The phone, point by point.

Wi-fi.

While hunting for networks the radio announces itself, and store sensors use those signals to recognize a device moving through a space. Randomized addresses blunt it. The radio sends probe requests while hunting for known networks, and joining one reveals a stable address to its operator. Modern phones randomize the hardware address between networks. Retail analytics built an industry on passive probe collection before randomization blunted it. Forgetting old networks and disabling auto-join stops the phone calling out familiar names.

Leaving Wi-Fi on turns a walk through a mall into a signed guest book.

Cameras.

Photos leave the phone carrying hidden data: coordinates and a timestamp, device model too. One published frame located a fugitive at a resort poolside. Every photo embeds metadata: GPS coordinates, timestamp, device model, and settings. Major social platforms strip it on upload; email and cloud drives do not, and many messengers keep it too. The McAfee case turned one geotagged photo into an arrest. Turn off camera location tagging, and use the share sheet’s location toggle for the archive you already have.

A single shared image can undo months of careful location hygiene.

Bluetooth.

Beacons in stores and venues log nearby devices, and tiny trackers piggyback on passing phones to report position. The radio is chattier than it looks. The radio advertises constantly for accessories and finding networks. Tracker tags report their position through every passing phone, and venue beacons log yours in return. Apple and Google shipped cross-platform stalker-tag alerts because misuse became routine. Your phone is a relay in the network whether or not you own a tracker.

Known systems / AIRTAG · TILE

The tracker economy works because everyone else’s phone reports what it hears, including yours.

Notifications.

Every notification routes through Apple or Google servers, and governments have demanded records of that traffic. Both companies now disclose the demands, and the metadata still flows. Push traffic transits Apple and Google infrastructure, producing records of which app reached your device and when. Governments compelled those records quietly for years. The practice surfaced in 2023 through a Senate letter. Both companies now require warrants and publish the demands, and the metadata itself still flows by design.

Known systems / APNS · FCM

Even fully encrypted apps leak the fact and timing of every message through the pipe that delivers it.

Motion sensors.

The chips that count your steps also reveal activity and transport mode, behavior patterns too, and have historically been readable with little or no permission. Accelerometer and gyroscope streams reveal steps, transport mode, sleep, and coarse behavior patterns. Web pages could read them with little or no permission for years. Browsers and operating systems have tightened access release by release. The lesson stands: the boring sensors reconstruct what the guarded ones are blocked from seeing.

Sensors nobody thinks to audit can reconstruct what the audited ones are blocked from seeing.

Cell connection + sim.

The phone checks in with towers constantly, and your carrier keeps long location and call records under your name. Fake towers exploit the same handshake locally. The baseband registers with every tower in range, and carriers retain location and call records for years under their own policies. Tower dumps hand investigators every phone near a place and time. Cell-site simulators impersonate towers to force nearby phones to check in. Carrier records are the one trail phone settings cannot cut; the Supreme Court’s Carpenter ruling put a warrant on the history.

Known systems / STINGRAY

You can be careful with every app and the network itself still files your location history.

Cloud backup.

A backup is a complete copy of your phone held by the provider, reachable by password reset and legal process unless you turn on end-to-end encryption. A default backup includes messages, photos, settings, and app data, stored under keys the provider controls. Standard iCloud backups remain readable to Apple and reachable by legal process. Advanced Data Protection moves the keys to your devices, and Android encrypts backups under your screen lock. Turn the setting on and the copy stops being the soft target.

Known systems / ICLOUD · GOOGLE ONE

One password reset away is a complete copy of your life, unless you turn the key yourself.

Ad id number.

A serial number built for the ad industry. It joins your activity across apps into one profile, and it is the key that made ad-market location data searchable in tools like Fog Reveal. The identifier ships in every ad request alongside location and app details, device details too. Brokers key their files to it, which is what made ad-stream data searchable by phone. Fog Reveal demonstrated the end state: a police search box over commercial ad data. Deleting the ID on Android and denying tracking on iOS breaks the join at its cheapest point.

Known systems / IDFA · AAID · FOG REVEAL

This one number is why a stranger can buy your movements from an ad company.

Apps + hidden trackers.

Free apps carry embedded broker and analytics code that inherits every permission the app holds. The flashlight is free because the data inside it is the product. Embedded SDKs inherit every permission the host app holds and report to their own masters. Location brokers paid developers to carry their code inside innocuous utilities. The FTC banned Outlogic, previously named X-Mode, along with InMarket from selling sensitive location data after this exact pipeline surfaced. Fewer apps, and paid over free, shrinks the passenger list.

Known systems / OUTLOGIC (X-MODE) · GRAVY ANALYTICS

You audited the app. Nobody showed you the four companies riding inside it.

Microphones.

Any app granted the permission can capture audio while in use. The audit that matters is which apps hold it and whether each one has a reason. Any app holding the permission can record while active, and assistants keep a hot mic waiting for a wake word. False activations have shipped private audio to review contractors. Amazon, Google, and Apple all ran human review of voice clips until 2019 reporting forced changes. Audit the permission list, and treat always-listening as a choice, not a default.

The question is never whether the mic works. It is who holds the permission slip.

Location.

GPS plus Wi-Fi and cell positioning pin the phone to a few meters. Apps holding the permission build a diary of where the device sleeps and works, down to every stop between. Location services blend satellites, Wi-Fi maps, cell towers, and beacons into a fix within meters. Every app granted access writes its own copy of your movements to its own servers. Significant Locations and Google’s Timeline keep long home-and-work histories, and Google moved Timeline storage onto the device in 2024. Set apps to While Using and audit twice a year.

Known systems / FOG REVEAL · BABEL STREET

Where your phone sleeps is where you sleep, and that fact is for sale.

System analytics.

Diagnostics and personalization services describe how and where the device is used, tied to your account unless switched off. Diagnostics report crashes, feature usage, battery, and identifiers to the OS vendor, and personalization services profile usage on top. Each toggle is a separate stream. The data is mostly mundane and the identifiers are not. Ten minutes in the privacy menu turns most of it off with no visible cost.

Convenience features are measurement features with better branding.