In short: Your phone is tracked from several directions at once: apps through the permissions you grant, ad networks through your device advertising ID, your carrier and the websites you visit through your IP address and DNS lookups, and in rarer cases stalkerware and Bluetooth tags such as AirTags. Perfect anonymity does not exist, but most tracking is removed by basic hygiene: auditing permissions, resetting the advertising ID, installing updates, and encrypting traffic with a VPN on untrusted networks. Below we break down each channel and give an action checklist for iPhone and Android.
Who tracks your phone and how
Phone tracking is not a single bug planted on your device — it is several independent data streams. Once you know who collects what, it is easier to apply targeted defense instead of pointless paranoia.
- Apps. Once granted access to location, microphone, contacts or storage, an app can collect that data in the background and share it with its developer and partners.
- Ad networks. They link your activity across different apps through the advertising ID (IDFA on iOS, AAID on Android) and build an interest profile.
- Carrier and websites. Your ISP sees which domains you connect to, and every site records your IP address and device characteristics.
- The operating system and cloud services. Location history, backups and sync are convenient features that double as a log of your movements.
- Spyware and tags. A separate, rarer category: manually installed stalkerware or a planted Bluetooth tracker.
These channels do not overlap: turning off ad tracking will not hide your IP, and a VPN will not revoke permissions an app already holds. That is why real protection is always layered.
Tracking methods and what actually helps
The table below is a threat map: tracking channels in the rows, tools in the columns. It also shows the honest limits of a VPN — it covers the network layer but does not touch what happens inside the device.
| Tracking method | What is collected | Does a VPN help | What actually helps |
|---|---|---|---|
| App permissions | Location, contacts, microphone | No | Audit and revoke permissions |
| Advertising ID | Cross-app interest profile | No | Reset or delete the advertising ID |
| ISP and DNS monitoring | List of domains you visit | Yes | VPN plus private DNS |
| IP address and network geolocation | Approximate location, session linking | Yes | VPN, IP change |
| Public Wi-Fi | Unencrypted traffic, interception | Yes | VPN, HTTPS, avoiding open networks |
| Spyware (stalkerware) | Messages, screen, coordinates | No | Anti-malware, factory reset, password change |
| Bluetooth tags (AirTag) | Physical movements | No | Tracker scanner, Bluetooth off |
App permissions: where most data leaks
The largest tracking channel is not hackers — it is legitimate apps you granted access to yourself. A flashlight that asks for contacts, or a game with location set to Always, are classic cases of excessive permissions.
The key principle: an app needs access only while you are actively using it. A navigation app needs your location during a trip, not around the clock. A messenger needs the microphone during a call, not all the time.
Pay special attention to three permissions: location, microphone, and access to photos and files. These paint the most sensitive picture of your life. Both platforms show an activity indicator — a dot in the status bar that lights up when an app uses the camera or microphone. If it flashes for no reason, that is a cue to check what is calling them.
Ad trackers and profiling
Every device has an advertising ID — an anonymized but stable marker that ad networks use to recognize you across different apps. On its own it carries no name, but combined with other signals (model, activity times, approximate location) it becomes a detailed profile.
You can fight this on two levels. At the device level, resetting or fully deleting the advertising ID strips networks of the cross-app marker. At the network level, a VPN and private DNS stop ad and analytics domains from matching requests to your real IP. This does not remove tracking entirely, but it makes profiling noticeably harder.
To understand where network-level privacy ends and device privacy begins, read our breakdown of what a VPN protects against — it sets the honest boundaries.
Spyware and Bluetooth tags
Stalkerware is commercial spying software that someone with physical access to your phone installs by hand. It hides behind system-looking names and forwards messages, coordinates and screen contents. Indirect signs: fast battery drain, heat while idle, unfamiliar apps holding device-admin rights.
Bluetooth tags (Apple AirTag, Samsung SmartTag and similar) are meant for finding belongings, but they are also used to track people by slipping one into a bag or car. Modern iOS and Android can warn you about an unknown tracker that moves with you.
- Regularly review installed apps and which ones hold device-admin rights.
- Do not ignore the system alert that an unknown tracker is moving with you.
- If you have well-founded suspicion of stalkerware, back up your data, factory-reset the phone, then change every password from a different device.
A VPN is useless here — these are device-level threats, not network ones. Do not confuse the layers of protection; for the bigger picture see VPN vs proxy vs Tor.
Your network footprint: IP, ISP and public Wi-Fi
Even with perfectly tuned permissions, your phone leaves a network footprint. Every site sees your IP address, which reveals your approximate region and links sessions together. Your carrier or the Wi-Fi owner sees the list of domains you reach, even when the page content is encrypted over HTTPS.
This is where a VPN works: it encrypts all of the phone's traffic and routes it through its server, so your ISP only sees that you connected to a VPN, not which sites, and sites see the server's IP, not yours. That closes the network layer of tracking and matters most on public Wi-Fi, where traffic is easier to intercept.
If you are still choosing a service, our guide on how to choose a VPN in 2026 and the DNS leak test explain what to check. For a phone connection with no complex setup, see LiMP pricing — the app brings up an encrypted tunnel in one tap on iOS and Android.
Privacy settings: iPhone and Android
iPhone (iOS)
- Privacy & Security → Location Services — switch apps to While Using and turn off Precise Location where it is not needed.
- Tracking — disable Allow Apps to Request to Track to block access to the advertising identifier.
- App Privacy Report — shows which sensors and domains apps have reached.
- Lockdown Mode — for high-risk users: it sharply reduces the attack surface.
Android
- Privacy → Privacy Dashboard — a log of app access to camera, microphone and location.
- Ads → Delete advertising ID — fully zeroes out the cross-app ad marker.
- Permissions → auto-reset for apps you have not used in a while.
- Private DNS — encrypts DNS queries at the system level.
If you are just setting up a secure connection, our step-by-step guides for iPhone and Android walk you through it.
Checklist: lock down phone tracking in one evening
- Go through your app list and revoke location, microphone and camera from anyone that does not need them constantly.
- Reset or delete the advertising ID and stop apps from requesting tracking.
- Turn on Private DNS in system settings.
- Install system updates — they patch known vulnerabilities.
- Review apps that hold device-admin rights and remove anything unfamiliar.
- Turn on a VPN and keep it active on any network that is not yours.
- Do not ignore alerts about unknown Bluetooth trackers near you.
- Repeat the audit every couple of months — new apps keep asking for access.
Frequently asked questions
Can a VPN make my phone fully anonymous?
No. A VPN hides your IP and encrypts traffic, but it does not turn off app permissions, delete the advertising ID, or fight spyware. It is one layer of several.
How do I know if my phone is being tracked?
Indirect signs include unexplained battery drain and heat, a spike in background mobile data, the camera or microphone indicator flashing for no reason, and unfamiliar apps with admin rights. Individually these are not proof, but they are a reason to check.
Does incognito mode protect me from tracking?
Only partly: it keeps history and cookies off the device, but your IP, ISP and the sites still see you. To hide the network footprint you need a VPN.
Should I cover my phone's camera and microphone?
For most people that is overkill. Controlling permissions and watching the activity indicator is enough. Physically blocking the microphone is justified only under a specific threat.
Does turning off location stop me from being located?
It stops precise GPS coordinates, but your approximate region is still derived from your IP address and cell towers. Hiding the region fully also requires a VPN.
Will a factory reset stop tracking?
A reset removes installed spyware and most tracking apps, but it does not prevent reinstallation or change your habits. After a reset, change passwords from another device and reconfigure your privacy settings.
Are free VPNs just as safe for privacy?
Not always: some free services monetize user data, which defeats the purpose. Look for a no-logs policy and a transparent owner.