The TLDR

Your operating system is a commercial product, and its maker wants data about how you use it. Android phones contact Google servers an average of 340 times per day. iPhones contact Apple servers even when you’ve turned off every analytics toggle you can find. Windows sends “basic diagnostic data” that includes your hardware configuration, installed apps, crash dumps, and browsing data from Edge. None of this requires your explicit consent because you agreed to it when you set up the device. The settings that reduce this collection exist, but they’re buried, and some telemetry can’t be turned off without replacing the OS.

The Reality

A 2021 study by Professor Douglas Leith at Trinity College Dublin measured the data transmitted by stock Android and iOS devices at rest — sitting on a table, not being used. Findings:

This is before you open a single app. This is the OS itself, doing what it was built to do.

How It Works

iOS Telemetry

Apple’s privacy marketing is the best in the business. The reality is more nuanced.

What Apple collects by default:

The $95 million Siri settlement: In 2024, Apple settled a class action over Siri activating without the trigger phrase and recording conversations that were then reviewed by human contractors. Apple said recordings were anonymized. Plaintiffs argued the recordings contained identifiable personal information, medical discussions, and intimate conversations.

“On-device processing”: Apple frequently claims data is “processed on device.” This is real for some features (Face ID biometrics never leave the device). But for others, “processed on device” means the raw data is processed locally and the results are sent to Apple’s servers. The distinction matters.

Settings that actually reduce collection:

Android Telemetry

Android’s relationship with telemetry is more complex because there are two layers: Google’s Android services and the device manufacturer’s additions.

Google’s layer:

Manufacturer additions (Samsung, OnePlus, Xiaomi, etc.): The Trinity College study found that Samsung, Xiaomi, and Huawei phones all transmit telemetry to their own servers in addition to Google’s collection. Samsung’s telemetry included device identifiers, app usage logs, and call/text metadata sent to Samsung Analytics servers.

Settings that actually reduce collection:

Windows Telemetry

Windows is the most aggressive desktop OS for telemetry collection.

The four telemetry levels (Windows 10/11):

What “basic” diagnostic data actually includes:

Microsoft Connected Experiences is a separate data collection system built into Office 365. It analyzes your document content to provide features like “smart suggestions” — which means Microsoft is reading your documents on their servers.

Settings that reduce collection:

macOS

Apple’s Mac telemetry is generally less aggressive than Windows but not zero.

Gatekeeper’s reporting: When you open an application, macOS contacts Apple’s OCSP (Online Certificate Status Protocol) server to check the developer certificate. This means Apple receives a log of every application you open, timestamped and tied to your IP address. Apple says they don’t log IPs — but the connection is made.

In 2020, this system caused a major incident when Apple’s OCSP server went down, and Macs couldn’t open applications because the certificate check couldn’t complete.

How It Gets Exploited

Geofence Warrants and OS Location Data

Law enforcement uses geofence warrants to demand location data from Google’s Sensorvault — a database built entirely from Android telemetry. Google reported receiving over 11,000 geofence warrants in 2020. You don’t have to be a suspect — you just have to have been in the area.

Apple has received similar requests but maintains that their location data collection is more limited and stored locally. The difference between Android and iOS here is meaningful — Google stores your location history on their servers by default; Apple stores Significant Locations primarily on device.

Insurance and Health Data

Apple Health and Google Fit data, collected through OS-level fitness tracking, can be accessed by insurance companies through data broker pipelines. John Hancock’s Vitality program explicitly ties life insurance premiums to fitness tracking data. The data flows from the OS health API → fitness app → data broker → insurance company.

Targeted Advertising from OS Data

Both Google and Apple use OS-level telemetry to power their advertising businesses. Google’s is more direct (advertising is their primary revenue model). Apple’s is more indirect (App Store ads, Apple Search Ads) but growing. The telemetry data feeds the targeting.

What You Can Do

The honest answer: you cannot fully stop OS telemetry without replacing the OS. What you can do is reduce it significantly.

  1. Review every privacy setting on your device — don’t trust defaults
  2. Turn off analytics sharing on iOS and Android
  3. Delete your advertising ID (Android 12+) or limit ad tracking (iOS)
  4. Use a VPN to prevent your ISP from correlating your device’s telemetry connections with your browsing
  5. For maximum privacy: Consider GrapheneOS (Android without Google) or Linux (desktop without Microsoft/Apple telemetry)

The corporate giants designed these systems to collect data. The settings to reduce collection exist because of regulatory pressure, not because the companies want you to use them.

Sources & Further Reading