13 Two Sides of Mobile Privacy

13.1 What Leaves the Phone and What the Air Reveals

Start with a simple question: if this phone rode in someone's pocket all day, what could it tell others about that person? Some clues leave because an app is allowed to collect them. Other clues are read from the radio signals around the person, even when no app is open. Mobile privacy is the habit of checking both paths before trusting the design.

Mobile privacy is about what a phone, its apps, and the wireless world around it can learn about a person. It helps to see two distinct surfaces. The first is what apps actively collect and send: the permissions you grant, the data the app gathers, and the destinations it transmits to. The second is what the wireless environment can passively sense: signals from Wi-Fi and Bluetooth can reveal presence and movement without any app being involved at all.

This chapter is the map for four connected topics, which the rest of the module covers in depth: mobile data collection and permissions, leak detection, location privacy, and wireless sensing. The thread tying them together is a single review habit: do not trust what is declared; check what actually flows and what can actually be sensed.

Inspect Figure to separate data exposed through an active app from inferences made by ambient wireless sensing.

Read Figure along the active-app lane first: platform gates lead to app and SDK behavior, direct and derived data, destinations, and retention. Then follow the ambient lane from radio observations to tracking or presence inference, including bystanders with no app relationship. The center comparator tests declarations against evidence. Both lanes rejoin at minimization, safeguards, ownership, and retesting, but require different observations.

An analogy: a phone is both a microphone you carry and a beacon you emit. As a microphone it captures what you let it; as a beacon it radiates signals that others can read. Protecting mobile privacy means quieting both, not just one. The review loop also assigns an owner to each finding.

The One-Minute View

Beginner Examples

Work from the simplest case toward the broader design consequence. First, A weather app needs only a coarse location, so granting it precise, always-on location is more access than the feature requires. Next, an app can declare modest collection while an embedded third-party component quietly sends more; only inspecting the traffic shows the difference. Finally, A presence sensor built from Wi-Fi signal changes can tell whether a room is occupied without ever taking a photo.

Overview Knowledge Check

Start simple: name the data tap, watch the traffic, minimize the location trail, and remember that the air can reveal bystanders too. If you can see both the active and passive surfaces, you have the core idea. Continue to the review layer for a unified check across the four topics.

13.2 Review Collection, Leakage, Location, and Sensing Together

Run a single mobile privacy review that covers all four topics across both exposure surfaces, because a gap in any one undermines the others. Strong permission hygiene means little if an embedded component leaks data anyway, and careful app controls do nothing about passive sensing in the environment. Review collection, leakage, location, and sensing together.

Use the procedure below to turn the two-surface map into a bounded review: fix one feature or sensing deployment and its owner, gather declared and observed evidence for each applicable surface, minimise and test the changed design, then record a disposition and a retest trigger.

Use the flow in Figure after the two-surface map to turn those observations into a bounded decision and retest obligation.

Read Figure from scope and owner into separate declared, active-app, and ambient evidence lanes. Reconcile each match, gap, or unstated behavior, then minimize or redesign and run the surface-specific tests. The decision gate permits approval only with recorded limits and evidence; otherwise it holds or rejects release. Every branch ends with an owner and change-triggered retest, preserving the chapter's running accountability record.

Permissions: Grant the Least

Start with least privilege. For each permission ask what feature needs it, whether a coarser version would do, and whether it can be limited to when the app is in use. Modern mobile platforms support approximate location, one-time grants, and revoking access later, so the safe default is the narrowest grant that still lets the feature work, revisited as features change.

Leak Detection: Watch the Traffic

The only reliable way to know what an app sends is to observe its network traffic. Declared behavior and actual behavior can diverge, often because third-party components bundled into the app collect and transmit data of their own. A leak review inspects the destinations and the contents where possible, and treats any flow that is not explained by a feature as something to question.

Location and Sensing: The Subtle Two

Location deserves special care because a short trail of points can identify a person through their home, workplace, and routine, so prefer coarse precision and short retention. Wireless sensing is subtler still: signal changes can indicate that a room is occupied or that someone is moving, and nearby devices can sometimes be counted or tracked, all without the sensed person running any app. A complete review accounts for what the environment can infer, not only what the app collects.

Practitioner Knowledge Check

If you can review all four topics across both surfaces, you can stop here. Continue to the mechanism layer for why declared and actual behavior diverge, and why passive sensing breaks the usual consent model.

13.3 Check Declarations Against What Actually Happens

The deeper layer explains why mobile privacy resists trust-by-description. The gap between what is declared and what actually happens is where most surprises live, and passive sensing introduces a person who never agreed to anything.

A Permission Is Necessary, Not Sufficient

Granting a permission permits access, but it says nothing about how responsibly the data is used or where it ends up. An app with a single granted permission can still over-collect through embedded third-party components, send data to destinations the user never considered, or retain it far longer than the feature needs. This is why permission hygiene and leak detection are different checks: one limits what can be accessed, the other reveals what is actually done with it.

Traffic Is the Ground Truth

Because declared behavior is a claim, the network traffic is the closest thing to ground truth about what leaves a device. Inspecting it can reveal undisclosed destinations and unexpected data, though encryption limits how much of the contents can be seen, so a review often reasons from destinations, timing, and volume as well as contents. The discipline is to compare observed flows against the declared collection and to investigate every difference rather than explain it away.

Location Is Uniquely Identifying

Location data is unusually powerful because human movement is distinctive. A small number of points, especially the places someone sleeps and works, can single out an individual even without a name, and a continuous trail exposes routines, associations, and visits. Coarse precision, short retention, and on-device processing all reduce this, but the underlying lesson is that location should be treated as sensitive by default rather than as ordinary telemetry.

Passive Sensing Breaks the Consent Model

The active model assumes the person whose data is collected is the app's user, who can grant or deny permissions. Wireless sensing breaks this assumption. Signal strength and channel variations in Wi-Fi can indicate presence and motion, and devices that emit identifiers can sometimes be counted or followed, all performed by a third party about people who are merely nearby. Identifier randomization reduces some tracking, but it is not complete, and the sensed person typically has no permission prompt at all. Mobile privacy therefore has to consider bystanders, not only the holder of the phone.

Mechanisms and Failure Modes

Common Pitfalls

Review these failure modes in order. First, Trusting the description. Believing declared collection without checking the traffic. Next, Permission tunnel vision. Tightening permissions while ignoring embedded components. Then, Treating location as ordinary. Keeping precise, long location trails as if they were harmless telemetry. Then, Forgetting bystanders. Considering only the app user and not the people the wireless environment senses. Finally, No evidence. Reviewing once by reading, with no declared-versus-observed record.

Under-the-Hood Knowledge Check

At this depth, mobile privacy is a verification practice across two surfaces and four topics: limit what apps can access, observe what actually leaves, treat location as sensitive, and account for passive sensing of people who never opted in. A trustworthy review compares declared behavior with observed behavior, keeps evidence, and remembers the bystander as well as the user.