Reduce everyday tracking · Part 3 of 3 · 7 min read

Microphones, monitoring, and someone you know.

What the evidence says about listening, why workplace devices differ, and when a safety plan must come first.

In this series · 3 parts

When it is someone you know.

↳ read the safety note before the how-to

Please read this first

If you think someone is monitoring your phone, do not start by removing it.

From the Coalition Against Stalkerware, verbatim:

“Removing stalkerware or other monitoring detection and/or making significant changes may be detected by the abuser and could increase the abuse and harassment.”

“Deleting stalkerware means also deleting evidence related to this. If you wish to report the incident, you may need to seek help from law enforcement, as this evidence could be helpful.”

Their guidance is to build a safety plan with the assistance of a trusted survivor assistance program, and to attempt removal only if you believe it is safe to do so. That ordering is deliberate and it matters more than anything else in this section.

National Domestic Violence Hotline: 1-800-799-7233, available 24 hours a day and confidential. Technical safety guidance is available from stopstalkerware.org and techsafety.org.

↳ how common, honestly:

The most recent industry count comes from one security vendor’s 2023 to 2024 report: 31,031 unique affected users in 2023, up from 29,312 the year before, with the largest counts in Russia, Brazil and India. No 2025 or 2026 edition exists.

The vendor’s own caveat is the important part: “The statistics reflect only mobile users of Kaspersky’s security solutions.” These counts undercount badly. Treat them as a floor, not a prevalence rate.

The same report’s survey found 12% of respondents admitting they had installed monitoring software or altered settings on a partner’s phone, 13% reporting a partner had done so to them, and 23% encountering online stalking from someone they had recently started dating.

↳ trackers, and what actually shipped:

In May 2024 Apple and Google jointly shipped a detection specification, so that an unknown tracker moving with you produces an alert regardless of the platform the device is paired with. It is in iOS 17.5 and Android 6.0 and later, and Chipolo, eufy, Jio, Motorola and Pebblebee committed to compatibility. Call it an industry specification rather than a standard: the underlying draft has expired.

Two limits worth stating. It detects trackers, not a phone running monitoring software, which is the more common interpersonal case. And the AirTag litigation against Apple is still live: a docket entry showing it terminated in July 2026 reflects a transfer to a different district, not a dismissal or settlement.

If you are checking a device and it is safe to do so, the places to look are app permissions and Safety Check on iOS, and on Android the device-admin app list and, above all, accessibility services, which is the mechanism most monitoring software relies on. Verify the exact menu paths on the device itself, since they move between versions.

So is your phone listening?

↳ the honest answer, in both directions

This is the question everyone actually came for, so it deserves a careful answer rather than a confident one.

A large field study

No app was caught sending audio

Researchers at Northeastern University analysed 17,260 Android apps across four app stores. Their finding, verbatim: “We did not find any true positive audio files in our extracted dataset, i.e., no apps appeared to exfiltrate audio in our tests.”

What they found instead was arguably worse. Third-party analytics libraries were uploading screen recordings and screenshots with no permission requested and no notification. One conference app sent 45 screenshots, including contacts and messages.

State the limits, as the authors did: automated interaction could miss audio transcribed or transformed on the device, the study was Android-only, and it was published in 2018. No newer replication was found. “No evidence found, with known blind spots” is the honest summary. Not “proven impossible,” and not “repeatedly debunked.”

The famous proof

It was false advertising

In 2024 a media company’s leaked pitch deck advertised an “Active Listening” product and named major platforms as partners. It circulated everywhere as proof that phones listen, and Google dropped the company from its partner programme.

Then in May 2026 the FTC charged the company and two others with falsely representing that the product worked. The FTC’s position: it never listened to anyone and used no voice data. It was resold data-broker email lists at inflated prices with inaccurate geo-targeting. The settlement totalled $930,000.

The most-cited proof that phones listen is now on the record as a company being penalised for claiming a capability it did not have.

↳ where the microphone genuinely is the story:

Wake words. Apple settled the Siri litigation for $95 million, with final approval in November 2025 and payments distributed from January 2026, averaging about $8 per device. Apple denied that Siri data was used for advertising. Amazon paid $25 million in May 2023 over retaining children’s voice recordings indefinitely, ignoring parental deletion requests, and using that audio to train speech models.

And your television. Automatic content recognition is the quieter version of this. In 2017 Vizio paid $2.2 million after capturing second-by-second viewing from roughly 11 million televisions, surfaced to owners only as a feature called “Smart Interactivity,” then appending age, income, marital status, education and home value and selling it.

A 2024 academic audit of current Samsung and LG sets found ACR running even when the television was used as a plain HDMI monitor. Here is the encouraging half, and it is the reason to bother: opting out actually stops the traffic. The researchers measured it. Menu names drift between firmware versions, so find the setting in your own set’s current support article rather than trusting a name from an article.

Your car, too. In January 2026 the FTC finalized an order against GM and OnStar over collecting and selling precise geolocation and driving-behaviour data from millions of vehicles without adequate notice or consent, including to consumer reporting agencies. It carries a five-year ban on that sharing and a twenty-year express-consent requirement. California settled separately for $12.75 million in May 2026, and several state attorneys general have their own suits running.

And at work.

↳ one Puerto Rico line that is genuinely unusual

In the United States generally, private-sector monitoring of company systems is largely lawful. Federal wiretap law’s business-use and consent exceptions do most of the work, and employers are commonly advised to eliminate any reasonable expectation of privacy on company systems. State wiretap laws, particularly in two-party-consent states, constrain the recording of conversations more than they constrain monitoring generally.

Some states require notice. New York has required prior written notice of email, internet and phone monitoring since 7 May 2022, and Connecticut and Delaware have comparable notice laws.

↳ a correction, because this one is widely repeated:

A 2022 National Labor Relations Board memo would have treated pervasive worker surveillance as presumptively unlawful where it chills organizing. That memo was rescinded on 14 February 2025, so it no longer reflects agency enforcement policy. Any guide describing it as current is out of date.

On how common monitoring is: count the tools, not the adopters. Reliable figures on how many employers actually monitor are scarce, and most quoted percentages come from vendor marketing surveys with undisclosed methodology. The defensible datapoint is that Coworker.org’s database documents more than 550 labor-focused monitoring products developed since 2018.

↳ and the local exception:

Puerto Rico is unusual: its constitutional right to privacy under Article II, Section 8 has been applied directly against private parties, not just the government. In Arroyo v. Rattan Specialties (1986), the Supreme Court of Puerto Rico relied on it to limit a private employer’s polygraph testing of its own workers.

We are deliberately keeping that to one sentence and its case. The facts and the constitutional grounding are verified, but the further doctrinal reach is not something we will assert without counsel review. And we will not tell you Puerto Rico has no employee-monitoring statute, because we could not verify that negative either way. If this affects you, that is a question for a Puerto Rico employment lawyer, and it is a genuinely better question here than it would be on the mainland.

Edited September 29, 2026. Research and source dates are retained; this edit is not a fresh review of every statistic or legal development.