I don't know of any carrier hypervisory capability, but there has been a lot of discussion about OnePlus phones and the data they exfiltrate. There's a bunch of

I don't know of any carrier hypervisory capability, but there has been a lot of discussion about OnePlus phones and the data they exfiltrate. There's a bunch of vendor bloatware even on my factory-reset phones so it's not out of the question that a carrier-locked phone might have snuck something else in there. Intelligence can be inferred at the carrier level even with paranoid privacy settings and all apps using HTTPS. CDNs in particular frequently serve content over regular HTTP, and there aren't too many reasons why you'd be communicating with Grindr's CDN. All of this is visible over the wire. DNS requests betray a lot about you. VPNs are notoriously leaky when it comes to DNS as well. I'd expect that even with a VPN running you're not stopping anything, just changing the exfiltration route for some of your traffic.