How Ad Targeting Follows You Between Apps

Search for a pair of shoes once in a shopping app, then open an unrelated game twenty minutes later and see an ad for the exact same shoes, and the first suspicion is almost always the phone's microphone. The far more common explanation involves no audio at all: a shared identifier baked into your device that lets advertisers and data brokers recognize "this is the same phone" across completely unrelated apps, stitching your activity together without ever needing your name, your voice, or a single word you said out loud.

The advertising ID: one number, shared by design

Both Android and iOS assign every device a unique advertising identifier — Android calls it the Advertising ID (AAID), Apple calls it the IDFA (Identifier for Advertisers). This is a randomly generated string, distinct from your phone's hardware serial number, specifically designed to be readable by any app you've granted tracking permission to, and specifically designed to be resettable by the user. Its entire purpose is to let different apps and ad networks recognize "this is the same device" without needing your name, email, or phone number — app A can log that this advertising ID searched for running shoes, and app B's ad network, if it participates in the same ad exchange, can serve a shoe ad to that same ID.

Software Development Kits: the actual mechanism inside each app

Most apps don't build their own ad systems from scratch — they embed third-party advertising and analytics SDKs (software development kits) from companies like Meta, Google, and various ad-tech firms. These SDKs run inside the app with whatever permissions the app has been granted, and routinely report activity — screens viewed, searches made, purchases, time spent — back to the SDK provider's servers, tagged with your device's advertising ID. Because the same handful of major ad SDKs are embedded in enormous numbers of otherwise unrelated apps, a single company can end up seeing snippets of your activity across dozens of apps you use, simply because so many developers use the same few ad providers.

Real-time bidding: the auction that happens before an ad loads

Every time an ad slot loads in an app, an automated real-time bidding auction typically runs in milliseconds behind the scenes — the app's ad space is offered to multiple advertisers, along with contextual and audience signals (including, where permitted, the advertising ID and inferred interest categories), and advertisers bid to win that impression based on how well it matches who they're trying to reach. This entire process happens before the ad visually appears, and it's the mechanism by which an advertiser targeting "people interested in running shoes" can win your specific ad slot in an unrelated app.

Data brokers and probabilistic matching fill the remaining gaps

Beyond direct SDK data sharing, a layer of data broker companies specializes in combining signals from many sources — advertising IDs, IP addresses, general location, device type — into broader behavioral profiles, sometimes using probabilistic matching (statistically likely, not certain, matches based on patterns like the same WiFi network, similar usage times, or shared device characteristics) to link identities across contexts even without a shared login or explicit ID.

Why it sometimes really does feel like listening

The uncanny timing that convinces people their microphone is being used usually has a more mundane explanation: you likely searched for or looked at the same product across multiple touchpoints already (a browser search, a product page visit, a friend searching from a shared WiFi network or household), and cross-device/cross-app tracking simply surfaces that ad with a delay that happens to line up with a conversation. Apps do request microphone access for legitimate features, and permission misuse isn't theoretically impossible, but the mechanisms described above are sufficient on their own to explain the vast majority of these experiences without any audio involved.

What actually limits this tracking

Both Apple's App Tracking Transparency (which requires apps to explicitly ask permission before accessing the IDFA, and which most users decline) and Android's newer privacy controls (including the option to delete the advertising ID entirely rather than just reset it) have meaningfully reduced how much cross-app tracking is technically possible compared to a few years ago, pushing more ad targeting back toward each app's own first-party data and contextual signals rather than cross-app profiles.

Resetting or deleting the advertising ID, and declining tracking permission when apps ask, genuinely dents this system in a way that turning off your microphone never would — because the microphone was rarely the mechanism doing the work in the first place.