I'd consider myself 'aware' rather than 'paranoid', but if we extrapolate for a minute....Some function or app on the phone (or distant cloud service) can recognise the MAC address of the Fisher price phone's bluetooth PHY and, coupled with GPS info, we have a location where there's possibly a young child (or an older one in their home office!). Maybe, worse case, your targeted ads contain more children's toys.

That’s not how MAC addresses work. Once a packet crosses a router, the packet appears to come from the MAC address of the router.

So for example a web site you connect to has no idea what your MAC address is.

...unless you (or the app you're running) tells it.

But, yeah, you're not wrong for IP networking - however, an app on the phone could forward the MAC address of the bluetooth connected device.

But you are correct that regular apps can't address the MAC address of connected Bluetooth devices, so the tracking vulnerability that OP is suggesting isn't really possible.

"Connects to your mobile device with Bluetooth® wireless technology to make and receive calls through your existing phone plan—no additional line required (Compatible with IOS and Android™ devices)"

Calling random people doesn’t seem like something that’s a good idea.

The closest I could find to it saying that was the customer questions, one of which was answered with, “This one is intended for adult collectors.”

You may find this post (https://ptx2.net/posts/unbricking-a-bike-with-a-raspberry-pi...) inspirational.

Could these things be virtualized? And provide a fixed location, silent sound, and an empty contact list to whatever applications you don't trust?

I agree, but I doubt it will happen. It was already a battle to get the permissions in android as fine-grained as they are. Even though they are fine-grained now, the permissions don't mean anything when every app demands that you give it everything it asks for (even though it clearly does not need them to work).

I haven't kept up with it, it needs a rooted phone and Xposed Framework, and some apps don't like that and stop working.

But in an older version of this app, you can set it to prompt you for any activity the app wants to do, e.g. read clipboard or phone status, where you can say "Allow/deny always, allow/deny for 10 minutes" etc.

I might have used something like XPrivacy. https://github.com/M66B/XPrivacy

Ironically, those are probably more expensive. Privacy has become a commodity.

I'm perfectly happy using appliances like it's the pre-smartphone era but the moment using an app becomes _required_ is when I'll flip my shit