How Safe Is Your Phone?

Jump to Examples

Most of us carry a computer with a microphone, two or more cameras, a GPS receiver, motion sensors and a permanent network connection in a pocket, and we have installed dozens of programs on it that were written by strangers. At least once everyone has had the same experience: you talk about something (or just look at it), and a few minutes later an advertisement for exactly that appears on Facebook, Instagram or YouTube. The natural conclusion is that "the phone is listening". This article tries to separate what is technically possible, what is documented, and what is probably happening instead – and ends with concrete steps for iPhone, Android and GrapheneOS. The television, the speaker, the watch, the camera over the door and the car have their own article.

A Bit of History of Collecting Data About People

Before the smartphone, the collecting happened in the browser. In 1994 Lou Montulli at Netscape invented the cookie – a small piece of text that a website stores in your browser so that it can recognise you next time (originally for shopping carts). The advertising industry quickly discovered that a cookie set by an advertising company, embedded on many different websites, can follow the same person across all of them. DoubleClick (founded in the mid-1990s) built a business on that, and in 2000 a plan to link its browsing data to real names caused one of the first big privacy storms. Google bought DoubleClick in 2007–2008. Facebook (2004) added something new: users themselves entered their names, birthdays, friends, interests and photos. In 2007 its Beacon programme reported purchases made on other websites to the friends of a customer; it was shut down after protests and a lawsuit, but the idea of connecting activity outside Facebook to a Facebook profile stayed.

The iPhone (2007), the App Store (2008) and Android (2008) changed the picture. Phones know where you are, they are almost always switched on, they belong to one person, and cookies do not work well inside apps. The industry replaced them with identifiers: first the hardware ID of the device (Apple's UDID was phased out in 2012–2013), then a resettable advertising ID – the IDFA on iOS (2012) and the Advertising ID on Android (2013). Apps also started to include SDKs – ready-made code libraries from advertising, analytics and social networks (for example the Facebook SDK and Google's analytics) – so that a developer who wants a login button or crash reports gets a data-collecting component from a third party with it. Many developers do not even know exactly what such a component sends. In 2014 documents published by Edward Snowden showed that intelligence services were happy to use exactly this stream of data from "leaky" apps.

2018 was the turning point in public awareness. In March the Cambridge Analytica story showed that data of tens of millions of Facebook users had been harvested through a quiz app and used for political profiling (in 2019 the US Federal Trade Commission fined Facebook 5 billion dollars), and in May the European GDPR began to apply, with the principle that personal data may be processed only with a legal basis and that people have the right to see, correct and delete it. In the same year researchers at Northeastern University tested more than 17,000 popular Android apps for the microphone rumour and found no case of an app secretly switching it on – but they did find apps that recorded the screen and sent it to a third-party analytics company. After that the platforms started to compete on privacy features. Apple introduced orange and green recording indicators in iOS 14 (2020), "privacy nutrition labels" in the App Store (December 2020) and App Tracking Transparency (April 2021), which forces apps to ask before they use the advertising ID – most people say no, and Meta estimated that this would cost it about 10 billion dollars of revenue in 2022. Android 12 (2021) brought the Privacy dashboard, indicators for the camera and microphone and system-wide switches to turn them off; Google Play later added a "Data safety" section (2022). In 2021 Project Pegasus showed the other side: commercial spyware from NSO Group, installed without a single click, was used against journalists, lawyers and politicians. Apple answered with Lockdown Mode (2022).

The 2020s are a mixture of regulation, lawsuits and new data sources. The European Digital Markets Act and Digital Services Act started to apply to the big platforms, and in 2025 the European Commission fined both Apple and Meta under the DMA (in Meta's case over its "pay or consent" model for ads; the press reported nearly 800 million dollars in total). In the United States, voice-assistant cases ended in settlements, both without admitting wrongdoing: Apple's 95 million dollars over Siri (payments started in early 2026, up to 20 dollars per device) and Google's 68 million dollars over Google Assistant (preliminary settlement January 2026; a final approval was reported on 13 October 2026). On 16 December 2025 Meta started to use people's conversations with its AI assistant as a signal for ads and content in most countries – initially not in the European Union, the United Kingdom and South Korea – the same week in which the head of Instagram published a video saying, once again, that Instagram does not listen through the microphone. On 30 September 2026 Google's developer-verification rules for sideloaded Android apps start to apply in the first four countries. At the same time, the first phone maker (Motorola, March 2026) announced a partnership with the hardened open-source system GrapheneOS.

A short timeline:

Some resources for history:

• HTTP cookie (Wikipedia)
• Facebook–Cambridge Analytica data scandal (Wikipedia)
• Identifier for Advertisers (Wikipedia)
• GDPR – full text
• EFF – Surveillance Self-Defense
• Computer History Museum

How Apps Get to Know You

"The app collects data" is not one thing. The information that ends up in an advertising profile comes from several different streams, and only a small part of it needs a permission pop-up.

What is collected and how (my own overview, not a complete list):

Everything is then combined. The crucial step is the one that is rarely visible: companies do not only target people by what they know about you, but also by what they know about people like you ("lookalike audiences"), and by what an advertiser tells them (for example, a list of its customers' e-mail addresses). The advertiser pays for a result – a click, an installation, a purchase – and the system learns which kinds of people produce it.

Why Does Facebook Show Ads for Things I Only Looked At?

Because that is how it works, and no microphone is needed. Roughly, the chain looks like this:

1. You visit a web shop (or an app) that uses a Meta Pixel or the Meta SDK. It tells Meta: "this user viewed these shoes". If you are logged in to Facebook in the same browser or phone, Meta can attach the event to your account; if not, the shop may send a hashed e-mail address or phone number you typed in earlier, or other signals, so the match is made anyway.
2. The shop (the advertiser) creates a retargeting campaign: "show an advertisement to everyone who viewed this product but did not buy it". You get exactly the shoes, within minutes or hours.
3. Even if you never visited the shop, the system can reach you through someone similar: people in your area, of your age and interests, or with a connection to you (the same household, the same Wi-Fi, a recent conversation in a messaging app) who looked at that product. "People like you" ads are why a conversation with a friend about a trip and the ads for hotels appear to be connected.
4. The last part is human. We notice the ad that matches the conversation and do not notice hundreds of the ones that did not. This is the frequency illusion (also called the Baader–Meinhof phenomenon) combined with confirmation bias. Also, the thing you are talking about with a friend is often something you or they searched for or saw earlier – that is why you are talking about it.

The head of Instagram, Adam Mosseri, said in a video in October 2025 that Instagram does not use the microphone and gave nearly the same reasons: ad systems use the behaviour of friends and similar people, and listening would drain the battery and show the microphone indicator. Meta had published a similar statement already in a 2016 blog post. A company statement is not proof, of course, but the argument about the indicator and the battery can be tested – and independent researchers have tested it (see the next section). It is worth noticing, however, that the "no microphone" answer is somewhat beside the point: if what you type, watch and chat about with an AI assistant becomes an input for ads (as Meta announced for its AI products), the system will know what you are interested in without hearing you.

Can a Phone Listen or Watch Without Us Knowing?

The honest answer has four levels: what the system itself does, what ordinary apps can do, what a marketing company claims, and what a compromised phone can do.

1. The system listens for a wake word – on purpose. "Hey Siri", "Hey Google" and similar functions need the microphone to be "on" all the time, but the audio is analysed locally by a small model that only reacts to the wake phrase, and only after it triggers does the audio go to the server. The weak point is false accepts: the assistant thinks it heard the phrase, starts to record and sends the recording. That is exactly what the lawsuits were about – plaintiffs said they had received ads after such unintended recordings, and both Apple and Google settled while denying wrongdoing (Apple has also said that it does not keep Siri audio unless the user opts in to improve Siri). You can turn the wake word off, and you should if you do not use it.

2. Ordinary apps: possible only within the rules of the system. To use the microphone or the camera an app needs your permission, and the system has to show an indicator – an orange dot (microphone) and a green dot (camera) on the iPhone, and a small icon in the status bar on Android 12 and later. Recent versions of both systems also limit what an app can do in the background and list in a dashboard which app used what, and when (Android's Privacy dashboard shows access to the camera, microphone and location for up to the last 7 days on recent versions; iOS has the App Privacy Report). Researchers have been looking for apps that record secretly: the Northeastern study found no app that activated the microphone, and later analyses have not changed that picture in public. What has been found is that apps with permission for the microphone or camera can record when you do not expect it (for instance while the app is open but you think you are not using it), that some apps leaked the clipboard (when iOS 14 started to show the "pasted from" banner, many popular apps were caught reading what was copied), and that analytics libraries recorded screens.

3. The leaked "Active Listening" pitch. In 2023–2024 the news site 404 Media published a sales presentation of the American media company Cox Media Group, which claimed that its "Active Listening" software listens to conversations through phones and smart devices and pairs the voice data with behavioural data, and listed Facebook, Google and Amazon among its clients. After the report, Google removed CMG from its partner programme, Meta said it was reviewing CMG and denied using the microphone for ads, and Amazon said it had never worked with CMG on that programme. The deck did not explain how the data would be obtained, and nobody has publicly shown a working system. The honest summary: this is a claim by a marketing company, not a verified technique – but it shows that someone considers the story valuable enough to sell.

4. A compromised phone is a different story. If malware or stalkerware is installed (for example by a partner or a colleague who had access to the phone, or by a fake app), it can record the microphone, camera, messages and location. Android banking trojans abuse the accessibility services to read the screen and press buttons. Commercial spyware such as Pegasus can break into a fully updated phone with no click, but it costs a lot and is used against a small number of targeted people – journalists, activists, lawyers, politicians, businesspeople – not at random. There are also academic "side channel" attacks, such as recovering speech from the motion sensors (Gyrophone, 2014), and ultrasonic beacons that pair a TV advertisement with a phone (the FTC warned the makers of such apps in 2016) – they are interesting, but they are not what most people's ads are based on.

Proven, claimed and folklore (my own assessment, based on public information):

Why does the difference matter? If we believe the wrong explanation we protect the wrong thing. Switching off the microphone does not stop retargeting; blocking trackers and limiting what you give to the apps does.

Some resources for this part:

• 404 Media – the reports on Cox Media Group's "Active Listening"
• Northeastern University – Is your smartphone spying on you?
• Gyrophone – Stanford research
• Coalition Against Stalkerware

What About the Other Devices?

The phone is the device we think about most, but not the one that collects the most carelessly. The television that identifies what is on the screen, the speaker with a wake word, the camera over the door, the watch, the robot vacuum and the car use the same logic – more data, more services, fewer choices – and usually with weaker controls: no permission pop-ups, no indicator dots, no dashboard, and ten years of use without an update. They have their own article, Privacy of Smart Devices: TVs, Speakers, Cameras and Cars, with the history, the documented cases, the protocols and services they use, and a one-evening audit of the house. Two things from this article apply to them directly: the wake-word design is the same (so are the "false accepts"), and a DNS filter on your router, described in Example 4, shows what every device in the house contacts.

iPhone and Android – What Is Different

Comparison of the two systems (my own summary; details change with every version):

My own judgement: with default settings and the same habits, an iPhone leaks somewhat less to third-party advertisers than a typical Android phone, mainly because of App Tracking Transparency and the closed ecosystem; a carefully configured Android phone (or a hardened one) can be better than both, but it takes more work. The biggest difference is usually not the system but the number of apps and the permissions you gave them.

GrapheneOS and Other Alternative Systems

If you want the control that neither Apple nor Google gives by default, there is a third route: replacing the operating system. GrapheneOS is a non-profit, open-source mobile operating system based on the Android Open Source Project, focused on privacy and security. It is not a "no Google" system in the sense of a phone without apps: you get a normal Android-compatible phone, but the system itself contains no Google services and no tracking, and it hardens the parts that attackers use.

What GrapheneOS adds (summary of the project's own feature list):

The trade-offs are honest ones. It only runs on a few devices: the project officially supports Google Pixel phones (6 to 10 series, including the "a", Fold and Tablet models) and recommends Pixel 8 or newer, which receive at least 7 years of support from launch; Pixel 6 and 6 Pro reach the end of their minimum support in October 2026. The reason is hardware: GrapheneOS requires, for example, hardware memory tagging, a secure element with proper rollback protection, and timely security patches, and says that most other devices cannot provide a reasonably secure base. In March 2026 Motorola announced a partnership with the GrapheneOS Foundation and a future phone with GrapheneOS pre-installed (no model or date was given, and the project said that existing Motorola phones do not meet its requirements). The project has also said it is working with an unnamed "major OEM" on future flagship devices. Until such devices appear, the choice is a Pixel. Some apps may not work as you expect: apps that insist on Google's strictest device-integrity checks, some banking or contactless-payment apps and a few games may refuse to run or to pay; the project and its community keep compatibility lists. You are the administrator: you flash the system yourself, the bootloader is unlocked and relocked in the process and your data is wiped, and you must keep the phone updated. And it does not make a bad app good – if you install the Facebook app on any system, Facebook still knows what you do inside it; GrapheneOS lets you give it no contacts, no network outside the app, no sensors and a separate profile.

Other alternatives (my own overview; check the current state of each project before you buy):

Is it worth it? For people who handle sensitive information (journalists, lawyers, activists, people in conflict with someone who has power over them) the answer is often yes. For everyone else, the biggest improvement per hour of effort is still the settings in the examples below, and GrapheneOS is the step after that – especially for a second phone, or when you need to replace an old one anyway. Do not install anything on your only phone before you have a backup and read the official instructions.

Some resources for alternative systems:

• GrapheneOS – Features
• GrapheneOS – FAQ (supported devices, support dates, requirements)
• GrapheneOS – Installation
• /e/OS
• LineageOS
• Privacy Guides – Android distributions

What You Can Change on Facebook, Instagram and Google

The best known switch is the one that most people never look at: the list of the apps and websites that send information about your activity to Meta. On Facebook / Instagram look in the Accounts Center for Ad preferences and Your activity off Meta technologies – you can see which businesses sent data about you, clear the history and disconnect future activity. The names and positions of these settings are changed regularly, so search for them by name. In the European Union you may also be offered a choice between ads based on your data (or less personalised ads) and a paid subscription without ads; the offer, the price and the details change, so read what is actually shown to you. Outside the EU, the UK and South Korea, reports in 2026 say that there is no switch that fully removes your AI conversations from ad personalisation (there is a setting for AI data usage, but it reduces rather than stops the processing) – if you do not want a conversation used, do not have it with Meta's assistant. Under the GDPR you can additionally request a copy of all your data (Facebook: Download your information) and object to some forms of processing.

At Google, My Activity shows what is stored (searches, YouTube, maps, voice and audio activity if you enabled it), My Ad Center shows and controls ad personalisation, and Takeout exports everything. Apple's equivalent is privacy.apple.com. Turning off ad personalisation does not stop the collecting, but it limits how much of it is used to target you – and a downloaded archive is always an eye-opener.

Examples: How to Check and Control Your Phone

The aim of the examples is not to make the phone unusable, but to know what it is doing and to remove the unnecessary. Take the first three steps in each list as a minimum – they take five minutes and remove most of the risk for most people. The paths below are from recent versions; on your phone they may be named a little differently, and on Android they differ between manufacturers (Samsung, Xiaomi and others rearrange the menus).

Example 1 – iPhone: a 15-minute check-up

1. Update. Settings > General > Software Update and turn on automatic updates. Updates close the security holes that real attacks use.
2. Tracking. Settings > Privacy & Security > Tracking: switch off "Allow Apps to Request to Track", or look at which apps asked and say no. Then in Apple Advertising (same menu) switch off personalised ads.
3. Microphone and camera. Privacy & Security > Microphone and Camera: the list shows which apps asked for the permission. A weather app, a calculator or a game rarely needs a microphone. Switch off everything you cannot justify.
4. Location. Privacy & Security > Location Services: for each app choose "While Using" or "Ask Next Time", and switch off Precise Location where a city is enough (shops, weather, news). Check System Services for "Significant Locations" – this is the history of places you visit; clear it or switch it off if you do not want it.
5. Contacts, photos, local network, Bluetooth. The same menu. Choose limited access for photos, and look carefully at which apps want contacts (a social network uploading your address book is how it finds "people you may know" – and builds a map of people who are not even its users).
6. See what apps actually do. Privacy & Security > App Privacy Report (switch it on; it starts to collect from that moment). After a week it shows which app used the camera, microphone, location and contacts and which domains it contacted. An app that contacts twenty tracking domains is a candidate for deletion.
7. Voice assistant. In Siri settings decide whether you want "Hey Siri" at all, and in Privacy & Security > Analytics & Improvements switch off sharing audio recordings for improving Siri.
8. Clean up. Delete apps you do not use. Each one is a company with access to your data. Prefer a website in the browser to an app for shops and social networks that you use rarely – the browser gives it less than an app.
9. Check the others in your life. Privacy & Security > Safety Check lists who you share location and data with – useful if a relationship has ended, and a quick way to find out whether someone else can see where you are.
10. For higher risk: Lockdown Mode (Privacy & Security, at the bottom) turns off many functions, so most people will not want it all the time, but it is the right tool if you are a journalist, activist or someone who might be targeted.

Example 2 – Android: a 15-minute check-up

1. Update. Settings > System > Software update (and the Google Play system update in Security & privacy > System & updates). If your phone no longer gets security updates, this is itself the biggest risk – use it less for banking and sensitive things, or plan to replace it.
2. Open the Privacy dashboard. Settings > Security & privacy > Privacy > Privacy dashboard. Look at the last 24 hours and, where it is offered, the 7-day view for location, camera and microphone. This answers the question "who used the microphone?" better than any theory.
3. Permission manager. In Privacy > Permission manager go through Microphone, Camera, Location, Contacts, Photos and videos, Nearby devices and Notifications. Choose "Allow only while using the app" or "Ask every time" and remove what is not needed. Leave "Remove permissions if app is unused" on.
4. Advertising ID. Privacy > Ads (or Settings > Google > Ads): delete the advertising ID or at least reset it, and switch off ad personalisation. Apps then receive a string of zeros instead of an identifier.
5. System-wide switches. Privacy has Camera access and Microphone access toggles (also as Quick Settings tiles): they block all apps at once. They are useful when you are in a meeting, a doctor's office or just do not want any app near the sensor.
6. Check the dangerous special permissions. Settings > Apps > Special app access (names vary): Device admin apps, Accessibility (Settings > Accessibility > Installed apps), Notification access, Install unknown apps, Display over other apps. A flashlight app with accessibility access, or an unknown device admin, is a typical sign of malware or stalkerware.
7. Google account. Open myactivity.google.com and myadcenter.google.com (see above), switch off Web & App Activity, YouTube history and voice and audio activity if you do not need them, and set auto-delete. In the Google Assistant / Gemini settings review the hotword and voice-recording options.
8. Play Protect and the store. Keep Play Protect on, install only from the official store (or from F-Droid if you know what you are doing – and see the note about developer verification above), and before installing look at the Data safety section and the reviews.
9. Look at the trackers. Exodus Privacy is a free service that lists the tracking components and permissions found inside Android apps; the Android app of the same name lets you scan your installed ones. Free apps with ten trackers are not "free".
10. Advanced Protection, Safety Check and the stalkerware question. On Android 16 and supported devices look for Advanced Protection in the security settings and decide whether you need it (it is stricter, so it can block some things you like; high-risk users should turn it on). In Security & privacy use Google's safety tools to review what you share with whom, and if you suspect stalkerware, read the Coalition Against Stalkerware advice before you remove it, because removing it may alert the person who installed it.

Example 3 – A Pixel with GrapheneOS: the outline

This is an outline of the process, not a replacement for the official guide, which is kept up to date and verifies the system cryptographically. Do it on a phone that you can afford to wipe.

1. Choose the phone. Look at the FAQ for the list of supported devices and the "support until" dates; prefer a recent model (Pixel 8 or newer is recommended by the project). Buy one that is not locked to a carrier, because carrier-locked devices may block the installation. Phones sold with GrapheneOS pre-installed by third parties are not endorsed by the project – installing it yourself is better.
2. Back up and prepare. The installation wipes the phone. Copy your photos, contacts and two-factor codes (move authenticator apps and passkeys deliberately, not by accident). Update the phone to the latest stock system first, so that the firmware is current.
3. Enable OEM unlocking and USB debugging. In Settings > About phone tap the build number seven times to enable developer options, then switch on OEM unlocking there (it needs an Internet connection and, on some phones, a few days of waiting after the first sign-in).
4. Use the web installer from grapheneos.org/install/web in a browser with WebUSB support (a Chromium-based browser on a computer, with a good USB cable). It walks you through unlocking the bootloader, downloading and flashing the system, and locking the bootloader again. The page also shows the hash of the verified-boot key, so you can check that nothing in between has changed the system. Users who prefer it can follow the command-line guide.
5. First start. Set a long passcode (not a four-digit PIN), check the update settings (automatic), and decide on the profile layout: the Owner profile as the clean one, a second profile for apps that need the sandboxed Google Play, and maybe a third one for risky apps.
6. Install apps from F-Droid or the project's own app store where possible. If you need Google Play for a specific app, install it in the second profile from the GrapheneOS app store and give it only the permissions it needs. Give every app the Network permission only if it needs the Internet.
7. Set up the protections that fit your life: auto-reboot time, the USB-C charging-only mode, the duress PIN if you need it, Sensors and Storage Scopes for suspicious apps, and the Auditor app if you want to verify the phone regularly.
8. Test what you depend on before you move over completely – bank, public transport, messengers, maps, payments – and keep the old phone as a backup for a few weeks.

Example 4 – Seeing what your apps send

If you want to move from belief to observation, you can look at the network traffic of your own phone. Do it only on your own devices and your own network.

1. The easy way – on the phone. TrackerControl or NetGuard (Android; they use a local VPN, nothing leaves the phone) show which app contacts which domains and let you block them. On the iPhone use the App Privacy Report from the first example.
2. The DNS way – for the whole household. If you run a Pi-hole (see the article on constructing a cloud) or use a filtering DNS service such as NextDNS, set it as the DNS of the router or the phone. The query log shows every domain contacted by every device, and the blocklists remove most known advertising and tracking domains. Leave the phone for a day and look at the log in the evening – the number of domains for a "quiet" phone is usually surprising. DNS blocking does not catch everything (a device may contact a server by its IP address or use encrypted DNS), but it is a cheap first layer.
3. The detailed way – a proxy on the computer. With mitmproxy you can see the requests themselves. On the computer start the web interface:

   mitmweb --listen-port 8080

   Set the Wi-Fi proxy on the phone to the address of the computer and port 8080, open http://mitm.it in the phone's browser and install the certificate as the instructions say. You will see what ordinary apps and websites send. Many big apps use certificate pinning and will refuse to work through a proxy – which is also a result: you see only the domain, not the content. When you have finished, remove the proxy and the certificate from the phone.
4. Read the result calmly. A domain such as an analytics or advertising network does not mean spying by itself; ask what is sent and how often. The question "does it contact thirty companies at launch?" is a better indicator of a privacy-hostile app than any individual domain. To see which tracker libraries are inside an Android app before you install it, use the Exodus Privacy report.

Example 5 – Testing the "it listens to me" claim yourself

A simple experiment cannot prove that nobody ever listens, but it can show whether your ads follow your words or your behaviour.

1. Choose something you have never searched for, looked at or discussed in any message, a product or subject that is unrelated to your usual interests – for example a brand of fishing equipment if you are not a fisherman.
2. For a week say the word several times a day near the phone, in a room, with the phone unlocked and the apps in the background. Do not type it anywhere, and ask the people around you not to message you about it.
3. Watch the ads. Also open the Privacy dashboard (Android) or the App Privacy Report (iPhone) every evening and check which apps accessed the microphone.
4. Compare with the same test where you type the word once in a search box or look at one product. If the ads show up only in the second case, you have found the real mechanism. If something unexpected appears in the first, write down the app, the time and the dashboard entries – that is evidence you can report to the company, your national data-protection authority (in Slovenia the Information Commissioner) or the researchers who study such cases.

Example 6 – Habits that help more than any setting

• Fewer apps. Each app is a relationship with a company. A web page in the browser, with a tracker-blocking browser (Firefox with uBlock Origin on Android, Safari's built-in tracking prevention or a content blocker on iPhone, or Brave), usually knows less about you than an app.
• Separate roles. Use different e-mail aliases for different services (for example iCloud's Hide My Email, or alias services), a password manager, and do not use "Log in with Facebook" for unrelated apps.
• Be careful with the free things. Free flashlight, keyboard, "photo cleaner", VPN and quiz apps are historical favourites of data collectors. For a VPN, a keyboard or anything that sees everything, choose a company with a known business model and, if possible, a published independent audit or open-source code.
• Lock and encrypt. A long passcode (not four digits), biometrics as a convenience, the system encryption (on by default on current phones), a SIM PIN and the "Find my device" function.
• Do not give your phone to people who may want to watch you, and be careful with the "free" parental-control and tracking apps that make the other person's phone transparent to you – they use the same technology as stalkerware, and in many places using them on an adult without consent is illegal.
• Think before you talk to an assistant. What you tell a chatbot may be stored, reviewed or used for advertising, depending on the company and the country. Check the data-usage settings and avoid giving it identifying or very private details unless you know how they are treated.
• Use your rights. Ask companies for a copy of your data, withdraw consent to personalised ads, and file a complaint if they ignore you. The organisation noyb and the national authorities collect such cases.
• Back up and update. A phone that is lost, stolen or infected should not mean losing the family photos. See also the article on security considerations.

Some resources for protection:

• Privacy Guides – recommended tools and explanations
• EFF – Surveillance Self-Defense
• Exodus Privacy – trackers in Android apps
• Mozilla – Nothing Personal (product privacy reviews, formerly *Privacy Not Included)
• Apple Platform Security guide
• Android Security (AOSP documentation)
• Information Commissioner of the Republic of Slovenia and the European Data Protection Board

A Few More Thoughts

Is the phone listening? In the sense that a big social network records your conversations in the room to sell you shoes – there is no good public evidence for it, and a lot of evidence for something more mundane and in a way more worrying: a system that does not need to listen, because it already knows what you read, where you go, who you know, what you buy and what people like you do next. The microphone question is a good example of how a simple, scary explanation can distract from a complicated, structural one. At the same time, "we have no proof" is not the same as "it cannot happen": the voice-assistant settlements, the leaked sales pitch, the apps that recorded screens and read clipboards and the real spyware are reasons enough for a cautious user to look at the permissions and the dashboards from time to time.

The good news is that the tools for taking control have improved a lot in a few years, and most are free: indicators, dashboards, one-time permissions, tracking prompts, ad-ID deletion, DNS filters, hardened systems such as GrapheneOS, and laws that give you the right to ask. The bad news is that they need the user to use them, and that convenience will always push in the other direction. Think of the phone as a tool that is not yours alone: give it only the permissions that the task really needs, look at what it does once in a while, and accept that perfect privacy and a perfectly convenient phone do not exist together. The point is to choose the trade-off consciously – and then to look at the other devices in the house with the same questions.