The device makers may not think it's possible, but that doesn't mean it's not happening. The very definition of a vulnerability is something someone finds that

The device makers may not think it's possible, but that doesn't mean it's not happening. The very definition of a vulnerability is something someone finds that someone does not know is possible. This could also be a weasel answer. What they're saying is that apps are not allowed to do this via official permissions or channels in the OS. It's like YouTube saying there is no CSAM on YouTube. What they're saying is that they do not allow CSAM on YouTube and remove it when they find it, not that it can't possibly exist. I posted this elsewhere as one possible method: https://arxiv.org/abs/2212.01042 https://arxiv.org/abs/2212.01042 Phones have so many sensors with legitimate uses it might actually be hard to prevent an AI-enhanced sensor fusion approach from extracting this kind of information. Mitigations may require things like the injection of randomness into sensor feeds, which is also a mitigation used to prevent timing side channel attacks against hardware. But this is a lot harder to get right than it sounds. You have to make sure it's enough randomness to completely swamp the signal but not enough to destroy the usefulness of the system. Then there are microphones in devices like smart TVs and other Wifi-enabled gadgets that have a well established history of shady behavior. It may not be your phone. It may be other devices in the room. But if your phone is there then your location can be matched to the data later in a data fusion pipeline. As for these being crappy little companies: (1) if you listen to the pod or read some of the articles on this, some of them are larger companies like Cox Media Group and (2) crappy little companies are actually more likely to do shady fly by night shit. I'd find it much more likely that some crappy little adware company would do something like this than Meta or Google, because the latter can be sued while the former will just evaporate if you try to sue it. But once the data is gathered it'd be sold to data brokers where it'd be fused with lots of other data and made available to larger companies to power their targeting algorithms. This is how the adtech industry operates. The shady stuff is done by disposable or offshore companies and then the data is laundered through the data broker market. I don't know if acoustic eavesdropping is happening at any scale, but I am absolutely 100% sure that if it can be done it is being done by someone.