Is My Phone Listening to Me? No Evidence Has Been Found - and the Researchers Who Looked Say That Is Not Proof

Almost every page answering this question gives you one of two answers. Antivirus companies say yes, more or less, and here is what to switch off. Technology journalists say no, don’t be silly, and here is how ad targeting really works.

The most careful piece of work on the question refuses to give either answer, and its reasoning is more useful than either.

The paper that reviewed the whole question

Kröger and Raschke (2019), in Data and Applications Security and Privacy XXXIII (Springer LNCS vol. 11559, pp. 102-120), set out to structure the argument rather than win it. They reviewed the technical claims on both sides, examined what access-control mechanisms and detection methods can and cannot see, and reached a conclusion that neither camp quotes.

On evidence: “no evidence has been found to confirm the widespread suspicion that firms are secretly eavesdropping on smartphone users to inform ads. To the best of our knowledge, however, the opposite has not been proven either.”

On the confident denials: they explicitly “challenge the widespread assumption that the spying fears have already been disproved,” and state that “the fact that no evidence for large-scale mobile eavesdropping has been found so far should not be interpreted as an all-clear.”

On feasibility, their analysis is the part that makes the reassurance hard to give cleanly. A naive implementation - continuous high-quality recording, uploaded and transcribed - would be detectable in battery drain and network traffic. But they identify several ways it could be made “much more efficient and scalable”: low-quality recording, local preprocessing on the handset, keyword spotting instead of full speech recognition, and selective rather than continuous capture. Their assessment is that “sophisticated eavesdropping operations could potentially be run by either of the above-mentioned adversaries without being detected” at current levels of platform transparency, and that “no estimate can be made as to the probability and economic viability of such attacks.”

That is not the same as saying it is happening. It is saying that the confident “no” is doing more work than the evidence supports.

What the measurement study actually found

The most-cited empirical check is Pan, Ren, Lindorfer, Wilson and Choffnes (2018), Panoptispy, published in Proceedings on Privacy Enhancing Technologies 2018(4), 33-50. The researchers took 17,260 Android apps from Google Play and three third-party stores - selected because they requested camera or record-audio permission - and ran them on real handsets with automated interaction while recording network traffic and extracting media from it.

What they reported finding, per the authors’ own conference presentation: 21 cases of detected media exfiltration, of which 12 were considered leaks (unexpected or unencrypted), and 9 of those shared with third parties.

The leaks they characterise are images and video, not audio. The named example is screen recording: third-party libraries “that record and upload screenshots and videos of the screen without informing the user and without requiring any permissions”, with the analytics firm Appsee named as a recipient.

A limit on how far this can be pushed: we could read the paper’s abstract and the authors’ conference slides, but not the full text. Neither accessible record contains an explicit statement that no audio exfiltration was found. So what can honestly be said is narrower than the way this study is usually cited - a large automated survey of media-permission apps surfaced image and video leaks and did not surface audio ones. It is not a proof of absence, and the authors did not present it as one.

The company that advertised doing it

There is one documented instance of a firm claiming this capability commercially, and it is instructive precisely because of what it does not establish.

In August 2024, Joseph Cox at 404 Media published a pitch deck from Cox Media Group marketing a product called “Active Listening” - advertising targeted on what people said out loud near device microphones. The deck “explicitly points to Facebook, Google, Amazon, and Bing as CMG partners.”

Google removed CMG from its advertising Partners Program after 404 Media approached it for comment. CMG subsequently deleted the material from its own site.

What this proves is that a marketing company was willing to sell the claim. It does not establish that the technology existed, worked, or was ever deployed, and the reporting does not assert that it did. A pitch deck is a sales document. It is evidence about a seller, not about a phone.

The mechanism that actually explains the coincidence

The strongest reason to doubt the microphone theory is not that eavesdropping is impossible. It is that it would be redundant.

In September 2024 the US Federal Trade Commission published a staff report, A Look Behind the Screens, based on Section 6(b) orders issued in December 2020 to nine companies: Amazon (Twitch), Meta (Facebook), YouTube, X, Snap, ByteDance (TikTok), Discord, Reddit and WhatsApp.

Its central finding, verbatim:

the companies “collected and could indefinitely retain troves of data, including information from data brokers, and about both users and non-users of their platforms.”

The report also found that companies “deployed privacy-invasive tracking technologies, such as pixels, to facilitate advertising to users based on preferences and interests”; that they “fed users’ and non-users’ personal information into their automated systems, including for use by their algorithms, data analytics, and AI”; that data collection, minimisation and retention practices were “woefully inadequate”; and that some companies did not delete all user data when asked to.

Read that alongside the experience that prompts this search. You mention a product to a friend; an advertisement for it appears. The systems described in that report know where your phone has been, what your friend’s phone has been near, what both of you have browsed, what a data broker sold about your household, and what people with your pattern of behaviour bought last month. They can also target you on the strength of what your friend did, because they hold data on non-users.

A microphone would add expense, legal exposure and detectability to a system that already has enough to produce the coincidence.

What we can and cannot tell you

We can tell you that nobody has found it. Two independent lines of work - a large automated app survey and a technical review of the whole question - looked and came up empty.

We can tell you that the researchers who looked hardest decline to declare it settled, and that their reason is specific: a well-designed covert system using keyword spotting and local preprocessing would not necessarily be visible to the detection methods currently available to outside researchers.

We can tell you that the documented mechanism is more comprehensive than the one people fear. The FTC found data collection covering people who never used these services at all.

What we cannot tell you is that your phone definitely is not listening, because that is a negative that nobody has demonstrated, and the paper best placed to demonstrate it declined to.

This is a question about data collection, not about how a feed decides what to show you once it has the data - that is a separate question - and it is separate again from whether algorithmic curation isolates people ideologically, which is measured directly.

Limitations and disputes

• The Panoptispy paper could only be read in part. Its abstract and the authors’ conference slides were accessible; the full text was not. No claim of “no audio leaks found” is attributed to it here, because we could not verify that the authors made one.
• Panoptispy tested Android only, in 2018, with automated random interaction. It could not exercise every app path, and it says nothing about iOS or about the years since.
• The 2019 review is an analysis, not an experiment. Its feasibility argument is reasoning about what could be built, not a demonstration that anything was.
• The CMG story rests on a single outlet’s reporting of a leaked sales document. We have not seen the deck, and no independent confirmation that the product functioned has been published.
• We have not read the full FTC staff report, only its official record and press release. The findings quoted are the Commission’s own published wording.
• Voice assistants genuinely do listen for a wake word. That is disclosed, documented behaviour and is not what this question is asking about; it is also not covered here.
• This is not security advice. It does not tell you which permissions to change.