You mention to a friend that your fridge is acting up. You don’t search for it. You don’t type it anywhere. Two hours later an advertisement for appliance repair appears in your Instagram feed.

Almost every Jamaican with a smartphone has had this experience, and drawn the same conclusion: The phone is listening.

It isn’t. The truth is way more unsettling.

Researchers at Northeastern University spent a year on one of the most thorough tests of this question ever conducted. They examined more than 17,000 popular Android apps — including Facebook and thousands of apps that send data to Facebook — watching for any sign that microphones were being switched on and audio quietly sent away. They found none.

Neither Android nor iOS permits background microphone streaming, and both require your explicit permission before an app can touch the microphone. Your phone does listen for a wake word — “OK, Google,” “Hey, Siri” — but that happens on a dedicated chip, and nothing leaves the phone until the wake word fires.

So how did that advertisement find you? It didn’t need to hear you. It already knew.

Stage 1: Collection

Roughly seven in 10 mobile phones in Jamaica run Android, made by Google. On those phones — and on any device signed into a Google account — several recorders run by default. The main one is Web & App Activity. The name is modest; the reach is not. It logs what you search, what you do in Chrome while signed in, what you do inside Google apps, and it independently stores your location. This is why switching off “Location History” alone changes very little: There are two separate location records, and most people only find one.

Alongside it sit Timeline, mapping everywhere you have been, and YouTube history, which knows what holds your attention.

Then there is a quieter category: Apps that are not Google apps at all. Most free apps are built from ready-made blocks of code called SDKs, supplied by Google, Meta and advertising firms. A local news app, a delivery app, a game — many contain this code, and it reports back when opened. The developer isn’t hiding anything; the building blocks simply report to their makers.

Stage 2: Connection

Collection alone would be manageable. The problem is that these streams get stitched into a single profile, and the thread doing the stitching is your advertising ID — a unique number your phone hands to every app that asks. That number lets a shopping app, a weather app, a news site, and Instagram each hold a fragment of your behaviour and have those fragments recognised as the same person. Your Google account does the same across your devices.

Location connects people, too. If your phone and your friend’s phone spend two hours in the same place, the system can infer that you know each other — and treat their interest in appliance repair as a signal about you. That is how a conversation reaches your feed without a microphone. You were in the room. Your device said so. Your friend had searched it that morning.

Stage 3: Inference

Advertising systems are not looking up facts about you. They are making probabilistic guesses — predicting what someone with your pattern of behaviour will want next. Feed a system your searches, your movements, your watch time, the people you are near, and the purchases of thousands who resemble you, and it need not hear your conversation; it can anticipate it. When the guess lands, it feels like being overheard. When it misses — most of the time — you scroll past.

The rest is psychology: You notice the advertisement you would otherwise have ignored, and forget the 200 misses.

Why this matters more than eavesdropping would

An eavesdropping phone would capture what you said. This captures something more revealing: What you did, where you went, who you were with, and what you will do next. That profile can be exposed in a breach, requested in legal proceedings, and used to shape the prices you are shown.

Seven in 10 of us on Android means one foreign company holds the behavioural record of most of the population. Our data protection framework binds organisations handling personal information, but no law can undo a switch you left on yourself.

In Part 2 I will provide the 20-minute fix.

Trevor Forrest is chairman, Lignum Security Limited and is a cyber security, digital transformation & AI consultant and senior advisor for science, technology and special projects at the Office of the Prime Minister.

Trevor Forrest.