Nobody asked your phone for this.

What My Phone Knows is a free Android app. It finds the trackers inside the apps on your phone and tells you what each one can reach. The readout here filled itself in the second this page opened, with no prompt and nothing to agree to. The app goes a good deal further.

Tell me when it’s outSee what it shows you

Read from this browser, just now

Time zone
Roughly where in the world you are, without anything asking for your location.
Language
Likely country, and sometimes a first language different from the one spoken around you.
Screen
Phone or laptop, and which tier of it.
Device
What you are holding, and often roughly what it cost.
Processor cores
How new and how expensive the machine is.
Appearance
Little on its own. It is here because the list keeps going.

This list stayed in your browser. It was read on the page, shown to you, and forgotten when you close the tab. The ads at the bottom of the page are a different story, and they say what they send.

None of that needed a permission

6lines read from this browser with no prompt

The prompt you remember agreeing to isn’t where most of this happens. A permission covers the things a phone treats as dangerous: your camera, your microphone, your exact location. Everything in the list above sits outside that, because on its own each line describes millions of people.

Put six of them side by side and the group gets small fast, and it stays the same group every time you come back. That’s the part that does the recognizing, and no dialog is involved in it.

“My data” is at least seven different things

Each rung is worked out from the one below it. Climbing gets more specific about you, and it happens by arithmetic, not by anyone asking again.

Layer 1: Signal

Raw output from the hardware.

Accelerometer samples. GPS fixes. Which Wi-Fi networks are in range.

Layer 2: Event

Things the operating system noticed happening, with a time on them.

Screen on at 6:14. App opened. Photo saved. Charger plugged in.

Layer 3: Record

A typed value someone chose to write down.

Steps: 8,412. Weight: 184.2 lb at 07:03.

Layer 4: Pattern

The same records, added up over time.

Asleep 11:40pm to 6:15am. Nine hours at the same place every weekday.

Layer 5: Trait

A stable fact about you, not about the phone.

Where you live. Where you work. Roughly what you earn. Who else lives there.

Layer 6: Inference

A guess about you, with a confidence attached and no way to check it.

Likely a new parent. Likely shopping for a car. Likely training for something.

Layer 7: Consequence

What gets done with the guess.

Which ads you get. Which price you see. Which list you end up on.

The line that matters. Everything up to Pattern describes a device. From Trait upward it describes a person. You consent down at Record and get characterised up at Inference, and nothing in between ever shows you a dialog.

One card per app, for the trackers inside it

It opens the code inside each app in your launcher and looks for app trackers it recognizes. Every one it finds gets the same four beats, because a scanner that stops at naming the tracker has told you a fact you can’t use.

  1. 01

    The story

    What is in there, counted plainly. “Google Play Store contains 2 tracking libraries from 1 company.” No adjectives.

  2. 02

    How it works

    The ladder above, drawn only as far as those libraries ordinarily climb. A crash reporter stops at Event, and the card says so instead of reaching for the top rung.

  3. 03

    The law

    Why this is allowed and what gives you a lever. It’s being written properly from coursework, with sources. Until then the app leaves the space empty and says why, because an app that invents a statute is worse than one that stays quiet.

  4. 04

    Your move

    The one setting that actually changes something, and a button that opens it. Where nothing would change, it says that too.

The app’s report for Google Play Store: 2 tracking libraries from 1 company, AdMob and Firebase Analytics, then the ladder showing how far they climb.
A screen from the app. This one is the report for Google Play Store.

Matched against 405 known app trackers, bundled in the app and refreshed when the app updates. A tracker being present means its code is in there. It doesn’t prove it ran, and the app doesn’t claim otherwise.

Asked here, before you have to ask them

What does my phone know about me?
More than any one permission covers. The six lines at the top of this page came from your browser with no prompt, and an app you install can read a good deal more. The useful question is which of your apps carry trackers, and how far those trackers can climb. That’s what the app shows you, one app at a time.
Is my phone tracking me?
Some of your apps almost certainly carry tracking code, in the ordinary advertising and analytics sense: code from a company other than the one that made the app. That’s a different thing from a person following your location on purpose. This app is about the first kind, and it tells you which apps carry it.
How do I reset my Android advertising ID?
On most Android phones it’s in Settings, under Privacy, then Ads. Newer versions let you delete the ID outright instead of resetting it. Phone makers move it around, so if it isn’t there, search Settings for “ads”.
Does it need permissions?
Four, and all four are there for the ad: internet access, network status, the advertising ID, and one that keeps the phone awake while a request finishes. No location, no storage, no contacts, no camera, no microphone. The scan itself needs none of them. That’s a short enough list to check rather than believe, and the app’s own build fails if a library slips anything else in.
Why does this page have ads?
Because an ad is the quickest way to watch all of this happen, and describing one is a poor substitute for showing you. The app carries one for the same reason. Here the Ads section at the bottom lists what your browser sends to get it, with your own values filled in.
Does it send anything anywhere?
Nothing comes to us. There’s no account and no server on our end, so there’s nowhere for your scan to go even if we wanted it. The one thing that goes out is the ad, and only after you tap for it: that sends and receives the basic metadata an ad request runs on, and the app lists every piece of it on screen before you ask. Android apps have to declare network access before they can use it, so you can check the whole list against the file in about ten seconds.
Is this an anti advertising app?
No, and it would be a worse app if it were. Plenty of people prefer ads that match what they’re interested in. The point is knowing what gets made and how it combines, not being told how to feel about it.
What does it cost?
Nothing. There is no subscription, no upgrade and no account to make.
What can it not see?
Apps without an icon in your launcher, which includes most of what the manufacturer preinstalled. And anything a tracking library does at runtime, because reading code tells you what is in an app, not what it did this morning.

It’s the test the course asks you to run

Your Data Rights is a plain English course on what companies collect and what you can do about it. Its first module ends by asking you to reset your advertising ID and run the test yourself. This is that test. The course covers the law and the history, this shows you the phone in your hand, and both are free.

See what the course covers

The course is being written now, so it is on the same schedule as the app.

Three honest ways to leave this page

  • Tell me when it’s out

    One email when it lands on Google Play. Nothing else, ever.

    Email me at launch

  • Read the why instead

    The course this pairs with covers what the law says, which is the half an app can’t show you.

    See what the course covers

  • Just looking

    Fair enough. Scroll back up and read the six lines this page got without asking. That was the whole argument.

    Back to the top

The ad is part of the lesson

A good personalized ad is useful. It’s how plenty of people find things they end up loving. It works because your browser hands the ad server a few facts every time it asks for an ad.

Here are those facts with your values in them, and the published audience segments each one can feed.

What this can’t show you is why you got the ad you got. Google doesn’t tell the site that, and nobody else in the chain does either. So these are segments a signal can support, from lists anyone can look up. It’s not a claim about which ones you’re in.

What your browser sends with the request

Region, from your IP address
Not visible to this pageYour IP address goes out with every request, and the ad server turns it into a city or region. This page would need a server of its own to see it, so it doesn’t.

Supports segments like

  • Google affinity/News & Politics/Avid News Readers/Avid Local News Readers
  • IAB Audience Taxonomy 1.1Demographic | Household Data | Household Income (USD)
  • Google affinity/Travel/Travel Buffs
Browser and device
Sent as the user agent string with every request.
Language
Sent as your browser’s language preference.
Time zone and hour
The ad script reads this the same way this page did.
Cookies and consent
This is what decides whether the rest gets tied to your history, or only to this one visit. Every segment above that’s about your past depends on it.

Where the platforms show their side

Google and Meta both let you see the interests they have on file for you, and change them. That’s the half this page can’t show you.