How Ad Targeting Follows You Between Apps

Search for a pair of shoes once in a shopping app, then open an unrelated game twenty minutes later and see an ad for the exact same shoes, and the first suspicion is almost always the phone's microphone. The far more common explanation involves no audio at all: a shared identifier baked into your device that lets advertisers and data brokers recognize "this is the same phone" across completely unrelated apps, stitching your activity together without ever needing your name, your voice, or a single word you said out loud.

The advertising ID: one number, shared by design

Both Android and iOS assign every device a unique advertising identifier — Android calls it the Advertising ID (AAID), Apple calls it the IDFA (Identifier for Advertisers). This is a randomly generated string, distinct from your phone's hardware serial number, designed to be readable by any app you've granted tracking permission to, and designed to be resettable by the user. Its entire purpose is to let different apps and ad networks recognize "this is the same device" without needing your name, email, or phone number — app A can log that this advertising ID searched for running shoes, and app B's ad network, if it participates in the same ad exchange, can serve a shoe ad to that same ID.

Software Development Kits: the actual mechanism inside each app

Most apps don't build their own ad systems from scratch — they embed third-party advertising and analytics SDKs (software development kits) from companies like Meta, Google, and various ad-tech firms. These SDKs run inside the app with whatever permissions the app has been granted, and routinely report activity — screens viewed, searches made, purchases, time spent — back to the SDK provider's servers, tagged with your device's advertising ID. Because the same handful of major ad SDKs are embedded in enormous numbers of otherwise unrelated apps, a single company can end up seeing snippets of your activity across dozens of apps you use, simply because so many developers use the same few ad providers.

Real-time bidding: the auction that happens before an ad loads

Every time an ad slot loads in an app, an automated real-time bidding auction typically runs in milliseconds behind the scenes — the app's ad space is offered to multiple advertisers, along with contextual and audience signals (including, where permitted, the advertising ID and inferred interest categories), and advertisers bid to win that impression based on how well it matches who they're trying to reach. This entire process happens before the ad visually appears, and it's the mechanism by which an advertiser targeting "people interested in running shoes" can win your specific ad slot in an unrelated app.

Data brokers and probabilistic matching fill the remaining gaps

Beyond direct SDK data sharing, a layer of data broker companies specializes in combining signals from many sources — advertising IDs, IP addresses, general location, device type — into broader behavioral profiles, sometimes using probabilistic matching (statistically likely, not certain, matches based on patterns like the same WiFi network, similar usage times, or shared device characteristics) to link identities across contexts even without a shared login or explicit ID.

Why it sometimes really does feel like listening

The uncanny timing that convinces people their microphone is being used usually has a more mundane explanation: you likely searched for or looked at the same product across multiple touchpoints already (a browser search, a product page visit, a friend searching from a shared WiFi network or household), and cross-device/cross-app tracking simply surfaces that ad with a delay that happens to line up with a conversation. Apps do request microphone access for legitimate features, and permission misuse isn't theoretically impossible, but the mechanisms described above are sufficient on their own to explain the vast majority of these experiences without any audio involved.

Contextual Targeting: Advertising Without Any Personal Tracking at All

Not all ad targeting relies on identifiers or cross-app profiles — contextual targeting simply matches ads to the content of the specific page or app screen being viewed (a running shoe ad on a fitness app, regardless of who's using it), with no tracking of the individual user's history required at all. As privacy restrictions on ID-based tracking have tightened, contextual targeting has become a larger share of the ad industry again, partly as a direct response to users increasingly declining tracking permissions.

Why Deleting an App Doesn't Erase What Was Already Collected

Uninstalling an app stops it from collecting new data, but any activity already reported to an ad SDK's servers during the time you used the app typically remains on that company's servers, subject to whatever data retention policy they publish (often buried in a privacy policy most people never read). A full account deletion request, where the app or ad network offers one, is the only mechanism that reliably removes historical data rather than just stopping future collection.

Does a VPN Stop Ad Tracking

Partly. It masks your IP address and general location, which removes one signal used in tracking, but it does nothing to stop advertising ID-based tracking or SDK-level activity reporting, neither of which depends on your IP address at all. It's a partial fix, not a complete one, against this specific kind of tracking. And turning off "personalized ads" isn't quite the same as turning off tracking entirely. That setting usually stops ads from being tailored to your inferred interests, but some underlying data collection for analytics can keep running depending on the app. Declining app-level tracking permission, like Apple's App Tracking Transparency prompt, is the more complete control of the two.

What limits this tracking

Both Apple's App Tracking Transparency (which requires apps to explicitly ask permission before accessing the IDFA, and which most users decline) and Android's newer privacy controls (including the option to delete the advertising ID entirely rather than just reset it) have reduced how much cross-app tracking is technically possible compared to a few years ago, pushing more ad targeting back toward each app's own first-party data and contextual signals rather than cross-app profiles.

Resetting or deleting the advertising ID, and declining tracking permission when apps ask, dents this system in a way that turning off your microphone never would — because the microphone was rarely the mechanism doing the work in the first place.