> The Government Uses Targeted Advertising to Track Your Location. Here's What We Need to Do.

"No matter the risk, I must carry my smartphone everywhere and install every app. It would be unimaginable to have the urge to look something up, but then wait to do it later until I'm using a real computer. No negative outcome will EVER shake my deep, permanent need to carry a smartphone all the time and use it for as much as possible."

We've done this to ourselves, and we're terrified at even the most minor inconvenience. It's something I can't wrap my head around, but people cannot bear to just wait until they get home to query something on the internet. They MUST have access ALL THE TIME, no matter the downside. It's baffling.

The problem is that the downside is incredibly small (government isn't interested in most citizens) until it's suddenly massive (government is interested in you.) That makes it very difficult for people to build a mental model of why it's a problem: because in all seriousness it genuinely isn't unless you're either fighting the system, you're a criminal, or you have a level of perception where you can understand that other people are a threat to the government and you have empathy for them or you can see that the government might see you as a threat to in the future. Most people can't or won't understand about that.

You can't really blame them. Mobile devices are useful beyond 'looking stuff up'. Maps, communication, banking, etc are huge upsides to counter the probably very small (if you ignore empathy) downside for most people.

I use mine as a phone, messaging, podcast player, camera, a banking device, a little email and occastionally the web. Thats it. Some convience is good, too much is very bad. No social media or whatever millions of apps they constantly try to push in your store of (enforced) choice.

In someways we have done this ourselves but also there is a deeper societal issue. As Ellule and Kacsynski both pointed out, technology is voluntary to a point. But when it becomes a tool that you are practially forced to use to merely keep up with others, it is no longer a choice unless you can figure a way without it at your own peril.

For instance my bank has become entirely dependent of their app as the glue between all their functions and authorisation. I can try to avoid this but it becomes very difficult, it goes beyond just convenience at that point. I do not like that at all, I think it is very short term thinking, but here we are.

I try to avoid a lot of various technologies were I can make it work, I do not have a car for that reason, but smartphones have unfortunately become very ingrained in societies expectations at a blinding pace. Try to limit their use were you can, maybe others will follow.

That sounds horrible. What are users to do if their smartphone breaks?

We don't, and that sucks. But it's not a binary choice between "you can carry your phone everywhere" or "you can avoid having your movements stored in a database indefinitely". There are other options that we as a society could choose, if we could get our acts together.

Sure, the opsec ideal is that you don't have to trust other parties in the first place. But honestly, for the vast majority of people, that sort of thing doesn't matter, and having strong, readily-enforced privacy laws would be more than sufficient to keep people safe and secure.

None of this is to say that we shouldn't try, or that it's futile, but rather that it's a daunting task: the only way to really defeat this is to not only regulate private entities but also the government itself. And the only way to do that is to make such surveillance political suicide. And the only way to do that is to get the people to care about privacy. Here in the UK, the public has more or less come to accept CCTV cameras being everywhere, with the government now introducing AI face-scanning cameras, which has not been met with much public resistance. And so I do have to echo what @everdrive said: "We've done this to ourselves". Whether it's about convenience or apathy or whatever, we've had the means to object to this and we haven't.

“Mail Isolation Control and Tracking program, in which Postal Service computers photograph the exterior of every piece of paper mail that is processed in the United States”

We Await Silent Tristero's Empire

We could live in a world where we have strictly-enforced privacy laws. We don't, and that sucks, and if anything, we're moving further away from that state of affairs very day. But we could.

A receiver could use a new random ID to call “collect” to a secure third party network which agrees to pay for the base stations bandwidth for every connection. The station then responds to the base station yep ID X’s bandwidth will be paid by vert tel.

Obviously, this doesn’t eliminate the possibility of tracking as you’d want the cell to have multiple connections created and abandoned randomly, but it does remove that ID you’re concerned with.

The solution to this is just to make it illegal to store and process the results of such analysis applied to radio signals, without consent of the data subject (GDPR jurisdictions have that already), and to enforce that law.

There is the real problem. It’s not a tech issue. It’s a people problem. Most governments don’t actually _respect_ and _serve_ their people. They see them as cattle to be monitored and manipulated.

Do people seriously forget that humans design with an explicit purpose? That purpose can change you know...

edit: needs to be stated that the last data privacy law the US passed was regarding video rentals in the 80s.

The response to revelations about this sort of tracking should not be to roll our eyes at people who carry their phones everywhere. It should be to get angry at our government for treating us all like potential criminals, and vote out shitheads who support this sort of thing. (Which I know feels damn-near impossible most of the time...)

How about we carry a device with multiple cameras, multiple microphones, and 24x7 connection to the internet that is running an operating system made by an Ad Company, to the most private of places?

The more tragic thing is that those who care about it, can not do much about it.

That's exactly why orgs like EFF exist. Most laws also aren't passed because of overwhelming consumer feedback. It's lobbied by special interests. Which sadly took a negative connotation over the last few decades, but lobbies can be for the people too.

This is not an easy problem to solve. Certainly I want more things at the federal level than the authors of the constitution envisioned (currency, international diplomacy, military, etc.): some things really need to be done at the national level (like environmental regulation).

Anyway. Sure, those figures may be true for the US Congress (or not, I haven't verified), but I bet you those figures aren't even close to true for town and city councils and county government. And perhaps not even state government as well.

This will never happen, but good luck.

It's not popular because this is very reductive and dismissive of the problem almost to the point of dishonesty. Many modern functions need an application and there is little or no alternative.

Some examples:

QR codes - lots of restaurants don't have a physical menu and need a QR code scan. This behavior extends well beyond restaurants as well.

Keys - Lots of cars support lock/unlock and put a ton of features behind an app. While not strictly necessary, it's incredibly convenient if you're in the inevitable (and sometimes very expensive/difficult to remediate) situation everyone eventually faces when you lose your keys, or lock them in the car. Some garages and apartment complexes only support getting in by app, and I've seen this in hotels as well.

Banking - doing many things at banks nowadays requires confirming you are you via push notification to your phone. Lots of MFA is app-based as well. I could not do my job without a phone.

Navigation - I don't always carry a garmin or thomas guide around with me when I'm walking around an unfamiliar city, and it would be pretty ridiculous of me to do so.

Probably could come up with a lot of other things. Without a phone it's not really possible to function in much of the modern world. There is more to the app ecosystem than tiktok, maybe that's the miss here.

Those restaurants are worthless

>Keys

Carrying your car key does not count as inconvenient

>Banking

Agreed, and this is a problem, but you can just do your banking at home without carrying around your smart phone. This is a case where the industry is forcing a choice on consumers. I'm considering joining a local credit union for this reason.

> Navigation

How did people manage this prior to 2007?

> How did people manage this prior to 2007?

We had a map for each county. My wife would switch them when we crossed county boundaries and would give directions. We still got lost. It was romantic.

You just looked at a map. People used to be good at looking at maps, and remembering cardinal directions prior to GPS units. We have unfortunately lost that sense of natural direction.

https://www.bbc.com/news/technology-32545974

MapQuest? It sucked.

Google Maps does allow you to download areas to your device that can be used offline, too.

And you’re flat out wrong about banking, there are things and situations that require you physically entering one. And yes it is a situation where society is forcing the decision, that’s my entire point - I as an individual cannot apply the non remedy of “just do everything on your computer, ldo” because society has stripped that choice from me. unless the prescription you’re giving is to withdraw from society - which is only proving my point.

I’d also hardly describe my job as a minor inconvenience.

I see these types of arguments a lot on this site and I am very confused where they are coming from. It’s almost like the implication is you have no right to complain about the privacy nightmare if you participate in using things that are necessary to participate in society. You can have reasonable privacy and these tools at the same time, it’s not an impossibility.

With regard to the job, and the banking, I agree. I need to have OTP on my phone and I haven't tried to bank in person for a while. We have two young kids, and once things calm down I'm going to see if we can swap to a local credit union. The decision will be predicated on whether I can do everything in person.

With regard to the phone, I think the softer version of my argument would be that you can install the bare minimum number of apps, and otherwise just set the phone on a table and not carry it around with you. If you're worried about government tracking, power your phone off when you drive to work. Your work itself (and all your logins) will reveal your location, so it's not really as if powering your phone back on once you get to work is much of a detriment. The same is true for banking. Even if you must use the smartphone, just leave the phone off / or in airplane mode and then just do the banking at your desk at home.

In fairness to you, I'm pretty sure I failed a job interview once because I asked if I needed a smartphone for the job. I think my point would be that with the way things are going, it's becoming more and more important to figure out how to avoid as much of the smartphone as possible.

I don't want to do everything in person. It's frankly amazing that I can deposit a check on my phone, from my home, and don't have to go to a bank branch to deposit it anymore. For close to 20 years now, my primary banking has been through banks that don't have a physical presence at all, let alone in my city. And I don't mind it that way at all; in fact I like it, because these banks focus harder on making things more convenient for me.

Your attitude here seems to be that if other people's preferred method for doing something doesn't conform to your preferred method, then the other people must be wrong somehow. That's not a reasonable way to be looking at this.

Paper maps. Or even (in the earlier 00s) looking up directions on MapQuest or whatever, and then printing those directions out. I don't want to keep printing out directions; what a huge waste of paper that would be. Paper maps are doable, but awkward to use, and can easily become out of date. You need to have addresses (or at least nearby landmarks or cross-streets) for everywhere you want to go, because paper maps have a very limited set of points-of-interest on them.

> Those restaurants are worthless

That's just, like, your opinion, man. Your criticisms seem to mostly amount to "people should just abandon the various conveniences and niceties that smartphones provide, because there are alternatives, even in cases where those alternatives are incredibly inconvenient".

Yes, it's idiotic that we're subjected to so much tracking when we carry our phones around. But the response shouldn't be "let's just become a luddite and not take advantage of modern technology". It should be "wow, this makes me fucking angry; we need to fix our laws so this sort of thing doesn't happen".

> keys + mfa: this one is a tricky one for me. thinking to go do web-only mfa fwiw and go full RMS with just a laptop and a hotspot. does he even use a hotspot? haha. as far as SMS MFA goes... maybe tailscale out an adb session to your real cellphone at home. feels brittle, but so is sms mfa. edit: actually i'll just forward SMS to myself via e-mail; this is what your financial advisor does, since SMS is heavily regulated in fintech

> nav: yeah when smartphones first came out i just hated every design aspect about them (stupidly fragile screens at the time), but the most compelling reason to switch at the time was navigation. i don't mind printing mapquest again or just using a dedicated gps.

it's the value prop of having "all the world's knowledge at your fingertips" versus:

stupid obsoletion practices + lithium mining, corpogovernment surveillance + tracking, eroding mental health, porn, gacha games, cellphone thumb + turtle neck, doom scrolling + time wasted, enshittified content, the reverse flynn-effect, infuriating typing ux on both ios and android, and people having near constant access to you at all times (remember when it was rude to call past 8p?)

does this thing really make you happy?

that i think it's time to just leave your phone at home...like in ye olde days with your landline and i'm an app developer. (you should keep the phone and gps on and at least pretend that you're a normie).

anyone in construction really like their ruggedized SIP phone and can recommend a good voip system (ie they trust their voip provider) with e2e encryption that I can connect a wifi 6 mobile router to? someone a few months ago on hn mentioned the mudi v2 and sim swapping with https://github.com/srlabs/blue-merle

That's because you're coming off holier than thou and condescending. Anyone who understands gadgets will say phones are highly trackable and will have told anyone that well over 10+ years ago. It's a trade off of value. Corporations/gov can track me while I have my phone, but turn by turn directions, maps and a camera while wandering around are useful. We could legislate that traceability away in the US to an extent, but that would require our gov be working and right now it is not.

Sorry but what are you using your device for? There are many, many tools I use my smartphone for and I currently don't have Insta, reddit, Facebook, typical social media, etc on my device. Dismissing a pocket sized computer with far reaching access to the internet as a low value proposition is misguided. If all you use your device for is social media, call and text that's really too bad and a complete misunderstanding of what those devices are capable of.

(Which doesn't mean we have to give in to big corporations. Gotta love GrapheneOS!)

People don't want to be bored, so a phone with all the apps provides a reliable source of distraction/entertainment.

…to a Field Notes book in my wallet (and a pen).

But that's a moot point, because advertisers will still track you on any device you use.

and i noted that urge to check my phone to validate those (later midday: embarrassing) ideas. it occurred to me then that it's precisely that urge to check the phone that usually kills them. and if it isn't that, it's the missed smses and emails and the latest gripe on hn. i wondered how many good ideas were strangled with the mundanity/viciousness (depending on your algorithm) of this device

"is it really so bad to sit alone with my thoughts, without having an immediate answer to put them to rest?"

People don’t necessarily know the risk. Some do, and as someone on HackerNews you are in a space of such people who are more likely to know, but I don’t think the average person knows just how deep risks go.

> We've done this to ourselves, and we're terrified at even the most minor inconvenience

> It's baffling.

> I am quite angry and perplexed at why people have backed themselves into this corner

I don’t think this framing is quite right. It puts the onus of the problem onto the people and solely frames it as something people do, leaving out anything else. I don’t know if that’s how you meant it, but that’s how it comes off.

It’s baffling that people would push themselves into the corner because that’s not the full story. At least in part, they are being pushed into that corner; it’s not just something they do but something being done to them.

That’s what marketing, and at least some aspects of design, are. A company wants people to know about and use their product, and they want people to keep on using their product. Taken farther along, this leads to desires becoming needs or addictions. This can happen with many technologies, products, etc., phones included.

I don’t think it’s as baffling that people are drawn towards using a product excessively when there are millions to billions of dollars alongside time and effort put towards getting people to go down that path

Just not retaining everything forever and selling it seems like a good start for my personal use.

Since people around you will think you are also wearing a tinfoil hard, you had better stick to the phones with hardware switches as sibling comment mentions

https://securitylab.amnesty.org/latest/2025/12/intellexa-lea...

The fact that we still just allow arbitrary 3rd party code to run through ad networks is bizarre.

It's interesting to imagine how things would change if those ad-networks were legally liable for their role in spreading scams and malware.

This is another reason why you should not be carrying a phone everywhere except for times where you absolutely need one.

And it's a pretty new account.

The location data in these networks is very inaccurate. Your OS and browser actually do a pretty good job of locking down your location data unless you give explicit permission. It's in the ad network's interests to lie about the quality of their data - so a lot of the "location" data is going to be a vaguely accurate guess based on your IP address.

But also, location data is really important to ads right now because, contrary to common perception, per user tracking is very, very hard. Each SDK might be tattling on you, but unless you give them a key to match you across apps, each signal from each app is unique. Which is why you are often served advertisements based on what other people on your network is searching - it's much easier to just blast everyone at that IP address than it is to find that specific user or device again in the data stream.

Bidstream data in particular is very fraught. You're only getting the active data at the point the add is served, but it's not easy to aggregate in any way. You'll be counting the same person separately dozens or hundreds of times with different identifiers for each. The data you get from something like Mobilewalla is not useful for tracking individuals so much as it's useful for finding patterns.

I think it's pretty telling from the few examples shared about how agencies actually use the data:

>"CBP uses the information to “look for cellphone activity in unusual places,” including unpopulated portions of the US-Mexico border."

>According to the Wall Street Journal, the IRS tried to use Venntel’s data to track individual suspects, but gave up when it couldn’t locate its targets in the company’s dataset.

>In March 2021, SOCOM told Vice that the purpose of the contract was to “evaluate” the feasibility of using A6 services in an “overseas operating environment,” and that the government was no longer executing the contract

Something is going to have to be figured out about this data - realistically the only way is a sunset on customized advertisements. However, I would personally not be worried (yet) that the government is going to be able to identify an individual and track them down using these public sources as they currently are.

Many devices, when running, and in some cases even if turned off but connected to their battery, will ping cell towers (maybe even BLE/Wifi) and get triangulated by the network infrastructure (such as cell towers) without actively broadcasting the GPS location.

That's why I don't quite understand why the gubernment needs to have finer grained data (esp around the US/Mexican border). Precision location info would only be needed if you need to track people in densely populated areas.

If the government wants to tap your phone they need a warrant. If they want to buy it from a willing seller like Verizon they don’t.

But it is necessary to send it somewhere, otherwise the internet wouldn't work.

Unfortunately it seems to have become accepted for our devices to communicate constantly and often with services we never explicitly started communication with (like Ad networks used in Apps).

Permission systems on devices should care about Network connections just as much as Location. Ideally when installing an app you'd get the list of domains it requests to communicate with, and you could toggle them. Bonus points if the app store made it a requirement to identify which Domains are third parties and the category like an Ad service.

No; what we need is to ban this data collection entirely.

You're still that confident that no one else is selling your location data without your knowledge?

CPB doesn't care where I am. Unless they make a mistake and think I'm an illegal immigrant. Or they decide to teach a lesson to someone who's critical of them.

The problem is that we have markets where we: - Incentivize organizations to pursue profits at the expense of everything else, which includes social good and civic rights - Rarely hold bad actors accountable (and almost never in a timely manner)

Which means, given enough time, we're always going to trend to whatever makes the most money. Targeted advertising makes money, and will continue to do so unless or until we collectively decide to make it a greater risk to profits than it is today.

You'd be surprised what can be done when data from different source is fused together.

Large-Scale Online Deanonymization with LLMs: https://news.ycombinator.com/item?id=47139716

Robust De-anonymization of Large Sparse Datasets: https://www.cs.cornell.edu/~shmat/shmat_oak08netflix.pdf

Also, people who post under their real name are likely to write with their real voice:

> Any deanonymization setup with ground truth introduces distributional biases. In our cross-platform datasets, the pro-files are likely easier to deanonymize than an average profile: the very fact that ground truth exists implies that the user may not have cared about anonymity in the first place. Similarly, two split-profiles of a single user are inherently alike, whereas two pseudonymous accounts of the same person (e.g., an official and a pseudonymous alt account) might expose more heterogeneous micro-data.

Let me share a thing:

Factual, a company that specializes in hyperlocal geofencing, uses geofencing much smaller than the self-regulation that their industry allows in their own rules. I learned this after a coworker quit because our company was allowing ad targeting to people using these smaller geofences. The whole company had an all-hands about it where the CEO of the company told everyone that we were not going to stop using Factual nor the smaller-than-allowed geofences because we, ourselves, were not the ones to produce those geofences. We were just a man in the middle helping to build a system to track people at high resolution.

Please try to reconcile with what your industry has and continues to destroy.

I don't see anything contradictory between your comment and the OP. Having an amoral CEO who condones breaking geotargeting self-regulation doesn't contradict OP's claim that it's hard to tie geotargeting data in bidstreams back to a particular person.

For example, it was very hard for me to identify myself in an anonymized public dataset of vehicle trips, but I did. It was also hard to FOIA for the documents showing them writing SQL to spot my trip.. but I did.

Hard doesn't mean impossible.

I won't claim with certainty that this is the case, but it seems likely that Factual was overselling their capabilities. That, or they relied specifically on having users grant high precision location data access and had nothing otherwise.

Apps that already need location data are probably the most likely sources of collecting such data - food apps, dating apps, chat apps you have sent your location in, ...

Yes, and many companies have access to both feeds.....

Eg by running standard Android? That doesn't have eg secure app spawning, so apps can profile app initialisation data AIUI

And probably 10 other things behind the scenes that GrapheneÓS plugs?

Aren't there many examples of these? For example IMEI, IMSI, phone number, etc?

Even without "unique" signals, isn't it fairly trivial to identify a user with a handful of "not very unique" signals? User-agent, a few recent IP addresses, browser capabilities, list of installed apps, device operating system properties, etc?

The US government contracts with commercial data providers stipulate that all US data must be removed. There are quite a few regulatory controls that are adhered to.

There’s really not any legal practical way to avoid ALPRs.

I’m pretty sure the government knows where I am 24/7. I’m not going to worry about targeted advertising by the government anymore and just worry about it the people reselling it to non-governments for use.

https://web.archive.org/web/20070920193501/http://www.radaro...

The invasion of privacy has been slow, creeping, and just waiting for that Turnkey Tyrant. We fooled ourselves into thinking we'd never elect someone who would turn that key. But in reality the key has been slowly turning, until finally it opened the latch

> 1. Disable your mobile advertising ID

> 2. Review apps you’ve granted location permissions to.

I'm surprised they missed the most important step, which is blocking the advertisers from collecting your data in the first place. This is easily done in the browser with uBlock Origin and system-wide with DNS filtering.