Your phone isn't secretly listening to you, but the truth is more disturbing

My younger bro is convinced phones are eavesdropping on conversations and got particularly paranoid (I thought) a year or so back in regard to talking in earshot of his phone.

His evidence is empirical - Apparently he gets pretty high with friends and shit talks - but when when the search started to suggest some pretty way out things along the same lines, he landed that their conversations weren't private any more.

So I have an understanding of how much tracking is going on so I pressed him on that. But he assured me it was stuff he would not even bother to look up in a clearer mindset and of course smoking recreationally for a very long time knows not to go near some tools that could land himself trouble or awkward explanations. That's probably true he says a lot of stuff that a half decent search would put him straight. In the end I just figured loose permissions of one of the many apps he's installed and that's how they (the app) make their money, selling illegally obtained data to more legal sources.

Permissions are the problem with android phones - there needs to be a specific install route for users, one that the app starts asking for things it should not need have access to, the installer refuses to install and suggests the user look for something better. Camera apps for example really don't need access to communication channels, if it's updates it's need, it can ask - one time access.

> Permissions are the problem with android phones - there needs to be a specific install route for users, one that the app starts asking for things it should not need have access to, the installer refuses to install and suggests the user look for something better. Camera apps for example really don't need access to communication channels, if it's updates it's need, it can ask - one time access.

I definitely don't want my phone making those decisions for me; I want my phone enabling me to make decisions. The app asks for permissions, I say no, and, rather than ratting me out to the app, my phone does its best to pretend to the app that it (the app) has the permission it wants, say by giving an empty contact book or whatever. (I know rooted phones can do this, but it shouldn't have to be something I have to fight my phone for.)

He is right, all modern phone brands are surveillance devices furnished to provide the OEM with identifying data: https://arstechnica.com/tech-policy/2023/12/apple-admits-to-...

> Apparently he gets pretty high with friends and shit talks - but when when the search started to suggest some pretty way out things along the same lines, he landed that their conversations weren't private any more.

I had an experience like this several years ago. I was having dinner with a customer, and one of the guys brought up this story about how he went to school with someone who got caught cheating on Who Wants to be a Millionaire. Later, back at my hotel, I pulled up YouTube and the first recommended video was of the guy who got caught cheating on the game show. I had not searched for this during the conversation (or prior) nor do I watch game show videos on YouTube, or cheating scandal videos on YouTube.

Here's what I think happened: somebody at the dinner googled it, and the video got recommended based either on geo-location data (we were in close proximity) or because the person who googled it was in my phone contacts, or maybe both. But, I don't think Google/Youtube was recording anyone's conversation to make that recommendation.

He’s right and everyone knows it. It's pretty blatant and there have been lawsuits settle rather than go to a trial that would surely reveal the extent to which this thing that’s obviously happening is happening

https://www.sfchronicle.com/bayarea/article/apple-siri-priva...

Something I discovered when going down this rabbit hole is that if you had that conversation in your house and your visitors have access to your wifi, it may be that they performed the search without you knowing, and your ISP connected that data to you and sold it (as they do).

Location location location.

- User 1 shows an interest in <topic>.

- User 1 visits the same location, for the same period of time, as user 2.

- So I show an ad for <topic> to user 2.

That's true. I had to rule that out by only counting instances when my friends and I were alone. If not, or Wifi is open, then who knows.

How would your ISP connect that data if every search engine uses HTTPS now, so there's no way for the ISP to see what you were searching for?

I attempted to debunk that one here (an admittedly impossible task but I can't help myself trying): https://simonwillison.net/2025/Jan/2/they-spy-on-you-but-not...

Yeah, it's Google and Facebook - not the ISP.

DNS lookups are still frequently in the clear, and even if they're not, that just means you're trusting some DNS-over-HTTPS provider. The incentives are perverse.

And of course whoever you are performing your search with, like, oh, an ad company like Google, Meta, or Facebook? They just might use that search data for something.

Exactly. Google or Meta can correlate behavioral data like this. Your ISP cannot do that by intercepting your searches.

I care about accuracy when it comes to privacy conversations. I don't want people wasting their time on theories that aren't true when they should be focusing on the real issues at stake.

A swan can't stop a hurricane

It is irrelevant. The suggestion that spying is for advertisement makes no difference.

That idea only exists to create fake two-dimensional anti-capilist rethoric, which is a rethoric easier to put down than the fact that privacy does not exist anymore.

So, I am supposed to do this. To "correct you" and look very lunatic.

It serves, however, a very specific goal. First, it cannot be copied en masse. If this behavior is copied (even as a meme), it implies doom to the more easier to defeat anti-capitalist rethoric and the birth of a true 3D anti-capitalist rethoric. It can only be mocked (smoking guy pointing to a conspiracy board), but that mockery is getting real serious real fast now.

Can I dive deeper into the mechanics of how this is gonna go?

We had so many chances, of doing good. You all had so many chances.

OK wow that actually fits here. https://simonwillison.net/2025/Apr/23/meaning-slop/

It could also be that YouTube started recommending this video to people for whatever reason, which was why it was on this guy’s mind.

Anything is possible, but he didn't start the conversation about cheating. Someone else brought up something to the effect of they thought game shows were fake, then he told his story and a third person the table searched for and showed the video.

His phone would have to be running a hotspot for any visitors (in many parts of the rural area in my locale, mobile data is it for the internet) but if any visitors were with the same carrier network, visitors could have searched. However it's entirely improbable any of his buddies would be on their phone while they're there unless it was a legit interest. Secondly this is stuff from what I gathered, some of is stuff that no one would really even think exists - it's shit talk speculation that's out past the black stump - no one once they're back to earth is ever going to bother to look up even a small aspect of it.

In his case a realistic answer falls towards loose or sneaky permissions in regard of an app that have slipped through that have allowed a weird conversation to influence suggestions in internet activity later on.

However for more grounded subject matters, the more probable strange coincidences falls to queries and visits to the net being scraped by external API and content (fonts scripts etc) providers. I've no idea how much meaningful info would normally be shared between the site and third party providers that seemingly need to be contacted while a site loads.

This matches up with my exact thoughts too. My old phone was an Android, and it was quite old in that the manufacturer hadn't updated it in a while. There were times when speaking about something would give me ads relating to it on Google, or posts in Instagram's case.

Then I got an iPhone and it stopped completely. My wife has a newer Android phone and the same things happen to her.

Now, I swear I read a few years ago that Facebook have teams to deliberately look for vulnerabilities to exploit, as well as things such as this: https://x.com/ashk4n/status/1070349123516170240.

So my personal conclusion(s) is this: 1. There are vulnerabilities in older (if not current) Android versions which companies like Meta exploit to eavesdrop at all times, or at least while the app is not closed. 2. Most people just provide the 'While using the App' or 'Always allow' permissions for the microphone/camera, so this basically gives permission for them to do that regardless, even if it's not what those permissions were requested for (sending a voice message, taking a picture to post etc), BUT now there are status lights for when apps are using the microphone/camera which I never noticed been activated on my wife's phone when using it, unless for the correct reasons.

Between all the apps people use daily which is pretty much Instagram/Twitter/TikTok/WhatsApp, microphone permissions tend to be enabled, and if they are, then most of someone's screen time is on an app with those permissions. Not to mention the 'Google' app on Android phones which seems to have every single permission enabled at all times that perpetually runs.

Sorry, but I'm not buying the "someone else in your home searched something similar" or "ads are so advanced that they can predict what you want" etc excuses. I'm extremely careful with what I search. I have never experienced this once I switched to an iPhone, but I have experienced it too many times when on Android.

For what it's worth, the ISP may not know the search terms entered, but it can see "google.com" followed by "itchybuttcream.net" when people click the first results. The data will grow more granular over time as users click the second or even third result on Google.

On WiFi you control this risk can be mitigated (force DNS to your own server that uses ODoH or similar) but for most people ISPs are still sitting on data gold mines obtained from passively observing DNS.

They can still get the hostname of the server you're connecting to through SNI, and that's far harder to hide. Most sites aren't using eSNI/ECH.

lol so it's getting that bad. Assigning meaning to random phrases is BS. If it keeps on going it'll start attributing meaning to misspelled words.

LLMs are only as good or bad as they are created - or their function / parameters? Google got real sad mid 00s - it's all about the money now isn't it.

Topic recently [1] re Google A.I. BSing.

[1] https://news.ycombinator.com/item?id=43748171 ('Epistemological Slop: Lies, Damned Lies, and Google' - <newcartographies.com>)

Searching for that phrase now shows your blog post as the top reference, and the AI overview now says it's a "nonsensical phrase used to illustrate how search engines can generate misleading or fabricated explanations for arbitrary inputs"! :O

Isn't this how proverbs come to life? "Bobs your uncle" - all these proverbs are made up...

Yes people are creative and time to time come up with phrases, comments or sayings that catch on. It's how popular jokes start out as well.

I'm not sure if you first thought it up or just repeated the term - as I see simonw meaning-slop link was posted as a separate post at HN 2 days ago.

However it's certainly bad when some piss poor LLM starts flogging some nonce as a meaning. For example when using less well documented idioms or terminology - google sadly isn't that great any more at finding stuff, so ... not good if it just makes stuff up instead. New creative stuff, sometimes people can get the gist of it but all the same no one wants the likes of a search assistant vomiting all over it.

I read it two days ago and found it fitting :)

I see your point - when LLMs just make stuff if to be helpful.

I’m basing my reasoning on the assumption that advertisers (such as google, meta, tictoc) are aware of your location at all times. (See: https://news.ycombinator.com/item?id=42909921)

Based on this assumption, it wouldn’t be necessary for any of your friends to search for the topic during an evening together.. it would simply be enough that one of the friends showed some interest in the topic prior to the hangout (searched for something, read a blog, stopped for too long on an instagram reel).

Then, during an evening together, your phones all share the same location (and possibly movement). That’s enough for advertisers to suspect there’s some relationship there. Enough of an association to attempt an ad placement (or instagram reel) for a particular obscure topic.

I'd agree on assuming that certain apps do or try as best they can with an aim to track not only location but presence of other wifi bluethooth device ids with time stamps, to help build patterns and a unique fingerprint for marketing purposes - on the basis it can once the app is given (accidentally perhaps) the necessary permissions.

As such, if location or device id data were available to build a larger picture, for any sort of common topic I'd agree the advertising could easily be a result of data analysis of various subsets of phones in a given region, applying algorithms and feeding it back into search results.

However like I said, the stuff was apparently way way out there zany - he ensured me he would ever bother searching for it. So zany in fact no one would ever bother. For all I know he may have ruled out other people and have just been talking to his pet dog and various other tame native animals that hang around his verandah. I would tend to believe way way out there as after a small smoke around me he's dribbling worthless bs. There's no low bar on my part either - something like if polka dot dogs exist I could accept as something that might / could be searched the next day by anyone who was involved in such a out there conversation, and as a result skew search results.

Any how I'm settled on it's one of the many worthless apps on his phone that exists because a website is not desktop friendly - as they say if the service is free, you're the product ...

It's not the ISP that's connecting you together, it's google. If two people are on the same network and one of them is searching for something, it's going to affect the other person's ads too.

man google's ai uses context clues better than some people I know. I kinda wish it wouldn't though, because it gives somewhat real sounding answers to things like that that actually have a different meaning because of historical and cultural context that it's not aware of. it should let you know when it's making something up using it's limited awareness of word meanings vs something that's an actual phrase that people use.