Tracking with free and informed consent isn't. What's problematic is how that consent is obtained when the interface makes refusing noticeably more costly than accepting, which data-protection authorities consider improperly obtained consent.

Is my phone listening to me?

The simplest explanation is usually sufficient, and it's already unsettling: what's already known about you — searches, location, purchases, contacts, sites visited — allows cross-references precise enough to surprise, without any listening being necessary. Still, check which apps have microphone access, since no function justifies it and it should be removed.

Does refusing really change anything?

Going forward, yes: fewer trackers set, so less material added to your profile. On what's already been collected, refusal has no retroactive effect — that's what an erasure request is for.

Abusive ad tracking

In plain terms

Tracking your activity from site to site to target ads. This isn't an attack and is mostly legal; the issue is what you actually agreed to.

Definition

Ad tracking is the tracking of a person's activity across sites and apps in order to build a profile used for targeting. This fiche appears here not as an attack — most of the practice is lawful when consent is properly obtained — but because it produces the raw material other pages on this site describe, and because the consent requested is often obtained through an interface designed for that purpose.

How it works

A site rarely displays only its own content: it loads components supplied by third parties — audience measurement, ad networks, share buttons, fonts. Each one sees your visit and can attach an identifier to it, which makes it possible to recognize you from one site to the next and reconstruct a journey. On top of that, some techniques need not store anything at all, recognizing the combination of characteristics of your browser instead. The point that falls within this site's scope is consent: European law requires it to be free and informed, and the screen that collects it is frequently designed to make accepting instant and refusing laborious — a single prominent button, refusal hidden behind several layers of settings, pre-checked boxes. This imbalance is recognized as such by data-protection authorities, and it explains why so many people have "accepted" without meaning to.

Warning signs

Consent banner where "Accept all" is a button and refusal a discreet link
Refusal that requires going through several settings screens, or boxes already checked
Ads that reuse a product viewed elsewhere, or a recent conversation
A site inaccessible without accepting, with no alternative offered
An app requesting an advertising identifier or location access unrelated to its function

How to verify

Open the banner's detailed settings instead of approving it outright: the number of partners listed and the stated purposes are visible there, and they often go well beyond what the site suggests. Check your phone's settings for which apps have access to the advertising identifier and to location.

What to do

Refuse whatever isn't necessary for the site to work, refusal being a right and not a favor. Use a browser that limits third-party trackers by default. On your phone, turn off the advertising identifier and remove location access from apps that have no use for it. These settings apply going forward and don't erase profiles already built.

If it already happened

You can ask an operator for access to data about you, its erasure, and object to its processing; the CNIL is the competent authority in France, including when a consent banner doesn't make refusing as easy as accepting. Reporting a non-compliant banner is useful beyond your own case: that kind of report is what drives the practice to change.

Frequently asked questions

Is it illegal?: Tracking with free and informed consent isn't. What's problematic is how that consent is obtained when the interface makes refusing noticeably more costly than accepting, which data-protection authorities consider improperly obtained consent.
Is my phone listening to me?: The simplest explanation is usually sufficient, and it's already unsettling: what's already known about you — searches, location, purchases, contacts, sites visited — allows cross-references precise enough to surprise, without any listening being necessary. Still, check which apps have microphone access, since no function justifies it and it should be removed.
Does refusing really change anything?: Going forward, yes: fewer trackers set, so less material added to your profile. On what's already been collected, refusal has no retroactive effect — that's what an erasure request is for.

Official sources

Cybermalveillance.gouv.fr — Assistance and reporting (French government cybersecurity assistance service)

This article is part of the Data and digital identity family. Last updated: 2026-09-03.