0

Type to search the shop and Field Notes.

How Phones Are Tracked: Carriers, Apps, Stingrays, Spyware

Last reviewed

By Dark Flock

Updated

You don't have to use your phone for it to give you away. Switched on, it checks in with the nearest tower every few minutes. Its apps ask where you are. Its ad libraries pass the answer along. None of that needs a hacker. Most of it is a business model.

Tracking comes in two kinds. Passive tracking is the record the phone leaves just by working: carrier logs, Wi-Fi chatter, app location sold through brokers. Active tracking is someone going after the device itself: a fake cell tower, a forensic unlocking kit, spyware. The first catches everyone. The second is aimed. This guide covers both, what the courts have said as of October 20, 2026, and what lawful settings actually change.

How we sourced this: court opinions, FTC orders, government audits, and contract records first, then reporting from established outlets; company claims are labeled as the company's, and anything only reported is marked as reported.

Passive phone tracking: the record you leave by carrying it

Can police get my location from my cell carrier?

Your carrier has to know roughly where your phone is to route a call. It keeps that record: which tower and which sector the phone connected to, and when. Lawyers call it cell-site location information, or CSLI.

In 2018, in Carpenter v. United States, the Supreme Court held that police getting seven days of a person's historical CSLI from a carrier is a Fourth Amendment search, which generally requires a warrant. The Court wrote that a phone "faithfully follows its owner beyond public thoroughfares and into private residences, doctor's offices, political headquarters, and other potentially revealing locales."

Carriers have also sold it to people who are not police. In April 2024, the FCC fined AT&T, Sprint, T-Mobile, and Verizon nearly $200 million combined, finding that each sold access to customers' location to "aggregators" who resold it, often with no valid customer consent. AT&T and Verizon argued that they were owed a jury trial. On June 4, 2026, the Supreme Court rejected that argument 8 to 1 in FCC v. AT&T.

What is a tower dump?

A tower dump is the reverse: instead of asking where one phone went, police ask for every phone that connected to a given tower during a window of time. Near a highway, that can be thousands of strangers.

On August 5, 2026, U.S. District Judge Carlton Reeves in Mississippi refused to approve four such warrants and held that "tower dumps are per se unconstitutional," calling them general warrants. He relied on Carpenter, Chatrie, and the Fifth Circuit's 2024 ruling in United States v. Smith, which called geofence warrants general warrants. The government filed its appeal to the Fifth Circuit on September 3, 2026. It is one district judge so far. Elsewhere, tower dumps continue.

Can Wi-Fi and Bluetooth be used to track my phone?

With Wi-Fi on, a phone periodically broadcasts "probe requests" looking for networks it knows. Bluetooth devices advertise themselves too. Each radio has a hardware address, and a sensor that logs those addresses can count and follow devices: in stores, in transit stations, and now, Leonardo says, beside license plate readers (we covered its SignalTrace product in our Flock camera guide).

Phone makers answered with MAC address randomization: the phone shows a different, made-up address to networks and scanners. Apple calls its version a private Wi-Fi address. It helps. It is not a cloak. A 2021 study in Proceedings on Privacy Enhancing Technologies found modern, updated phones resisted most known tricks for linking randomized addresses, while many older devices remained vulnerable. Earlier research showed that timing and the details of each probe could link a device's random addresses back together. Randomization raises the cost. It doesn't erase the trail.

How do apps sell my location data?

Most commercial location data starts with a permission you granted to an app that had a reason to ask: weather, a game, a prayer-time app, a transit map. Many apps embed third-party code, called an SDK, that collects GPS coordinates and sends them to a data company along with your phone's mobile advertising ID. The ID is not your name. It doesn't need to be. A device that sleeps at one address and spends the workday at another tends to identify itself.

Since 2022, the FTC has described the market in its own complaints:

Note what these orders do: they wall off clinics, churches, shelters, and protests. Selling everyone's ordinary movements isn't banned by any of them.

What is bidstream data, and why does it leak location?

Every time an app loads an ad, it can broadcast a bid request to many companies in a real-time auction. The request can carry your ad ID, device details, IP address, and sometimes location. Only one bidder wins the ad. All of them can keep the data.

The Mobilewalla order was the first time the FTC called that harvesting unfair: the company is now banned from collecting auction data for purposes other than bidding. In January 2025, a hack of Gravy Analytics exposed files that 404 Media and WIRED reported listed thousands of apps, including Candy Crush, Tinder, and MyFitnessPal. Researchers believed the data was skimmed from the ad auctions rather than collected by the apps themselves. You can do everything right inside an app and still be in the bidstream.

Can police buy my location data without a warrant?

They have, and they do, and the Supreme Court has not said they can't.

The theory behind all of it is that a warrant is for compelling data, and buying it is just shopping. Our data broker guide covers that loophole and the bill that would close it.

Are geofence warrants still legal after Chatrie?

A geofence warrant asks a company for every device inside a drawn boundary at a given time, then narrows the list until it gets names. In 2020, Google got more than 11,000 of them.

On June 29, 2026, in Chatrie v. United States, the Supreme Court held that police conducted a search when they obtained Okello Chatrie's Location History from Google. Justice Kagan wrote for the Court: "An individual has a reasonable expectation of privacy in records about his cell phone's location," and police intrude on it "even though for only a limited time, and from a third-party tech company." The Court rejected the government's argument that turning on Location History was a voluntary handover. Justice Gorsuch concurred in the judgment on different grounds. Justices Alito, Thomas, and Barrett dissented.

What it did not decide matters as much:

The practical ground had already shifted. The opinion notes that in July 2025 Google began storing Location History on users' devices rather than its servers, and that Google says it can no longer answer geofence warrants for that data. Google was the most common recipient of those warrants, but the Court noted, citing a Fourth Circuit judge, that Apple, Lyft, Snapchat, and Uber have received them too. A database that doesn't exist can't be searched. The ones that do exist still can.

Active phone tracking: when someone goes after the device

What is a Stingray, or cell-site simulator?

A cell-site simulator, often called a Stingray after an early Harris model, impersonates a cell tower. Phones in range connect to it, and it learns their identifiers and approximate location. Some models can also intercept calls, texts, and internet traffic, as TechCrunch reported. It cannot pick only the target. Every phone nearby answers.

Since 2015, Justice Department and DHS policies have generally required a warrant to use one, with exceptions for emergencies. Interfering with cell signals yourself is a federal offense, per the FCC. A February 2023 DHS inspector general audit found that the Secret Service and ICE's Homeland Security Investigations did not always follow the rules, including failing to get court orders required when using the devices in emergencies. ICE bought cell-site simulator vehicles from TechOps Specialty Vehicles for $818,000 in September 2024 and $825,000 in May 2025, TechCrunch reported from public records. The company confirmed that it supplies the simulators but said it doesn't make them.

The ACLU and EFF track which agencies have these devices. We describe them here and stop there. Detecting, jamming, or defeating them is out of scope.

Can police unlock and copy my phone?

Often, yes. Forensic kits from Cellebrite and Magnet Forensics' GrayKey are built to unlock phones and copy their contents. In Riley v. California (2014), the Supreme Court held that police generally need a warrant to search a phone seized during an arrest. A warrant still opens the phone.

The race is now about time. Since fall 2024, iPhones restart themselves after 72 hours locked, and police race that clock. Forbes reported in October 2026 that a tool called GrayKey Preserve can stop that timer, and that ICE's Homeland Security Investigations bought it. A sheriff's sergeant told Forbes the device extracts nothing; it holds the phone in place until a warrant arrives.

The same tools have been misused. In December 2024, Amnesty International reported that Serbian police and intelligence used Cellebrite tools to unlock journalists' and activists' phones and, in at least two cases, install spyware. Cellebrite then suspended the Serbian customers involved.

What are Pegasus and Paragon spyware?

Mercenary spyware is the top of the market: remote infection, sometimes "zero-click," meaning the target never taps anything. Once installed, it reads messages before encryption matters. Citizen Lab has documented NSO Group's Pegasus against journalists and activists for a decade. On October 19, 2026, it reported with high confidence that the rector of the University of Belgrade, a supporter of Serbia's student movement, was hacked with Pegasus in 2026. In the U.S., a federal court entered a permanent injunction in 2025 barring NSO from targeting WhatsApp users.

Paragon's Graphite reached WhatsApp users in 2025; Citizen Lab confirmed infections of journalists in Italy. ICE revived a paused $2 million Paragon contract in August 2025. In an April 1, 2026 letter, acting director Todd Lyons acknowledged approving a commercial spyware tool for Homeland Security Investigations' use against foreign terrorist organizations and fentanyl traffickers, NPR reported. In May 2026, DHS told NPR that ICE has "no relationship" with Paragon; the contract was closed out January 20. DHS declined to say what tool Lyons approved. So: spyware, yes; whose, unstated.

What is stalkerware?

The cheapest active tracking is installed by someone with your phone and your passcode. Stalkerware apps upload messages, photos, and location to whoever paid. They also leak. In February 2026, TechCrunch reported that a hacktivist scraped more than 500,000 payment records for phone-monitoring apps including uMobix and Xnspy, adding that dozens of these apps have exposed victims' data over the years. The FTC banned SpyFone and its CEO from the surveillance business in 2021.

If you suspect it, the FTC and the Coalition Against Stalkerware give the same caution: removing it can alert the person who installed it. Make a safety plan first, ideally with a domestic violence advocate, from a device they can't reach.

How to reduce phone tracking lawfully, and where it stops working

None of this makes you invisible. Your carrier's records are outside your control, and so are court orders. What you control is how much extra you hand over.

Phone settings for a protest

EFF's Surveillance Self-Defense guide to attending a protest is the best single reference. The short version:

We sell packs, and a pack is not a Faraday bag.

The phone isn't the villain here. It is a device that has to know where it is to work, owned by people who found out what that knowledge sells for. The limits that exist came from a few judges and one federal agency, mostly in the last three years. Judges, contracts, and votes will settle the rest.

Sources

Courts

Federal agencies and contracts

Research and civil liberties groups

Company documents

Journalism

FAQ

Can police get my phone's location without a warrant?

Sometimes. Demanding location records from a carrier or from Google is a Fourth Amendment search under Carpenter (2018) and Chatrie (2026), which generally means a warrant. Buying similar data from a commercial broker is a separate question the Supreme Court has not decided, and agencies including ICE and Nevada's Department of Public Safety have bought access to such data, as reported by 404 Media and KSNV.

What did the Supreme Court decide in Chatrie v. United States?

It held that a person has a reasonable expectation of privacy in cell-phone location information, so obtaining Google Location History through a geofence warrant was a search, even for a short window. The Court did not rule on whether that particular warrant was valid; the Fourth Circuit will decide that, and the good-faith question, on remand.

Does turning off location services stop my phone from being tracked?

No. It limits what apps and the operating system can read from GPS and nearby networks. Your carrier still logs which towers your phone connects to, and ad-tech systems can estimate location from your IP address.

Does airplane mode stop phone tracking?

It turns off the cellular radio, which stops new tower records while it is on. It does not erase earlier records. On iPhone, Apple says airplane mode leaves Bluetooth on, and Wi-Fi can be turned back on while it is active, so check both.

What is a Stingray or cell-site simulator?

A device that impersonates a cell tower so phones nearby connect to it, which reveals their identifiers and approximate location. Some models can also intercept calls, texts, and data, as TechCrunch reported. DOJ and DHS policies generally require a warrant to use them, and a 2023 DHS inspector general audit found ICE and the Secret Service did not always follow the rules.

How can I tell if someone installed stalkerware on my phone?

Warning signs and checks are covered by the FTC and the Coalition Against Stalkerware. Both caution that removing it can alert the person who installed it, so plan for safety first, ideally with a domestic violence advocate, before deleting anything.