The invisible processes in your smartphone

The main chip controls everything: memory, camera, encryption, sensors. It contains proprietary firmware blocks that remain active even after a factory reset. Qualcomm, Apple and MediaTek do not provide complete insight into the processes running on their chips — not even to device manufacturers.

ARM doesn't provide the chip, but the blueprint. Over 95% of all smartphones worldwide run on ARM architecture. Whoever licenses the architecture controls what can be executed at the lowest level — including TrustZone, an isolated execution environment that runs independently of the operating system.

The modem communicates continuously with the cellular network — even in the background, even when you're not using the device. It runs on its own memory with its own firmware, bypassing the operating system. No manufacturer offers a consumer device with open modem code today.

Samsung, Xiaomi and other manufacturers heavily modify Android: pre-installed apps, their own telemetry services, manufacturer-specific permission systems. In studies, devices with manufacturer Android sent up to 3× more data packets than AOSP devices — even in standby.

Android and iOS control every app permission, every network access, every sensor call. By default, both operating systems send diagnostic data, crash reports and usage statistics to their manufacturers — without any app needing to be open.

Modem firmware, WiFi chip code and security modules are updated via separate channels — independent of operating system updates. These updates run automatically, without visible confirmation. Whoever controls this infrastructure can change device behavior without you seeing it.

The bootloader starts before the operating system. It cryptographically verifies which code is allowed to load — and blocks alternative operating systems from starting on most devices. A locked bootloader means: you permanently use what the manufacturer intended.

Your provider sees the timing, duration and destination of every connection. Via cell tower triangulation, your location can be determined to within a few meters without GPS. Depending on local law, this data is stored for months or years.

WiFi chips regularly send probe requests — signals that search for known networks. Whoever receives these signals can create a detailed movement profile over time. MAC address randomization mitigates this, but doesn't fully protect.

Your internet provider sees every DNS request and all connection metadata — even with HTTPS. Detailed behavior profiles can be created from destination addresses and timing alone, without access to content.

Google and Apple decide which apps are available at all — and under what conditions. Both stores log search queries, downloads and usage times and link them to device identifiers.

Via SDKs embedded in thousands of apps, ad networks track your behavior across apps. An average smartphone with standard apps sends tracking pings to several hundred different domains in 24 hours.

iCloud, Google Drive and Samsung Cloud synchronize photos, contacts, notes and app data by default. Whoever operates the service has technical access to this content — regardless of whether they use it.

In Germany and the EU, authorities can request access to subscriber and connection data with a court order. Providers are legally required to cooperate. How extensively this data is evaluated is not visible to users.