We actually can by disassembling the YouTube.ipa, examining the calls, and checking for AVAudioSessionDataSourceDescription objects. Tracing their lifetimes.

It’s the same method Apple uses to check for “unauthorized internal API use” people get busted for.

We can also replace the AVAudioSession class with our own proxy to examine calls.

You'd have to disassemble Google Play Services, not the Youtube app.

OP said he/she was on iOS.

And not using the app at all, just browsers

Ah right, missed that part. In this case it’s rather easy as Safari will respect your settings. Just deny microphone access. Under settings->safari->Microphone which is down under “settings for websites”

it just makes it less likely that a microphone was used instead of other information such as IP and location.

You would expect it to consume quite a lot of power and/or bandwidth if the mic was always on.

But isn't it always on for "Hey Siri"?

You can try fingerprinting, etc. Ridiculous amount of effort to implement it. For little benefit.

They do it for music identification these days.

which is such a halfhearted excuse too- "why are you randomly sampling audio around me and phoning home about it?"

  "uhh.... shazaam?"

I thought that was all done on-device?

I'm not sure. Just pointing out that it doesn't necessarily have to use a lot of power or bandwidth to have the mic always on.

Imagine the computational resources needed to track microphone for all Android users.