Your phone probably
isn’t listening.
The truth is worse.

Every time an app loads an ad, a request goes out describing the device and often its location, and it goes to many potential bidders at once. Companies collect from that stream whether or not they ever win a bid, which is exactly what the FTC described Mobilewalla doing.

The best current investigation is Databroker Files: Targeting the EU, published November 2025 by netzpolitik.org with BR, Le Monde, L’Echo and BNR. It is empirical rather than modelled: cumulatively more than 13 billion location points, obtained as free samples. The Belgian slice alone exposed devices at the European Commission headquarters, the European Parliament, NATO headquarters, and the home addresses of five officials. The series was still running as of 11 August 2026.

Two cautions about the numbers you will see quoted elsewhere. The widely-repeated claim that your phone broadcasts your location a specific number of times per day comes from an aggregate industry broadcast count divided by an assumed online population, drawn from a confidential unpublished source, and the organization that produced it called it a low estimate. We are not going to repeat it as a per-person figure. And the claim that one surveillance vendor profiled five billion people is that vendor’s own marketing claim, not a measurement.

On enforcement: no EU or German regulatory outcome resulted from the Databroker Files through August 2026, and the long-running challenge to the ad industry’s consent framework has gone the industry’s way on appeal twice. The fair summary is that it remains unresolved after more than four years of appeals.

Muslim Pro. Reporting established two parallel things: that the app sent data to the broker X-Mode, and that X-Mode sold to defense contractors. It never established that the US military received Muslim Pro users’ data specifically, and the reporters said so themselves. The FTC’s X-Mode complaint names neither the app nor the military.

Life360. The family-safety app was one of the largest sources of raw location data, earning $16 million from it in 2020. It is often said to have stopped in 2022. It did not: it exited the broker market with exceptions, and its own FY2025 annual report shows data revenue of $32.7 million in 2025, up from $26.6 million and $21.6 million in the two prior years, with risk factors conceding precise geolocation is a core component of its products.

The priest. In 2021 a publication bought commercially available app signal data from an unnamed vendor and used movement patterns to identify a US church official, who resigned. The data carried no name; the attribution was inference. It was never established that any particular app sold or leaked his data. Separately and unrelatedly, Norway fined Grindr NOK 65 million in December 2021 over conduct that ended in April 2020, upheld on appeal three times through October 2025. Those are two different stories and they get merged constantly.

And what a subscription buys. In October 2024, a private investigator hired by a privacy company obtained a free two-week trial of a location-tracking tool sold to government, and was told that merely contemplating future government work was “good enough” and that “they don’t actually check.” The demonstration showed devices at a mosque, a synagogue, and a juror parking lot. Read that as a capability demonstration by a company building a lawsuit, which is what it was, rather than as evidence that particular people were surveilled.

Wake words. Apple settled the Siri litigation for $95 million, with final approval in November 2025 and payments distributed from January 2026, averaging about $8 per device. Apple denied that Siri data was used for advertising. Amazon paid $25 million in May 2023 over retaining children’s voice recordings indefinitely, ignoring parental deletion requests, and using that audio to train speech models.

And your television. Automatic content recognition is the quieter version of this. In 2017 Vizio paid $2.2 million after capturing second-by-second viewing from roughly 11 million televisions, surfaced to owners only as a feature called “Smart Interactivity,” then appending age, income, marital status, education and home value and selling it.

A 2024 academic audit of current Samsung and LG sets found ACR running even when the television was used as a plain HDMI monitor. Here is the encouraging half, and it is the reason to bother: opting out actually stops the traffic. The researchers measured it. Menu names drift between firmware versions, so find the setting in your own set’s current support article rather than trusting a name from an article.

Your car, too. In January 2026 the FTC finalized an order against GM and OnStar over collecting and selling precise geolocation and driving-behaviour data from millions of vehicles without adequate notice or consent, including to consumer reporting agencies. It carries a five-year ban on that sharing and a twenty-year express-consent requirement. California settled separately for $12.75 million in May 2026, and several state attorneys general have their own suits running.

A 2022 National Labor Relations Board memo would have treated pervasive worker surveillance as presumptively unlawful where it chills organizing. That memo was rescinded on 14 February 2025, so it no longer reflects agency enforcement policy. Any guide describing it as current is out of date.

On how common monitoring is: count the tools, not the adopters. Reliable figures on how many employers actually monitor are scarce, and most quoted percentages come from vendor marketing surveys with undisclosed methodology. The defensible datapoint is that Coworker.org’s database documents more than 550 labor-focused monitoring products developed since 2018.