How we know
The definitive study is Pan, Ren, Lindorfer, Wilson, and Choffnes 2018, "Panoptispy," published in Proceedings on Privacy Enhancing Technologies. The team instrumented 17,260 Android apps and watched every audio, video, and image stream leaving the device. They found 9,000 apps with the microphone permission. They found zero sending audio recordings to advertisers. They did find apps sending screen recordings without notifying users, which is a different problem.
The mechanism behind targeted ads is documented separately. Browser fingerprinting identifies 84 percent of browsers uniquely from fonts, screen size, and installed plugins (Eckersley 2010, Panopticlick; updated by Laperdrix 2020). Location data is shared every few minutes by most apps that ask for it. Purchase data is matched across stores by data brokers within hours, documented in the FTC's 2024 staff report on social media data practices.
Combined, these signals predict purchases accurately enough that targeting feels like eavesdropping. It is not. It is inference.
What it means
The microphone-spying theory is the wrong thing to worry about. The actual surveillance is more invisible and more accurate. If you want to reduce targeted ads, three settings do most of the work. Limit ad tracking in iOS settings. Reset your advertising ID. Disable cross-app tracking permissions for individual apps.
None of this stops Google or Meta entirely, but it does break the cross-site signal chain that lets advertisers match your fingerprint to your purchases. The microphone, ironically, is the safest sensor on your phone.
The 2026 update
On 22 May 2026 the FTC settled with Cox Media Group, MindSift, and 1010 Digital Works for a combined 930,000 dollars. The companies had been marketing a product called Active Listening that claimed to analyze ambient phone audio for ad targeting. The FTC ruled the product had no actual voice analysis capability. The settlement does not validate the listening myth. It penalizes companies for pretending to do something the underlying tech does not actually do.