You've disabled microphone and camera permissions for all apps in your phone settings. Then you open an app and see an ad for a product you discussed with a friend yesterday.

Your first thought: "It's listening to me."

Not necessarily. What truly drives those precise ads is a data pipeline you cannot turn off. It activates with every click, every scroll, every moment you open an app.

It's Really Not Listening

You're not alone in this suspicion. In 2019, security firm Wandera and Northeastern University each conducted large-scale experiments to test the "app eavesdropping" hypothesis. The former placed phones in two rooms playing ad audio and silence for three days; the latter analyzed 17,000 Android apps. Neither found any app activating microphones in the background for advertising purposes. In 2025, a cross-national study published in Big Data & Society surveyed 886 respondents from the US, Netherlands, and Poland. Among them, 72% of American respondents believed their phones were wiretapping through microphones to push ads. The more frequently people experienced conversation-related ads, the stronger their belief.

Widespread suspicion doesn't equal truth. More direct evidence comes from regulators. In May 2026, the FTC took enforcement action against Cox Media Group and two other companies for claiming their AI "active listening" service could capture conversations through smart device microphones and push targeted ads in real time. The FTC's investigation conclusion was straightforward: they had never collected any voice data. This alleged "listening" was simply buying email lists from data brokers and reselling them at a markup. The three companies were fined a combined 930,000 dollars.

Here's the question: If it's not listening, how does it know about you?

Layer One: Digital Traces You Leave Intentionally

Search history, loyalty card purchases, e-commerce transactions. You're aware of these, but you underestimate how connectable they are. Data brokers buy records in bulk from retailers and airlines, then connect them across platforms through email hashes, assembling your complete profile.

But that's not the part confusing you most. The truly hidden part is what you cannot turn off.

Layer Two: Data You Virtually Cannot Disable

This is the core problem: it happens without your knowledge or consent.

Whenever you visit any website or use any app's embedded browser, your device passively sends information for normal rendering: screen resolution, operating system version, browser type, font list, language settings, time zone, battery status, CPU cores. Individual data points are meaningless, but together they create an almost unique digital identity. The EFF's Panopticlick project proved long ago: the vast majority of browser fingerprints are unique, independent of cookies, logins, or any permissions. App WebViews and third-party SDKs on mobile use the same technologies.

An overview of core fingerprinting techniques:

Cross-app tracking, similar audience association, location-based targeting: these mechanisms work like mind reading. Researchers at Imperial College summarized it: algorithms can know what interests you before you're aware of it yourself. From an engineering perspective, eavesdropping isn't cost-effective: continuous recording drains batteries quickly, and both iOS and Android show indicator lights. Getting caught destroys business existence. The cost is too high, and alternatives are too abundant.

Layer Three: Real-Time Bidding, Your Data Broadcasts Without Your Knowledge

You already have a profile: device fingerprint linked to browsing history, purchase records anchoring spending power, location data mapping your lifestyle. How does this profile become an ad?

When you open any app with ad slots, within hundreds of milliseconds:

• The app sends a signal package (device ID, IP, location, audience tags) to the supply-side platform
• The platform broadcasts to ad exchanges, which broadcast to dozens of demand-side platforms
• Demand-side platforms decide: "Is this person worth bidding for?"
• The highest bidder's ad displays

The issue isn't bidding itself, but data leakage: all parties receive your data regardless of whether they win the bid. Display ad bidding volume in the US and Europe alone reaches approximately 178 trillion transactions annually, each one a broadcast containing personal data.

This situation is triggering increasingly strict regulation. In 2024, the EU Court of Justice ruled in IAB Europe that "transparency and consent strings" in real-time bidding constitute personal data, making industry associations responsible as data controllers. GDPR enforcement intensifies: fines reached €1.2 billion in 2025 alone, exceeding €600 million in the first half of 2026, with ad-targeting violations comprising the highest portion.

This entire process requires no microphone, no camera.

What You Can and Cannot Do

Effective measures:

• Use Firefox or Brave (with built-in fingerprint protection) instead of Chrome
• Use independent accounts across platforms; avoid "Sign in with Google"
• If still using current phones: Regularly reset your advertising ID (iOS: Settings > Privacy > Apple Advertising > View Ad Targeting Information > Reset Advertising Identifier / Android: Settings > Privacy > Google Ads). If using PlugOS: the system has no advertising ID concept, no action needed.
• Use data deletion services (like Incogni) to clean up broker records

Measures with limited effectiveness:

• Disabling microphone and camera permissions: the ad ecosystem doesn't depend on them
• Using only VPN: cannot block device fingerprinting
• iOS "Ask App Not to Track": only blocks IDFA, doesn't affect device fingerprinting and first-party data

But these are tactical measures, another layer on a patched old wall. The operating system itself collects data in the name of "improving experience." Telemetry at the system framework level and fingerprint parameters exposed by browser engines can't be solved by toggling a few switches.

A Different Approach: What If the OS Itself Never Created These Pipelines?

PlugOS represents a different philosophy: a privacy operating system running on dedicated hardware.

Sensor Virtualization: Making Fingerprinting Algorithms See False IDs

Apps and ad SDKs create device fingerprints by reading hardware parameters like device serial numbers, MAC addresses, location, carrier, and so forth. PlugOS intercepts these requests at the system level. For hardware identifiers such as device serial numbers, MAC addresses, and IMSI, the system automatically provides generalized defaults or returns different random values to different apps. For environmental information like location and network carrier, users actively set virtual coordinates or simulate network status through a centralized privacy control panel. Each data point is controllable. Fingerprinting algorithms create an uncorrelatable "device face." Not a browser patch, but operating system-level source blocking. When real hardware is needed, users can also pass through the host's camera, microphone, and other sensors to specific apps on demand, with ability to revoke authorization anytime, achieving flexible switching between functionality and privacy protection.

Zero Data Collection: No Profile, No Targeting

Traditional operating systems collect usage data, crash reports, and behavioral analysis by default. Ad systems use these to build your profile. PlugOS removes all telemetry and analytics components at compile time. No Google Services Framework, no crash reporting, no background behavioral analysis. Keyboards don't predict to the cloud, browsers don't return histories, systems don't build user profiles. It's not "you can opt out," but rather "it was never enabled to begin with."

Summary and Guidance

Back to the original question: Why do you still get personalized ads after disabling microphone and camera permissions? Because the ad ecosystem never depended on them. Your device fingerprint, browsing history, purchase data, location trajectory, and the real-time bidding broadcast within those hundreds of milliseconds each time you open an app constitute a data pipeline far more efficient, stealthier, and cheaper than "eavesdropping." Defensive measures range from strong to weak, but the real solution lies not in disabling more permission switches, but in a system that doesn't collect this data from the start.

This article is based on public research, regulatory documents, and industry reports from 2019 to 2026. It does not address state-level device monitoring (a different threat model) or future impacts of AI models on ad targeting. Technology and regulations continue evolving. This article reflects conditions as of 2026.

Sources

• Segijn, C. M., Strycharz, J., Turner, A., & Opree, S. J. (2025). "My phone must be listening!": Peoples' surveillance beliefs around devices "listening" to offline conversations. Big Data & Society, 12(2). https://journals.sagepub.com/doi/10.1177/20539517251337102
• CJEU C-604/22, IAB Europe (2024). https://curia.europa.eu/juris/liste.jsf?num=C-604/22
• EPIC, "What is Real Time Bidding" (2025). https://epic.org/what-is-real-time-bidding/
• EFF, Cover Your Tracks / Panopticlick (2025). https://coveryourtracks.eff.org/
• Wandera experiment via BBC (2019). https://www.bbc.com/news/technology-49567182
• Northeastern University, "Are mobile phones listening to serve targeted ads?" (2019). https://news.northeastern.edu/2019/07/10/are-mobile-phones-listening-to-serve-targeted-ads/
• DLA Piper, GDPR Fines Survey (2026). https://www.dlapiper.com/en/insights/topics/gdpr-fines