A great deal is claimed about digital privacy and very little is proven. One side sells panic, the other sells products, and both work with figures nobody checks. This article tries the opposite: to show what a device actually sends, what a hardened operating system changes about that, what it explicitly does not change, and what it costs you in everyday life.
The uncomfortable result first: the biggest gain does not lie in the operating system. It lies in two or three decisions that cost nothing and that most people never make.
What was measured
The most frequently cited study comes from Douglas Leith at Trinity College Dublin, published in 2021 and peer-reviewed at the SecureComm conference. It recorded the data traffic of an Android phone and an iPhone with telemetry switched off and no account signed in.
The result at idle: Android sent about 1 MB in twelve hours, iOS around 52 KB. Both devices made contact on average every four and a half minutes. On both platforms the data transmitted included the IMEI, hardware serial number, SIM serial number and phone number.
Fairness requires the other side too. Google disputed the volume: the researcher had miscounted TCP/IP overhead, and the figure was out by an order of magnitude. Leith replied that he counted payload, while Google counted protocol headers as well. What matters is what was never disputed in this exchange: that this data is sent. The argument was about quantity, not about the act. Apple never answered despite repeated requests; anyone who says Apple rejected the study has no source for it.
The usual objection is that the measurement dates from 2021. For Android that objection has been dealt with: Leith measured again in 2025 on a Pixel 7 running Android 14, published in the journal Computers & Security. Finding: advertising cookies, click-tracking identifiers and advertising-related device IDs are stored on the device and sent back, in the factory settings, at idle, without a Google app ever having been opened, without consent and without an opt-out. For iOS there is no comparably recent measurement, because modern iPhones can no longer be opened up for it. Anyone who claims in the present tense that "Android sends twenty times more than iOS" is stretching the source.
It is worth noting that Google documents part of this itself. The description of the Android device configuration service lists the collection of the IMEI, serial number, MAC addresses, SIM and carrier data, IP address and a truncated subscriber identifier. No opt-out is provided for there.
The contradiction that describes it best
No drama is needed, only two documents side by side.
Google's own Play policy states that the advertising ID must not be linked to personal data or to persistent device identifiers such as the serial number, MAC address or IMEI. That is exactly why it can be reset.
A peer-reviewed study from 2023, published in PLOS ONE, measured on Samsung, Xiaomi, Realme and Google devices that a long-lived hardware identifier travels in the same connection as the resettable advertising ID. The authors put the consequence soberly: this undermines the purpose of resettable identifiers. Whoever resets the advertising ID has cut a thread that runs right next to another one anyway.
Where the data flows
Most of the collection does not happen in the operating system but in apps, regardless of which system is running. An app executes third-party code in its own process, with its own permissions. A website does not.
How much this adds up to need not be guessed. In a study of more than 86,000 apps from the German Play Store, published at USENIX Security 2021, 34.3 per cent sent personal data to advertising companies before any consent had been given.
Onward sale is documented as well, and one of the best-documented cases comes from Germany. Investigations by netzpolitik.org and the broadcaster Bayerischer Rundfunk obtained a dataset from a data marketplace with 3.6 billion location points from 11 million advertising IDs in Germany, as a free preview sample. Not hacked, not leaked: handed out as a product sample.
The technical mechanism behind it is open to inspection, because the specification for real-time advertising auctions is public. A bid request record contains, among other things, the advertising ID in plain text, latitude and longitude with an accuracy figure, IP address, device model, carrier, and the identifier of the app in which the ad appears. Every participant in the auction sees this data, even if it does not win the bid.
US enforcement comes with a qualification that is rarely mentioned: the known proceedings against location data brokers all ended in settlements without a fine and without an admission of liability. They are allegations by an authority, not established facts. And the settlements contain an express exception for national security purposes.
GrapheneOS: what it is
GrapheneOS is an open-source, security-focused Android system, run by a non-profit project with around fifteen full-time staff and funded entirely by donations. Today it runs only on Google Pixel devices, and the reason is technical: only there can the bootloader be locked again after installation, with the project's own signing key stored in the secure element. Only then does verified boot work in full. The project expressly regards an unlocked bootloader as an incomplete installation.
Two points that overtake the common picture:
The tie to the Pixel is ending. In March 2026 the project announced a long-term partnership with Motorola Mobility; the first devices are expected in 2027. It is not exclusive, and no money flows to GrapheneOS.
The update lead has narrowed. Since June 2025 the EU ecodesign regulation has required at least five years of security updates for every smartphone placed on the market. The Pixel advantage is therefore seven years against five, no longer seven against two.
What GrapheneOS actually solves
Google Play without special privileges. On standard Android the Play services are privileged and form the foundation for system functions. On GrapheneOS, if you install them, they run as an ordinary app in the sandbox, according to the project without any special access, limited to the profile in which you install them. The system never uses them as its own foundation.
Location without Google. Requests are redirected to the project's own implementation, the position is calculated on the device, and only a network identifier is transmitted.
Permissions that Android does not have. Network and sensor access can be withdrawn per app; apps then receive zero values instead of sensor data. On top of that come storage and contact scopes, a hardened memory allocator and separate profiles with their own keys.
Less Google in the background. For connectivity checks, time synchronisation, the GNSS almanac and assisted location over the mobile network, GrapheneOS uses its own servers, and in doing so it blocks the transmission of the subscriber identifier and phone number.
Data extraction from locked devices. This is where the strongest provable effect lies: limited PIN attempts, rate limiting in the secure element, automatic reboot after inactivity. According to leaked documents from a forensics vendor, locked devices running a current GrapheneOS version are regarded as impossible to extract. The provenance of these documents is weak: usable as an indication, not as proof.
What GrapheneOS explicitly does not solve
This section is missing from almost every account, and the project is remarkably open about it.
The mobile network. The documentation states plainly that connecting to the carrier's network necessarily means identifying yourself to it, and that airplane mode is the only way to avoid being located by the mobile network. Classic calls and text messages should be avoided because they rely on trusting the carrier.
The same point from a legal pen, purely as a technical description: in its Carpenter decision the US Supreme Court found that a phone generates cell-site data simply by operating, without any action by the user beyond switching it on, and that there is no way to avoid leaving this trail other than disconnecting the device from the network.
LTE-only is no protection against IMSI catchers. The project states expressly that the feature serves only to reduce attack surface and must not be mistaken for a way of trusting the mobile network. Anyone who sells it differently goes beyond what the maker says.
Encrypted DNS currently achieves little. Again in the project's own words: because the destination address and the server name remain visible, encrypted DNS is "not worth much yet" and explicitly no substitute for a VPN or Tor. In addition, the filtering behaviour reveals that filtering is taking place, which itself can serve to recognise a device.
VPN leaks are not fully solved. In the project's words, it does not currently consider this a complete feature.
Recognition remains possible. The measures against device identifiers are described as a minor bonus; there remain plenty of side channels for recognising devices across apps.
Anonymity is not promised. The project makes this claim nowhere, and its statement on airplane mode is in effect a refusal of it. Anyone seeking anonymity is looking for something other than an operating system.
eSIM still needs proprietary Google components. Management is disabled by default and can be switched on, but it requires unmodified components from the Pixel firmware. The claim that GrapheneOS has its own eSIM implementation is wrong; only the dependency on Google Play has gone.
And it does not get around hardware checks. Expressly not, because that would be fragile and would break constantly. That is honest, and it leads straight to the next section.
The honest price: banking apps
Google runs an interface through which apps check the state of a device. It has several levels. The middle one requires, in Google's own wording, a certified manufacturer image; a locked bootloader alone is not enough. GrapheneOS passes the basic level but not the two upper ones, not for lack of security but for lack of licensing.
There is a technically superior route that Android itself provides: standard hardware attestation. With it an app checks the boot state directly and cryptographically and can accept the keys of alternative systems, without a detour through a Google service. GrapheneOS publishes its keys signed and machine-readable so that providers can do exactly that.
The situation in numbers, according to the project's own statement at the end of July 2026: around ten per cent of banking apps check device integrity, around ninety per cent work. And the trend is neither clearly better nor worse: more providers are adopting Google's check, while at the same time more providers accept hardware attestation as an alternative.
For readers in the UK the picture is comparatively good. In the community-maintained list linked by GrapheneOS, around fifty UK banking apps are reported as working, among them Lloyds, Halifax, NatWest, Nationwide, first direct, Monzo, Starling, Chase UK, Barclays and HSBC UK. With explicit caveats: Barclays, Barclaycard and HSBC UK are reported to run only in the owner profile, Santander and Marcus may need secure app spawning switched off, and the reports on Zopa conflict. The list also covers the Nordics, Benelux and Ireland; in Denmark, for example, apps that depend on MitID authentication need a workaround. This list is user-generated; GrapheneOS expressly gives no guarantee for it. It is useful for orientation, not as a promise.
Contactless payment via Google Pay does not work. In Europe that hurts less than elsewhere, because a number of banks run their own NFC payment apps, and Curve Pay and PayPal work as well. Outside Europe the project knows of no solution.
The situation moves, and in both directions: at the beginning of August 2026 a major payment provider newly excluded GrapheneOS, while several traditional banks expressly allowed it. If you depend on a particular app, check it before switching, and if in doubt keep a second device.
Three common claims that are wrong
"Android Auto only works with a cable." Wrong. Both are supported; wireless simply needs more permissions.
"The camera is worse." Half true, and that is exactly where the mistake lies. The same app delivers the same quality as on the original system, and the Pixel Camera app runs without Google Play having to be installed. The bundled GrapheneOS camera is deliberately leaner: fewer frames for HDR, and panorama, astrophotography and motion photos are expressly not on the roadmap.
"Unlocking the bootloader voids the warranty." There is no statement from Google to that effect. The warranty terms for the European Economic Area state that the voluntary manufacturer's warranty leaves statutory consumer rights untouched; damage caused by modifications is excluded. GrapheneOS says Pixel devices remain covered, but there is no confirmation of this from Google. Treat it as an open question, not a settled one.
What does more than any operating system
Sorted by effect per effort.
1. Signal for everything sensitive. Both big messengers encrypt content. The difference lies in the metadata, and it can be checked, because Signal publishes the court orders it receives and its own responses. Across all documented cases from 2016 to March 2026, Signal could only ever provide two things: the time of registration and the last connection. In the most recent case, data on 37 phone numbers was demanded; seven accounts did not exist, and for 24 there was no data. By comparison, WhatsApp itself lists in its European privacy policy what it collects: how you interact with others, the time, frequency and duration of your activities, plus device model, battery level, signal strength, mobile network and IP address. What is not stored cannot be handed over. This is the only point on this list for which the evidence exists in the form of court records.
2. Fewer apps, more browser. The structurally most effective step, and almost nobody takes it. An embedded third-party component inherits every permission you grant the app; Apple concedes in its own rules that this counts as tracking even if the developer does not use the component for that purpose. A deleted app is the only measure with a hundred per cent effect.
3. Phishing-resistant two-factor sign-in. Hardware security keys and passkeys are bound to the domain; a fake sign-in page cannot produce a valid confirmation. That is cryptography, not a detection heuristic. Google reports from its own research that not a single user who relied exclusively on security keys fell victim to targeted phishing. For a substantial fortune, account takeover is the realistic disaster scenario, not personalised advertising. Incidentally: the often-quoted Google study from 2019 with the 100 per cent figures tested phone prompts, not security keys; the two pieces of evidence are regularly mixed up.
4. Location permissions and unused apps. Approximate instead of precise location, "only while using the app", one-time permissions. Android automatically removes the permissions of apps left unused for months and clears their cache. Given the precision with which location data is traded, the approximate option is the single most effective setting.
5. Delete the advertising ID: effective, but limited. On Android every access afterwards returns a string of zeros; on iOS the same applies when no tracking permission has been granted. Measurably effective: after the prompt was introduced, transmission of the iOS advertising identifier fell from a quarter of apps to zero. But: the number of tracking components stayed practically the same, and the hardware identifier described above still travels along. Two minutes of effort, honestly assessed. On iOS it is also worth using the separate switch for Apple's own personalised advertising, which the tracking prompt does not cover.
6. Account hygiene. Automatic deletion of activity data reduces the stock held by the largest single collector. With due precision: Google says it aims to remove data from view, and expressly reserves longer retention for legal purposes.
7. Choice of browser. Safari blocks third-party cookies completely and deletes script-set storage after seven days without interaction; Firefox separates cookies per website. Neither helps against the provider you are signed in to.
8. Encrypted DNS: the most overrated point. Useful for filtering, but it neither hides destination addresses nor makes you anonymous. GrapheneOS says this about its own feature more clearly than most providers would.
9. The mobile network layer. There is no device solution here, and this is not a measure but a limit. Airplane mode really does cut the radio link, at the price of being unreachable.
A word on the legal position, because the UK and the EU differ here. In the EU, the Court of Justice confirmed in September 2022 that EU law precludes the general and indiscriminate retention of traffic and location data as a preventive measure against serious crime. The UK is outside that case law: under the Investigatory Powers Act 2016 the Home Secretary can, with the approval of a Judicial Commissioner, give a telecoms operator a retention notice requiring it to keep communications data, such as who communicated with whom, when and for how long, for up to twelve months. And even where no retention duty applies, data still comes into being: network operators generate it for their own operational purposes in any case.
How this connects with asset protection
Digital privacy is not asset protection, and it would be dishonest to claim otherwise. It lowers two concrete risks: the takeover of accounts, and the merging of information into a profile that others exploit. The first is a real financial risk, the second more a question of sovereignty.
What digital privacy explicitly does not do: it does not protect any wealth from legal access. What public authorities know about your assets depends on reporting and register duties, not on your phone; how far that reaches today we have set out on the page on the EU asset register. And whether wealth can be reached in an emergency is decided by the structure in which it is held: that is what asset protection, the protective structures and investing abroad are about.
Confusing the two means putting effort in the wrong place. A hardened phone with unprotected wealth is the clearly worse combination compared with the reverse.
How reachable your wealth actually is, and everything that follows from it, is clarified in a personal consultation.
Frequently asked questions
Do banking apps work on GrapheneOS?
Mostly, yes. The project itself puts the share of banking apps that do not work at around ten per cent and sees the trend as stable overall. For the UK, the community-maintained list reports around fifty banking apps as working, among them Lloyds, Halifax, NatWest, Nationwide, Monzo, Starling, Barclays and HSBC UK, some with caveats. Google Pay does not work; contactless payment runs through the apps of a number of European banks as well as Curve Pay and PayPal.
Does GrapheneOS make me anonymous?
No, and the project does not claim it does. It makes profiling by the platform and apps harder. It changes nothing about what your mobile carrier sees: by its own statement, airplane mode is the only way to avoid being located by the mobile network. And it changes nothing about accounts held in your name.
Why only Google Pixel devices?
Because only there can the bootloader be locked again after installation with the project's own key, which is the precondition for full verified boot. That is changing: since March 2026 there has been a partnership with Motorola Mobility, and the first devices are expected in 2027.
Does unlocking the bootloader void the warranty?
There is no statement from Google on this. The warranty terms for the EEA state that the voluntary manufacturer's warranty leaves statutory consumer rights untouched; damage caused by modifications is excluded. GrapheneOS says Pixel devices remain covered, but there is no confirmation of this from Google.
Does a secure phone protect my wealth?
No. It lowers the risk of account takeover and reduces profiling. What authorities know about your assets depends on reporting and register duties, and whether wealth can be reached depends on the structure in which it is held. No operating system affects either.