nobody heard a word. It was all footsteps.

Mobilewalla was not an outlier. A broker called X-Mode had, on the regulator's account, no policy at all for stripping sensitive places out of the raw location data it sold until May 2023, and provided one client a custom audience of people who had visited certain internal medical facilities in Columbus, Ohio. Nine days later the same regulator described InMarket maintaining nearly two thousand audience lists assembled from where people physically went, with categories including "parents of preschoolers", "Christian church goers" and "wealthy and not healthy". The longest-running of these cases, against Kochava, reached a proposed settlement in May 2026 over location data from hundreds of millions of devices, which becomes binding only once a judge signs it. Religion, family status and medical condition, inferred from movement, sold by the segment.

Location is the master key because movement is close to a fingerprint. In a study of 1.5 million people's mobile records, four randomly chosen points of time and place were enough to pick out 95 per cent of individuals uniquely, and two points still singled out more than half. That is cell-tower data from over a decade ago; satellite positioning would sharpen it, so treat 95 per cent as a floor.

The plumbing underneath is ordinary and everywhere. A scan of 959,426 free Android apps found the median app carrying code for ten distinct third-party tracker hosts, with 90 per cent carrying at least one. That is static analysis, so it shows tracker code present, not data actually sent, and the corpus is from 2017. The iPhone is not the exception people assume: a matched study of twelve thousand apps from each store found a median of three tracking libraries on both, and concluded that "neither platform is clearly better than the other for privacy across the dimensions we studied", with the caveat that the apps were collected just before Apple's tracking prompt arrived.

You can see your own share of it. When 709 volunteers downloaded their Facebook data and let researchers read it, Consumer Reports found that 186,892 different companies had sent Facebook information about them, an average of 2,230 companies per person, with a single data broker appearing in 96 per cent of the archives. Those volunteers were self-selected and probably more privacy-conscious than average, which cuts both ways.

The social graph does much of the work people attribute to microphones. Facebook's People You May Know has recommended a secret sperm donor to his biological child and a psychiatrist's patients to one another, built partly from contact books uploaded by other people who had your number.

The predictive ceiling was mapped before any of this became a panic. In 2013, from Facebook Likes alone, a model separated gay from straight men with an area under the curve of 0.88 and Democrats from Republicans at 0.85. That statistic is routinely mangled, so: 0.88 is the probability the model ranks a randomly chosen gay man above a randomly chosen straight man, which is not the same as being right 88 per cent of the time.

Which brings me to the part that spoils the horror story, and belongs here anyway. A lot of this dossier is junk. A field study of more than ninety brokered audiences from nineteen data brokers found that buying a segment improved your odds of reaching a person with the desired single attribute by somewhere between 0 and 77 per cent compared with picking at random. Zero, at the bottom end. And the founding parable of the whole genre, the American retailer that supposedly worked out a teenager was pregnant before her father did, was never substantiated.

That combination is the actual explanation of your holiday advert. A machine this large, guessing this often, with this much of your movement and your contacts and your purchases, will produce a hit that lands like a wiretap. It does not need to be good. It needs to be constant.

Two things about where this stands in 2026. The fix everyone was promised is gone: Google decided in April 2025 to keep third-party cookies in Chrome, then in October 2025 retired the ad-targeting and measurement core of the replacement it had spent five years building, eleven technologies including Topics, Protected Audience and the Attribution Reporting API, citing low adoption. And the dossier cannot be switched off by one person from a settings screen. California needed a statute in 2023, a state-built platform that opened to residents in January 2026, and a compliance deadline of 1 August 2026 before a single deletion request could reach the five hundred-plus brokers registered there. Europeans have a stronger right on paper and a harder job using it: erasure runs controller by controller, the Court of Justice had to rule in 2023 that a company must name the actual companies it sent your data to rather than describing them as advertising partners, and noyb's complaint points at one major ad-tech firm's own published figure, a zero per cent response rate to access and erasure requests in 2022.

The microphone got a toggle, an indicator light and a seven-day audit log, while the thing that actually profiles you got a cancelled reform.

Why a microphone is the easier story

The arithmetic of the anecdote starts with a number you have certainly seen and should throw out. The claim that we see five or ten thousand adverts a day is not real. The advertising industry's own American association called it unsubstantiated in 2007, noting that "the citations never get more specific than 'experts agree'", and the author of the book that popularised it says he never meant to endorse a figure. When researchers had people count, they got 76 exposures a day in 1968 and 98.5 when the method was repeated in 2007.

A commercial media firm's more recent estimate, which is a model rather than a measurement, puts adults at roughly 360 exposures a day, of which about 150 are noted at all. Take the cautious end of any of those and you are still passing several thousand adverts a month that mean nothing to you and leave no trace. One of them lands on a conversation you had an hour ago, and it is the only one you will ever be able to recall.

Most people, asked carefully, already have the right answer available. In a YouGov survey two-thirds of Britons had noticed an advert following a conversation, and when asked why, more of them blamed their browsing history and personal data, at 39 per cent, than blamed the device listening, at 22. The microphone theory is the loud answer, not the most common one. It is also widespread enough to matter: in a Consumer Reports survey of 1,006 American adults back in 2019, 43 per cent of smartphone owners believed their phone recorded conversations without permission.

So why does the microphone win, when the correct answer is available and better documented?

Partly because an agent with an intention is easier to think with than a statistical process. Someone listening has a who and a why and a place to be angry at. A bid request has none of those. There is a nice demonstration of how shallow that preference is: hurry people through the task and they endorse nearly half of a set of scientifically unwarranted purpose-based explanations of natural events, 47 per cent under the tightest time limit against 29 per cent with no limit at all (Kelemen and Rosset, Cognition, 2009), because the intentional story is the one that arrives first.

And partly because the microphone theory is the consoling version. A microphone can be covered with tape. It has a permission you can revoke, a switch in the settings, a light that comes on. If the microphone is the culprit, the problem has an off position and you are in charge of it. The dossier has no off position, which is why the accurate explanation lands like a dodge. When I tell someone their phone is not listening, they hear me saying nothing is wrong. What I mean is that the thing that is wrong cannot be fixed by them alone, and 73 per cent of Americans telling Pew they have little or no control over what companies collect about them are not being paranoid, but describing the arrangement accurately.

One last thing, which is uncomfortable in a different way. Quite often you did look it up. Or the person sitting next to you did, on the same network, while you were talking. Or you walked past the shop. The order of events in a story you tell an hour later is the sort of detail that gets rebuilt rather than replayed, which I have written about elsewhere and which applies to me as much as anyone.

Watched from two directions

For readers who spent part of their lives in the Soviet Union, or grew up around people who did, the instinct that someone is paying attention is not a defect to be argued out of; it was accurate for most of a lifetime. What goes wrong is that two very different machines get collapsed into one, and the confusion costs you something real.

The first machine is state interception. In Russia, SORM equipment sits on the operator's own network by legal mandate, documented by Privacy International as early as 2013 and extended since, with the security service holding access and the operator not shown the warrant. It is aimed at named individuals, and the things attached to it are courts and prisons.

The second is commercial inference, aimed at populations and sold by the segment. Yandex's own advertiser documentation describes Crypta inferring your age, income, interests and even which district of the city you live in from around three hundred behavioural signals: the words you use in searches, the sites you visit, the times of day you are active. Audio is not in the list, and nothing in that system needs to hear you.

The two are not the same actor and do not answer to the same things. Treating them as one leads people to tape over a camera while consenting to the dossier, and to assume the commercial machine is as immovable as the state one, when the commercial machine is the one that answers to regulators and courts, and occasionally to a settings screen.

The story also travels worse in Russian. When the Cox Media Group deck leaked, one Russian technology outlet ran it under the headline "Instagram listens to all users through the microphone", describing a reseller's sales pitch as an admission by one of Meta's main advertising partners. Twenty months before the regulator alleged that the product had never touched voice data at all. There are competent Russian-language debunkings, including a good one at RBC, and they are outnumbered, which is the same asymmetry I ran into when I tested what chatbots return in one language against the other.

Estonia, where I live, happens to offer the exact mirror image of ad tech. Log in to the state portal and Andmejälgija shows you which institutions have queried your data and why. Its limits are narrow: it covers state registries, connected one at a time, not all at once, and it knows nothing about your bank, your shops, your platforms or any ad network. Which is the comparison I keep returning to: the state people flinch from built its citizens an access log, and no commercial system that knows more about your week than any registry does has ever been asked for one.

It asked, and we said yes

On 1 October 2025, Meta announced that from 16 December your conversations with its AI would start feeding the content and adverts you are shown. The company's wording leaves nothing to interpret: "Whether it's a voice chat or a text exchange with our AI features, this update will help us improve the recommendations we provide for people across our platforms." More than a billion people use Meta AI in a given month, and if you use it, there is no opt-out from the advertising use.

The same announcement contains the narrowest and most checkable microphone denial the company has ever issued: "We don't use your microphone unless you've given us permission and are actively using a feature that requires the microphone."

Both sentences are true at the same time, and holding them together is the whole point. This is voice you deliberately spoke into an assistant, with the indicator light on, under a policy published in advance. It is not covert eavesdropping and my argument survives it. What changed in December 2025 is worth naming precisely, because microphone audio had fed advertising before, as Alphonso did with the television in the room. What it had not done was carry the content of your own speech, at the scale of a billion users, with the company announcing it beforehand. Anyone still flatly asserting in 2026 that your voice plays no part in advertising is a year behind. Meta's own post says only that the change is rolling out in "most regions". The widely repeated claim that the European Union, the United Kingdom and South Korea were carved out comes from press reporting, not from Meta.

The direction of travel is consistent. In March 2025 Amazon removed the setting that let three Echo models keep voice processing on the device, because the generative features need the cloud. An academic audit had already found that Amazon processes what people say to Alexa to infer their interests and target advertising both on and off the device, with smart-speaker interaction drawing as much as thirty times higher bids from advertisers. Amazon's answer to that paper was that its conclusions rest on inaccurate inferences, that it is not in the business of selling data, and that it does not share Alexa requests with advertising networks.

In September 2025 an app called Neon paid people to record their own phone calls, thirty cents a minute for calls to other users of the app and up to thirty dollars a day for calls to anyone, then licensed the audio to AI companies. It reached number two in the social category of the American App Store. No deception was required, only a price, and people took it.

For ten years the fear was that something would sneak in through the microphone while we slept. What arrived instead walked up to the front door, explained itself in a blog post, and was let in by a billion people who had other things on their minds. The microphone was never the weak point in this system. The weak point is the sentence nobody reads and the box everybody ticks, and that has the great disadvantage of being our half of the arrangement.

The question worth asking is not whether your phone is listening. It is what you have already agreed to, and how much of that you could reconstruct if you went looking. I did go looking, on my own phone: the seven-day microphone log, my ad-preference pages, the list of businesses that had uploaded me without asking, the broker registry in the one jurisdiction that publishes one. It took an afternoon and no skill at all, only the willingness to keep clicking after the interesting part was over. I do this for a living.