Who is doing the tracking: the SDK economy
Developers rarely hand-code analytics. They embed third-party SDKs that ship with tracking as a default feature. The usual residents on any Android device:
- Firebase / Google App Measurement — event beacons, crash logs, usage funnels. Present in a huge share of Play Store apps.
- Meta SDK (Facebook) — cross-app profiling; records when you open or interact with apps that embed it.
- AppsFlyer & Adjust — attribution trackers that fingerprint your hardware to connect installs, clicks and purchases across apps.
- TikTok / Pangle — ad-auction telemetry embedded via the Pangle ad network in many games.
- Yandex AppMetrica — location-tagged analytics and crash feeds.
Individually each ping looks small. Together they reconstruct your day: which apps you open, when you wake, where you roughly are, and which ads you clicked — a profile that outlives any single app.
How to audit what your phone is actually doing
- Install a network auditing firewall such as NULLOG and let it run for 24–48 hours with the screen off as usual.
- Open the background activity log. It classifies intercepted background calls by SDK and risk level — you will see per-SDK ping counts like "Meta: 180 background pings".
- Check per-app counters in the App Rules tab to identify the noisiest offenders — games and free utility apps are almost always at the top.
The two-layer defense: settings + network
Layer one — cut what Android gives away. Delete the advertising ID (Settings → Privacy → Ads), revoke location and contacts permissions from apps that do not need them, and disable notification listening and usage access for anything that does not explicitly require it.
Layer two — block the exfiltration itself. Settings cannot stop a properly-encoded telemetry call once it leaves the app. A local firewall can: when an SDK tries to resolve app-measurement.com or graph.facebook.com, the request is matched against the blocklist and dropped in device memory, before it ever reaches the network. The app keeps working — the profile does not get built.
What changes after a week
Users typically see 20,000+ blocked background requests in the first week and listing 10–25 distinct tracking SDKs. The behavioral tell is subtler: your "random" product suggestions across unrelated apps cool off, because the attribution chain that linked them is severed at the socket.
Put it into practice with NULLOG
NULLOG runs every technique in this guide locally on your Android — ads, trackers and telemetry filtered in device memory. No root. No cloud. No logs.
Download NULLOG APK (v1.0.2)