You mention dog food once at dinner. An hour later, your Instagram feed is full of kibble. You talk about running shoes with a friend and never type a word — and yet there they are, sponsored, in your timeline. It happened to your mother, your coworker, probably you. And every one of those moments adds a little more weight to one of the most durable beliefs of the smartphone era: that our phones are secretly listening to our conversations so advertisers can sell us things.

It is a seductive theory because it feels like the only explanation that fits. But when scientists actually went looking for the eavesdropping, the microphones were silent. What they found instead was a privacy scandal of a different kind — and an advertising machine so good at predicting us that it barely needs to hear a word we say.

This is the story of the evidence: the largest academic test ever conducted on the claim, the marketing company that claimed to sell exactly this surveillance (and was fined for lying about it), the psychology that makes coincidence feel like proof, and the genuinely creepy things your phone is doing instead.

*Your phone’s microphone is rarely the culprit — researchers found the real ad-targeting pipeline runs on metadata. Image: Unsplash.*

A belief most people share

Let us begin with how widespread this conviction is, because it matters. A survey of 1,000 American adults conducted in September 2026 by Vibe via Pollfish found that 70 percent of Americans believe their phones listen to their conversations. Even more striking: 81 percent said they had received an ad for something they had only discussed or thought about — never typed — and 42 percent said it happened often enough that it no longer felt like a coincidence. An earlier survey from 2019 had found 48 percent of Americans believed their phones were listening in, with younger adults even more convinced — 57 percent of those aged 18 to 34 said so. Public skepticism has not faded in the intervening years; if anything, it has hardened.

This matters because when a claim is believed by a supermajority of the population, the burden of explanation falls on the evidence, not on vibes. So what happens when you test the listening claim like a scientist?

The 17,260-app experiment

In 2018, a team of computer science researchers at Northeastern University decided they had heard enough. Led by David Choffnes and Christo Wilson, with Elleen Pan, Jingjing Ren, and Martina Lindorfer, the group designed a large-scale experiment to settle the question empirically: are smartphone apps secretly switching on the microphone and sending captured audio to advertisers?

The methodology was ambitious. The researchers installed more than 17,260 of the most popular Android apps — including Facebook’s own apps and more than 8,000 apps known to send data to Facebook — on ten Android phones. An automated program then interacted with each app the way a user might, while the team captured and analyzed all network traffic the phones generated. They were specifically hunting for media files — audio clips — being uploaded to servers, particularly to unexpected third parties.

The result, reported by Gizmodo’s Kashmir Hill and others in July 2018: no evidence of a single app unexpectedly activating the microphone or sending audio out when it had not been asked to do so. Zero. As the researchers themselves cautioned, that does not constitute mathematical proof that no phone anywhere is listening — proving a negative is genuinely hard — but across 17,260 of the most-downloaded apps on the planet, the eavesdropping pipeline simply did not appear.

One caveat the reporting was careful to note: the automated testing program did not behave exactly like a human. There is a limit to how fully an automated script can trigger every behavior an app might reserve for real human interaction. The researchers acknowledged this limitation themselves. But the study remains the most extensive empirical test of the claim ever published — and its failure to find anything is exactly what makes it meaningful.

What the researchers did find, though, was a scandal of its own. Several apps were secretly recording the phone’s screen and sending those screenshots and videos to third-party analytics companies, without the user’s knowledge or consent. The team identified this as a previously unreported privacy risk arising from third-party libraries embedded in apps — one that could operate without needing any permissions from the user at all. Gizmodo’s reporting gave the concrete example of the delivery app GoPuff: when the automated system entered data into the app, information including the user’s zip code and snack preferences was captured as a recorded video and sent to a mobile analytics firm called Appsee. GoPuff had not disclosed this in its privacy policy until reporters started asking questions.

So the answer the phones gave was a strange one: not listening, but watching.

Why researchers think it is unlikely anyway

Beyond the study’s direct findings, security experts have long argued that covert microphone surveillance at advertising scale is implausible on purely practical grounds, for reasons that do not require trusting any company:

Someone would notice. Constantly recording audio, compressing it, transcribing it, and uploading it to servers would leave a detectable trail — abnormal battery drain, unusual data usage, strange network traffic. Security researchers and independent network analysts monitor these things routinely. A covert, always-on recording operation across hundreds of millions of devices would be, in the words of one line of expert reasoning, nearly impossible to hide from the global security research community.

Advertisers do not need it. This is the more decisive argument. Advertising platforms already know vastly more about you than your spoken conversations reveal — where you go, what you search, what you buy, who your friends are. Audio surveillance would be expensive, technically fragile, and legally radioactive, all to gain a marginal sliver of signal on top of data they already have. As cybersecurity firm Kaspersky puts it: your phone doesn’t need to listen. The targeted ads feel eerily accurate because platforms build detailed behavioral profiles from browsing, location, and app activity.

A negative is hard to prove absolutely. This is the intellectually honest wrinkle, and the reason our verdict on this site is “Unproven” rather than a flat “False.” The Northeastern researchers refused to claim their study definitively proved phones never listen, and they were right not to. Proving the complete absence of a behavior across every app, every phone, and every jurisdiction is a nearly impossible standard. What science can offer is the absence of evidence despite rigorous looking — and the consistent failure of anyone to produce positive evidence, despite enormous incentives (for journalists, competitors, regulators) to be the one who catches it happening.

The company that claimed to sell the nightmare — and was fined for lying

For years, the single strongest piece of evidence cited by believers in phone eavesdropping was a marketing company that openly bragged about doing exactly that. Cox Media Group (CMG), a large American media conglomerate, pitched advertisers on a product it called “Active Listening,” which it described as an AI-powered service that used microphones in smartphones, smart TVs, and smart speakers to harvest consumers’ conversations and target ads based on what people said in their homes. Internal pitch materials obtained and published by the investigative outlet 404 Media (in reporting that broke the story in December 2023, with the full pitch deck published in August 2024) promised to “capture real time intent data by listening to our conversations.” The materials even name-dropped Google, Amazon, and Facebook as partners — claims that drew swift denials and, in Google’s case, led to CMG being kicked out of its advertising Partners Program.

Then came the reckoning. In August 2026, the U.S. Federal Trade Commission finalized orders against Cox Media Group and two smaller marketing firms, MindSift and 1010 Digital Works, requiring them to pay a combined $930,000 — $880,000 from CMG and $25,000 each from the others — to settle allegations that they had deceived customers. According to the FTC, the Active Listening service was essentially fabricated: it did not use consumers’ voice data and did not listen to private conversations at all. Instead, the companies were largely reselling email lists obtained from other data brokers at a significant markup, while their claimed geographic targeting capabilities were also inaccurate. They had even falsely claimed consumers had opted into voice-data collection when they had not.

The FTC’s conclusion did not merely fail to confirm the listening theory — it cut the other way. The one company openly selling the eavesdropping dream was not actually eavesdropping; it was monetizing data-broker lists under a science-fiction brand name. The settlement funds were earmarked for refunds to the advertisers who had been deceived. The orders also prohibit the companies from misrepresenting their marketing capabilities, voice-data collection, consumer consent, and geographic targeting. As the agency noted, had the listening system actually worked as advertised without adequate consumer consent, that collection of voice data would itself have violated federal law.

The denials from the giants

The companies with the most to lose have been put on the record repeatedly. Facebook’s Mark Zuckerberg was asked directly, during his 2018 congressional testimony, whether Facebook uses audio collected from mobile devices to enrich advertising — and denied it. Instagram’s Adam Mosseri has likewise denied that the app listens through the microphone for ad targeting. Meta’s official statements have consistently said Facebook does not use phone microphones for advertising purposes.

Naturally, skeptics will note that corporate denials are self-serving. That is fair — and it is exactly why the Northeastern study matters more than any press statement. Denials are words; a year-long forensic analysis of 17,260 apps is evidence. The denials align with the evidence, but the evidence stands on its own.

What your phone is actually doing — the documented reality

Here is where the story turns genuinely unsettling, because the absence of microphone surveillance does not mean your privacy is intact. Far from it. The real machinery of ad targeting is well-documented, operates at enormous scale, and explains nearly every “creepy coincidence” without a single spoken word ever being recorded.

Location tracking. Your phone logs where you are constantly — not just through GPS, but through Wi-Fi networks, Bluetooth beacons, and cell towers. Retailers can track your movements inside stores; apps you have granted location access to can record your position in the background. That data flows to advertisers. The FTC has brought enforcement action over the misuse of location data, including cases involving data brokers selling sensitive location information.

Data brokers. Companies such as Acxiom and LiveRamp exist to buy, aggregate, and sell information about you: your purchases, your demographics, your browsing history, your household composition. When you bought that unrelated item with your credit card, or filled out a warranty form, or registered for a loyalty program, that data entered a marketplace where advertisers buy access to people like you. The Cox Media Group case is instructive here precisely because it shows how this works: CMG’s real “Active Listening” product was not listening at all — it was reselling brokered data, mostly email lists, under an exciting name.

Cross-device and identity resolution. Advertisers do not think in devices; they think in people. Through shared IP addresses, logged-in accounts, device fingerprinting (screen resolution, installed fonts, browser version, time zone, hardware details — a combination unique enough to identify you even in private browsing), and hashed customer lists uploaded by retailers, the ad system can connect your laptop browsing to your phone’s apps to your friend’s phone. Reporting on the September 2026 Vibe survey described this as “identity resolution working as designed”: the system may not know who lives at an address, only that browsing patterns coming from it tend to look a certain way — and that is enough to aim ads at you.

Co-location and social graph inference. This is the single most powerful explanation for the classic “we talked about it and the ad appeared” story. If your phone and your friend’s phone sat in the same living room for two hours, the platforms know you were together. If your friend then goes home and searches for that product, the system reasonably predicts you might be interested too — and serves you the ad based on their search, not your conversation. No audio required. The same logic applies when someone in your household buys or researches something: advertisers target the cluster, and you are in it.

Predictive and lookalike modeling. Modern ad systems do not need to know what you said; they need to know what people like you do next. Models trained on millions of user trajectories can identify that people who searched for X, visited Y, and bought Z tend to buy product A within seven days. Your “spooky” ad is a probability-weighted match, not a surveillance transcript. As Kaspersky’s researchers put it, advertisers have a record of almost everything else, and a remarkably precise model of what that record suggests you will want next.

Screen recording and analytics. And then there is the Northeastern study’s actual discovery: some apps record what is on your screen and transmit it to third parties. Unlike hypothetical microphone surveillance, this was documented in the wild. It remains one of the least understood and least consented-to data practices in the app ecosystem.

Why your brain insists it heard something

Even with all these mechanisms documented, the feeling of being listened to persists. Cognitive scientists have a name for a big part of it: the Baader-Meinhof phenomenon, also called the frequency illusion. Once something enters your awareness — you talk about a couch, you start noticing couches — you begin seeing it everywhere. The ads were already in circulation; Tuesday was simply the day you started looking. You will notice the one ad that matches your conversation and forget the thousand that did not.

Add two more ingredients and the illusion is nearly airtight. First, confirmation bias: we remember the hits and discard the misses. You do not remember the thirty conversations that produced no ads. Second, the opacity of ad targeting. When you click “Why am I seeing this ad?”, the explanations are vague or generic. As the Electronic Frontier Foundation’s Jason Kelley has noted, when platforms hide this information, people fill the gaps with the most obvious story — our devices must be secretly listening. In the absence of transparency, the microphone is the explanation that fits the human intuition of how attention works.

There is also the simple statistical reality that in a world where you see thousands of ads a week and have hundreds of conversations, coincidences are not rare events — they are guaranteed. What feels impossible to an individual is inevitable across a population.

The permissions your phone actually grants

Some important facts about how microphones actually work on modern phones, because they constrain what apps can do:

• Microphone access requires explicit permission. On both iOS and Android, an app cannot access your microphone unless you have granted it permission, and you can revoke it at any time in settings. An app silently recording without permission would have to exploit the operating system itself — a very different category of attack from ordinary app behavior.
• Your phone tells you when the mic is hot. iOS displays an orange dot at the top of the screen whenever an app is using the microphone (green for the camera); recent Android versions show a similar indicator. Continuous covert recording would announce itself in your status bar.
• Voice assistants only listen locally for wake words. Siri, Google Assistant, and their peers keep a tiny on-device model listening for a wake phrase; that processing happens locally, and broader audio is not continuously uploaded. This does not mean voice assistants are flawless — Apple paid a $95 million settlement over claims that Siri had activated unintentionally and captured private conversations — but unintended activation of an assistant is a different phenomenon from systematic ad surveillance, and the settlement itself underscores that the behavior was treated as a bug, not a business model.
• Targeted spyware exists, but it is not advertising. Tools like Pegasus can remotely activate a microphone, but these are precision instruments aimed at specific individuals — journalists, dissidents, officials — not population-scale advertising. Their existence does not support the ad-listening claim, and the people targeted by such tools have problems far beyond personalized ads.

What you can actually do about it

If the listening theory makes you uneasy, the good news is that the most effective defenses work against the real tracking machinery, not just the imagined one:

1. Audit microphone permissions. On iOS and Android, review which apps have microphone access and set it to “While Using the App” or revoke it for apps that have no business recording audio. Do the same for location access — set it to “While Using” or “Never” where possible.
2. Reset your advertising ID. Both major mobile platforms let you reset the ad identifier that stitches your activity together for advertisers, and limit ad tracking. It does not stop tracking, but it breaks the continuity of your profile.
3. Watch for the mic indicator. If the orange dot appears when no app should be recording, investigate.
4. Turn off ad personalization in Google, Meta, and Apple settings, and use the “Why am I seeing this ad?” controls to block advertisers that feel too close.
5. Limit location sharing — including background location for social apps — and consider a VPN on untrusted networks, though a VPN does not anonymize you against the platforms you log into.
6. Remember the broker economy. Much of your profile comes from offline purchases, loyalty programs, and data brokers. You cannot fully opt out, but data-broker opt-out services and privacy laws in some jurisdictions give you deletion rights worth using.

*Searches, location history, and browsing behavior explain most “it heard me” moments. Image: Unsplash.*

The Verdict

Verdict: Unproven.

The claim that smartphones secretly listen to private conversations to serve targeted ads is unproven — and the weight of the evidence runs against it. The most rigorous test ever conducted, Northeastern University’s year-long forensic analysis of 17,260 popular Android apps, found no instance of an app unexpectedly activating the microphone or sending audio to advertisers. Security experts point out that such surveillance at scale would be detectable through battery, data, and network anomalies — and that advertisers already have far cheaper, legal, and richly detailed data sources that make eavesdropping redundant. The one company that openly marketed a phone-listening ad product, Cox Media Group’s “Active Listening,” was found by the FTC in August 2026 to have fabricated the capability entirely — it was reselling brokered data lists — and was fined $930,000 for the deception.

We rate this “Unproven” rather than “False” for one reason of intellectual honesty: proving a universal negative — that no app, on no phone, has ever done this — is a standard no study can meet, and the Northeastern researchers themselves declined to claim it. What we can say is that after years of looking by academics, journalists, regulators, and the security community, nobody has produced credible positive evidence that it happens. Absence of evidence, rigorously pursued, starts to look like evidence of absence.

But do not mistake that for comfort. The real verdict of the research is more alarming than the myth: your phone does not need to listen, because it already knows. Location trails, purchase records, browsing history, social-graph inference, device fingerprinting, and a multi-billion-dollar data-broker industry combine into profiles so precise that ads can predict your desires before you have finished saying them out loud. The microphone was never the main surveillance device in your pocket. The main surveillance device is everything else.

*App permissions and SDKs harvest far more data than any microphone ever could. Image: Unsplash.*

The bottom line

The next time an ad seems to read your mind, resist the simplest explanation and consider the likelier one: you were not overheard — you were predicted. Somewhere in the machinery of brokers, trackers, and models, a pattern you left behind did the talking for you. The eerie part is not that your phone might be listening. It is that it does not have to.

That is a harder story to tell at dinner. But it is the one the evidence supports — and it points at real problems you can actually do something about, starting with the permissions screen on your phone tonight.

*Real protection means auditing app permissions, not covering the microphone. Image: Unsplash.*

Sources and further reading: the Northeastern University study (Pan, Ren, Lindorfer, Wilson, Choffnes, 2018) via reporting by Gizmodo, Business Insider, and BGR; the FTC’s August 2026 settlement with Cox Media Group, MindSift, and 1010 Digital Works; 404 Media’s December 2023 and August 2024 reporting on the “Active Listening” pitch deck; Kaspersky’s research center analysis; the Electronic Frontier Foundation; and the September 2026 Vibe/Pollfish survey on American attitudes toward ad targeting.