Your Phone: How It Leaks and How to Close It

Your phone goes everywhere you go, and it keeps notes. Most of the leaks are boring defaults: an ad ID every app can read, a location permission you granted a coupon app in 2019, a lock screen that shows every text to whoever picks it up. Start with how the phone figures out where you are, and who else gets the answer.

The threat: how a phone gives you away

How a phone knows where it is

Your phone has several ways to locate itself, and it uses them together.

• GPS. The phone listens to satellite signals and works out its position. GPS itself only receives. The leak comes later, when an app sends the result somewhere.
• Wi-Fi. Every Wi-Fi router broadcasts an identifier. Apple and Google keep huge maps of where those routers are. Apple says Location Services combines GPS and Bluetooth with crowd-sourced Wi-Fi hotspot and cell tower locations, and that this crowd-sourced data does not personally identify you.
• Cell towers. This one runs whether you like it or not. In Carpenter v. United States (June 22, 2018), the Supreme Court described modern phones tapping into the wireless network several times a minute whenever the signal is on, even when nobody is using the phone. Each connection leaves a time-stamped record at the carrier called cell-site location information. In that case the government obtained 12,898 location points covering 127 days.
• Bluetooth and sensors. Google says that with Location Accuracy on, Android combines GPS, Wi-Fi and cell signals with the accelerometer, barometer and gyroscope, which helps indoors. Wi-Fi scanning and Bluetooth scanning let the phone look for nearby networks and devices even when Wi-Fi and Bluetooth appear off.

Apple also says apps and websites may estimate your location from your IP address even with Location Services off. "Location off" never means "location unknown."

The advertising ID: one number that ties apps together

Both iPhone and Android give apps an advertising ID, a string of characters that stays the same across every app on the phone, so an ad network can recognize your device in the recipe app and the game and join them into one profile. You never typed your name. You did not have to. Brokers key their location files to this ID, and once a device spends every night at one address and every weekday at one workplace, the ID points to a person. The FTC said X-Mode's location data tied to these IDs was not anonymized.

On iPhone, apps must ask before they track you across other companies' apps and sites. Android lets you delete the ID outright. Neither stops an app from collecting location you allowed it to have.

Permissions and SDKs: how a shopping app becomes a location feed

App developers build in SDKs, packages from outside companies that handle ads, analytics or maps. When you grant an app location permission, every SDK inside it can use that permission too. The FTC has documented how that becomes a business.

X-Mode Social (now Outlogic), January 9, 2024. The FTC said X-Mode collected precise location tied to advertising IDs through its SDK in other developers' apps, through its own apps Drunk Mode and Walk Against Humanity, and by buying data from other brokers. It sold to hundreds of clients, including private government contractors. The FTC said the data could track visits to medical and reproductive health clinics, places of worship and domestic abuse shelters. In one contract, a clinical research company received data on people who visited certain medical facilities and then pharmacies or infusion centers in the Columbus, Ohio area, for marketing. The order bans X-Mode from selling sensitive location data.

InMarket, January 18, 2024. InMarket ran its own apps, CheckPoints (shopping rewards) and ListEase (shopping lists), which asked for location for their core features. The FTC said the apps did not disclose that the data would also be combined with other data for targeted ads, and that InMarket's SDK in other apps did the same without telling those apps' users. InMarket kept location data for five years. It matched people's movements against places it cared about and sorted them into nearly 2,000 audience segments, with names like "parents of preschoolers" and "wealthy and not healthy." The FTC called its ban on InMarket selling or licensing precise location data a first for the agency.

Kochava. The FTC sued Kochava on August 29, 2022, saying it sold location data from hundreds of millions of mobile devices that could trace people's movements, including to reproductive health clinics and places of worship. A stipulated order filed June 26, 2026 bars Kochava and a subsidiary from selling, sharing or disclosing sensitive location data without consumer consent.

What the phone keeps about you

Your phone also keeps its own records: Significant Locations and Routes on iPhone, and Google Maps Timeline if you turned it on. In December 2023 Google announced that Timeline would move to storage on the phone, with a default auto-delete of three months for people who turn it on, down from 18 months. Those records matter most when someone else gets into the phone.

The lock screen leaks two-factor codes and message previews to anyone in arm's reach. Backups copy everything to a server, and under Apple's standard iCloud setting, Apple holds the keys to your iCloud Backup.

What police tools can reach

This guide does not help anyone defeat lawful process, but you should know what exists. Police can ask carriers for cell-site records; Carpenter held that getting seven days or more of historical records is a search that generally needs a warrant. On June 29, 2026, in Chatrie v. United States, the Supreme Court held that getting a person's Google location data was a Fourth Amendment search even though it covered only two hours, and sent the warrant question back to the lower court.

Once a phone is seized, forensic tools copy what is on it. The nonprofit Upturn's 2020 report "Mass Extraction," built on more than 110 public records requests, found at least 2,000 agencies in all 50 states and D.C. had bought these tools, and records from 44 agencies showed at least 50,000 extractions from 2015 to 2019. The tools can pull texts, photos, saved passwords, location records, app data and some deleted files, plus cloud data reached through accounts signed in on the phone. In Harris County, Texas, about 53 percent of 1,583 extractions were consent searches or of phones listed as abandoned or belonging to someone deceased. The full picture, including cell-site simulators, is in Phones: Cell-Site Simulators, Location Requests and Extraction Tools.

The defensive point is narrow: data companies never collect cannot be requested or bought later. Nothing here is advice to resist or obstruct a lawful search.

Who is most at risk

People who visit places the FTC orders call sensitive, such as clinics, places of worship, shelters and protests. Survivors of abuse, because the abuser often knows the passcode or controls the family account. Reporters and their sources. And the rare targets of mercenary spyware.

How to reduce it, level by level

Menu paths below come from Apple's iPhone User Guide and Google's Android Help as of October 2026, when iOS 27 and Android 17 are the current releases. Android paths are for Pixel-style menus; most also work on Android 12 and later. Samsung and other makers rename things. If a menu doesn't match, use the search bar at the top of Settings and type the setting's name.

Level 1 Everyday

This level goes after the advertising ID, the SDK pipeline and the lock screen. With tracking off on iPhone, apps that ask are treated as if you said no. Deleting the ID on Android removes the number brokers key their files to. Cutting app location to "while using" or "never" starves the background SDKs that fed X-Mode and InMarket. On iPhone, leave Private Address on for each Wi-Fi network (Settings, then Wi-Fi, then the info button next to the network); Apple says it reduces tracking of your phone across networks. On Android, turn on Pause app activity if unused in each app's screen so permissions fall away from apps you stop opening.

It does not stop your carrier's cell-site records, IP-based estimates, or anything an app already sold.

Level 2 Careful

This level goes after the location records your phone keeps for itself, and the radio scanning that runs even when Wi-Fi and Bluetooth look off. Apple says Significant Locations and Routes keeps track of places you have been, how often and when, and the routes you take. Apple says it syncs between your devices with end-to-end encryption, so the risk is mainly someone who gets into your phone. Turn it off if you don't use the features it feeds, such as Memories in Photos and predicted routes. On Android, Google Maps Timeline is off by default and only on if you opted in.

Level 3 Private

Backups are where your phone's secrets go to live somewhere else. Apple's Advanced Data Protection moves iCloud Backup, Photos, Notes and more to end-to-end encryption, so Apple no longer holds the keys. That shuts out a breach at Apple and a request to Apple for content it can no longer read. It does not protect the phone itself, and it puts recovery entirely on you.

On Android, Google says your backups upload to Google and some data is end-to-end encrypted with your screen lock PIN, pattern or password. Photos and videos in Google Photos are not covered by that screen-lock encryption. If your photos are the sensitive part, back them up to a computer you control.

Level 4 Hardened

If someone who is after you had access to your iPhone, start with Safety Check, after reading the FTC and hotline steps in The Privacy Ladder, because cutting off an abuser's access can alert them. Open Settings, then Privacy and Security, then Safety Check, and tap Manage Sharing and Access to review people, apps and devices one at a time. In an emergency, tap Emergency Reset instead; Apple says it quickly resets access to your device and personal information. People you cut off will notice.

Lockdown Mode and Advanced Protection answer a different threat, attacks that arrive through a booby-trapped message, web page or app. They break things on purpose. They also have a record: in April 2023 Citizen Lab reported it had not seen one NSO Group Pegasus exploit, PWNYOURHOME, succeed against any iPhone with Lockdown Mode on.

Neither stops someone who knows your passcode or changes what your carrier records.

Level 5 Hyper-vigilant

GrapheneOS is a privacy and security focused replacement for Android, built as a nonprofit open source project. As of October 2026 it officially supports only Google Pixel phones, from the Pixel 6 through the Pixel 10 family. Its FAQ lists the Pixel 6 and 6 Pro as reaching end of support in October 2026 and recommends a Pixel 8 or newer. It can run Google Play as an ordinary app inside the normal sandbox, with no special access, which limits what Google's own apps can reach. Installing it wipes the phone, and some banking apps refuse to run because GrapheneOS is not certified by Google. Its project says it does not try to fake those checks.

The other Level 5 habit is the simplest. A phone that is off, or sealed in a Faraday bag, is not talking to towers, which is the one leak no setting closes. Test any bag: seal the phone, then call it. If it rings, the bag is junk. Hyper-Vigilance covers testing and the mistakes that undo all of this.

The legal line: switching off or bagging your own phone is your choice. Jamming signals breaks federal law, the FCC says, and nothing here helps anyone defeat a warrant or a lawful seizure.

The ladder for this topic

Level	What to do	Cost or tradeoff
Level 1 Everyday	Ad tracking off, ad ID deleted, lock screen previews hidden, app location trimmed, Private Address on	Free, ten minutes
Level 2 Careful	Clear Significant Locations, Timeline off, Wi-Fi and Bluetooth scanning off	Fewer smart suggestions
Level 3 Private	Advanced Data Protection; local backups for sensitive photos on Android	You alone can recover your data
Level 4 Hardened	Safety Check, Lockdown Mode, Android Advanced Protection	Broken attachments, sites and features
Level 5 Hyper-vigilant	GrapheneOS on a Pixel; phone off or bagged when not needed	Wiped phone, failing apps, being unreachable