4.2 Mobile operating systems

Always-on surveillance devices

A modern smartphone is not just a pocket computer. It is a set of sensors with radios attached. A typical handset carries:

• several microphones and cameras;
• location systems (GPS, Wi-Fi and Bluetooth scanning);
• motion sensors;
• a permanent link to the mobile network.

Many of these run in the background for good reasons: navigation, step counting, crash detection, hands-free calls, contactless payments. The same machinery makes a phone a potent surveillance device when it is misused or poorly controlled.

It helps to separate where data goes:

• kept locally, such as a list of nearby Wi-Fi networks or a draft note;
• shared with the operating system vendor, the network operator or the app developer.

Everyday activity often touches all three. A mapping app working out a route may send your position to the developer, ask a third-party service for traffic data and log diagnostics with the OS vendor. No villain needed; that is how the system is designed to work.

In the UK, much of this flows under standard consumer contracts and privacy policies, not special surveillance law. That distinction matters:

• a public body asking for your data will typically need a legal process;
• private companies collect telemetry by default unless you opt out.

So the risk is as much ordinary commercial data collection as exceptional cases such as policing or the security services.

Android vs iOS realities

Android and iOS get pitched as opposites: open versus closed, flexible versus locked down. The reality is more nuanced. Both are tightly integrated with their vendors, built around app ecosystems and heavily reliant on cloud services. The differences are how much control you get, how transparent things are and which trade-offs you accept.

Android is developed by Google and used by many manufacturers, which means layers:

• Google's own services (often called Google Play Services);
• the device maker's customisations;
• the mobile network's additions.

A standard Android handset normally ships with Google's services on, because most everyday apps expect them. They handle push notifications, location services and device attestation (a way for apps to check whether the device has been altered). Convenient plumbing, but it centralises data and gives Google substantial visibility into device activity.

iOS is controlled end-to-end by Apple: hardware, operating system and default services. That simplifies security updates and means fewer pre-installed third-party apps. It also binds you to Apple's account system and cloud services for many features. A UK user relying on iCloud Photo Library or Apple Maps is trusting Apple with a detailed picture of their daily habits.

So the choice is less "privacy versus no privacy" and more which vendor you trust and which habits you are willing to change.

Myth: iOS prevents tracking and Android is inherently leaky. Reality: both let apps request sensitive permissions, both collect diagnostic data by default and both can leak through badly built apps. There are differences (Apple's tracking permissions have reduced some kinds of cross-app advertising profiling, for example), but neither is a magic shield.

The biggest privacy gain usually comes from installing fewer apps and choosing services that do not need to follow you around.

Vendor control

Mobile operating systems are not neutral. They are run by vendor policies that can change at any time, showing up in software updates, default settings and bundled or promoted services.

The big upside is security. Phones get patches against critical flaws, often silently. Without that central model, the average user would sit exposed to serious vulnerabilities for long stretches.

The downside: the same control can steer your behaviour and collect more data.

• Android setup may nudge you to enable location history or voice assistant features.
• iPhones encourage iCloud backups and "Find My" tracking.

Useful features, but they grow the pile of personal data the vendor holds. The trade-off is not only privacy; it is also reliability. Turn off cloud backup to keep data local, and a lost phone may mean lost data.

Vendor control also decides how long your device stays safe to use. Many Android manufacturers provide security updates for only a few years, leaving older devices running software with known flaws. Apple tends to support devices longer, but once support ends you face the same problem.

This is less about surveillance than about compromise, and a compromised phone is a surveillance device, however locked down its operating system once was.

Practical mitigation is mostly choosing hardware with a long update policy and keeping it current:

• Android: buy from a manufacturer with a published update schedule.
• iOS: install system updates promptly.
• Old spare phones: treat with caution. Still turning on does not mean still safe.

App store gatekeeping

App stores are both a security layer and a control mechanism. They screen apps for malware, handle payments and give you one place to update everything. For non-technical users that is a big safety benefit: if a malicious app slips through, it is often pulled quickly and updates can be forced.

The other side: the store operator decides what can run on your phone and on what terms. Apps can be rejected on policy grounds, removed after complaints or blocked in certain regions.

That touches freedom of speech in subtle ways:

• a messaging app might be removed for hosting content that breaks a platform's rules, even if it is lawful in the UK;
• a whistle-blowing tool might be excluded for not meeting a store's content moderation requirements.

Not everyday problems, but real structural constraints.

Myth: "sideloading" (installing from outside the store) is always riskier. Reality: it can be, but the real risk depends on the platform, the source, the update route and how you verify it.

• Android normally allows outside-store installs only after you grant the chosen installer permission. A manufacturer, child account or managed device may restrict it.
• Apple's alternative distribution is region-specific. Eligible iPhones can use it in Brazil, Japan and the European Union; eligible iPads in the European Union. It is not available to an ordinary UK-based account and device.

So do not assume instructions written for one platform or region will work on another.

Where outside-store installs are supported, a developer's authentic release can be safer than a copycat from an unfamiliar marketplace. But manual installation hands provenance and updates to you. So:

• use reputable sources;
• verify the publisher and signature where the platform shows them;
• keep a deliberate list of what you installed.

An organisation's device-management rules may override your choice.

Where the UK stands:

• October 2025: the CMA designated Apple and Google as having strategic market status for their UK mobile platforms.
• June 2026: it consulted on proposed requirements covering how app developers may steer users to outside transactions.
• August 2026: it published the consultation responses.

No final steering requirement had been announced at this review date. Designation, consultation and publishing responses do not themselves create UK alternative app marketplaces. In practice the dominant stores still shape what most people can run.

If your safety plan assumes an app could vanish at short notice, use services that also offer web access, or keep an offline copy of important data.

Official sources: Apple's regional availability rules for alternative app distribution and the CMA's mobile-platform programme.

De‑Googling trade‑offs

"De-Googling" means removing or reducing your reliance on Google services on an Android device, usually by:

• using alternative app stores;
• switching to open-source apps;
• installing an alternative Android build that ships without Google's services.

The aim is usually less data collection and no single company holding a detailed profile of your activity.

The catch: Google services are woven deep into Android. Many apps rely on Google Play Services for notifications, location and payments; without it, some break or behave oddly.

Realistic approach: work out which functions you truly need.

• A commuter might accept a transport app needing Google's location APIs, but avoid Google's search and browser.
• A freelancer might keep Google's services on a work phone for sign-in and calendar, and keep a personal phone more minimal.

Safety is another trade-off:

• some alternative app stores lack strong review processes;
• some "privacy" apps collect data of their own;
• a custom Android build can cut vendor telemetry but may weaken hardware-backed security features, or delay updates if the project is short of resources.

That does not make it a bad choice. It changes the risk profile.

Myth: removing Google makes your phone anonymous. Reality: your mobile network still knows which masts you connect to, many apps still talk to their own servers, and device identifiers may still be visible to networks and advertisers. De-Googling can reduce centralised profiling; it does not change the physics of cellular networks or the data appetite of modern apps.

For most people, the most reliable gains come from modest steps:

• disable unnecessary permissions;
• use a privacy-respecting browser;
• pick apps that work offline where possible;
• turn off background location for everything that does not need it.

For the technically confident, a carefully maintained alternative Android build can work, but it needs ongoing attention. Choose a level of effort you can sustain: a half-maintained privacy setup can be worse than a well-maintained mainstream one.

For detailed, current instructions on iPhone Lockdown Mode, Android Advanced Protection, app tracking, permissions, account recovery, mobile data, public Wi-Fi and phone VPNs, continue to 4.4 Securing iPhone and Android phones.