What an app can see about you, and what it cannot
Discussion of tracking tends to be either alarmist or dismissive, mostly because the specifics are rarely laid out. Android's permission model is genuinely strict about the sensitive categories. It is much less strict about a middle layer of information that identifies you well enough for advertising purposes, and that is where most tracking actually happens.
Available with no permission at all
| Item | What it enables |
|---|---|
| Advertising ID | Linking your activity across apps from different companies |
| Device model, screen, language, timezone | A fingerprint that narrows you to a small group |
| Whether you are on WiFi or mobile | Coarse location and context |
| Installed app list, in limited form | Inference about interests and demographics |
| Your IP address | Country, city, and often your network operator |
| Accelerometer and other sensors | Movement patterns, and gait is surprisingly identifying |
Anúncio
The settings that matter
- Delete the advertising ID Settings, Privacy, Ads. On recent Android there is a delete option that makes apps see a string of zeroes instead.
- Turn off usage and diagnostics Reduces what the system itself reports.
- Audit background location The most valuable single data point an app can collect, and the one least often needed.
- Check the privacy dashboard It shows which apps used the camera, microphone and location in the last day. Look at it once.
- Turn on encrypted DNS Stops your network operator building a list of the sites you look up.
What genuinely needs permission
- Contacts, calendar, call log
- Camera and microphone
- Precise location
- SMS content
- Files you did not select
- Body sensors and health data
- Advertising ID, unless you opt out
- Device characteristics
- Network type and IP
- Motion sensors
- Which app opened it
- Time and usage patterns within the app
The left column is well protected and gets most of the attention. The right column is how commercial tracking mostly works, and the strongest lever you have over it is the advertising ID setting.
Apps that reduce what leaks
Blocks third-party trackers in the browser and, with app tracking protection, in other apps too, using a local filter rather than a remote server.
Content blocking on by default, plus container-style isolation of sites from one another.
Blocks trackers and fingerprinting attempts at the browser level, which covers a large share of everyday exposure.
For the cases where the IP address itself is the thing to hide.
Delete the advertising ID, audit background location, turn on encrypted DNS, and use a browser that blocks trackers.
Frequently asked questions
Can an app read my other apps' data?
No. Android isolates apps from each other. It can sometimes see which apps are installed, which is different and much less sensitive.
Does an app know who I am?
Not by name unless you told it. It can usually recognise you as the same person across sessions and often across apps, which is what matters for tracking.
Is deleting the advertising ID enough?
It removes the easy link. Fingerprinting from device characteristics still works, less reliably, and browser-level blocking covers more of the rest.
Read next
This is not a rivalry. Each does something the other cannot.
You are not buying encryption. You are buying an operator whose income does not depend on you.
For a plain ZIP either works. For a split, password-protected archive, only one does.
