The ad profile is a surveillance file.
The advertising industry says the data your phone leaks is anonymous and harmless. A tool called Fog Reveal showed exactly what that data becomes when someone decides to use it against you.
What Fog Reveal is
Fog Reveal is a web tool sold by Fog Data Science, a Virginia company, to law enforcement agencies. It came to light through the Electronic Frontier Foundation, whose public records requests uncovered the program during a location-data investigation, and through a subsequent Associated Press investigation. The company has claimed billions of data points drawn from roughly 250 million American mobile devices, and the tool has been in use in criminal investigations since at least 2018.
None of that data came from wiretaps or warrants. All of it came from the advertising market: ordinary apps on ordinary phones, selling location trails to brokers, who sold them onward.
How the trick works
Your phone carries an advertising ID, a unique number that lets the ad industry recognize your device across apps and websites. Many apps collect your GPS position alongside that ID and sell the pairing to data brokers. The industry line is that this is fine because the ID contains no name.
Fog Reveal demonstrated how thin that assurance is. An investigator draws a box on a map around any location and time, and the tool returns the devices that were there. Pick a device and the tool follows it backward through months of history. Reporting on the company's own terms put the lookback at 180 days or more. Analysts use the trails to build what the trade calls patterns of life: where a device sleeps every night, where it spends working hours and which homes it visits, even which gatherings it attends.
A device that sleeps at your address and commutes to your job is you. The name was never needed.
Why it matters
The Supreme Court requires a warrant before police track a person through GPS or cell tower records. Buying the same trail from the ad market slid through a gap between surveillance law and data privacy law, and the AP found the tool used at times without a warrant. Reporting in late 2024 added a darker detail: the company had instructed agencies on listing the locations of a suspect's doctors and lawyers.
Set the police question aside and the deeper problem remains. The profile exists either way. A commercial market compiled a browsable and searchable history of where hundreds of millions of people have been, and it sells to whoever pays. Law enforcement was one customer. The same industry has sold movement data to private buyers of many kinds, and every person in those databases is one query away from being found by someone with worse intentions than a detective.
What this means for you
This is digital exhaust in its purest form. You never posted your location. You never agreed to be in a surveillance product. You installed a weather app, and the weather app knew where you sleep.
The defensive moves are concrete and they work forward from today:
- Delete or reset your advertising ID, and turn off ad personalization at the OS level.
- Audit location permissions app by app. Almost nothing needs your location in the background, and most apps need it never.
- Treat free apps as data collectors first and products second, because that is the business model.
- The Atlas: the ad ID on your phone
The Phone Hardening Checklist walks through each step for iPhone and Android, in order, with nothing assumed.
Sources
- Electronic Frontier Foundation, Fog Revealed
- Associated Press reporting on Fog Reveal
- The Conversation, legal analysis of Fog Reveal
Close the leaks in the device that knows the most about you.
Open the Phone Hardening ChecklistNo list to join. The work just ships.
PDN keeps no mailing list, which is exactly how a privacy project should treat your inbox. New guides and Atlas entries land on this site first, dossiers too, and the podcast carries every announcement. A community space is planned once the audience earns it.