Learn

Cox Media Group told advertisers it was listening to you. The FTC says it never was.

The FTC fined Cox Media Group and two partners $930,000 over Active Listening, a service they said could pick up conversations from phones, TVs and smart speakers. It never collected a second of audio, and the tracking that really explains those eerie ads is duller and harder to escape.

Joel Folgner

Joel Folgner

— 7 min read
Share
A smartphone lying face up on a dark table with its home screen lit, a strip of purple light glowing on the wall behind it
Photo: Jonah Pettrich via Unsplash
"My phone must be listening to me."

We've all said it. You talk about some obscure product. A few hours later you're seeing an ad for the exact thing you talked about. You didn't Google it. You didn't look it up. You only said it out loud. So the phone must be listening. But is it?

For years the answer has been a shrug and a stack of studies. Then a company came along and sold the thing everybody was afraid of.

"Where do you want us to listen?"

Cox Media Group, a Georgia media company, started selling small businesses a product called Active Listening in 2023, and the pitch was not subtle. Its own website told customers that a smartphone "is technically always listening." Voice data goes further than search data, the page argued, so "every casual conversation between two consumers becomes a tool for you to target, retarget, and retain customers." One line read, "Creepy? Sure. Great for marketing? Definitely."

In sales presentations the company said Active Listening used AI "to detect pertinent conversations via smartphones, smart tvs, smart speakers and other devices." It offered territories in ten and twenty mile radiuses. Prospective customers were asked, in writing, "Where do you want us to listen?"

When a small business owner pushed back and asked whether any of this was legal, the FTC says the company doubled down. Employees were coached to name Alexa, Google, OpenTable and Samsung as sources, and to point out that almost every app and device people buy asks for microphone access.

What the company was actually selling was email addresses. It was buying lists of them from data brokers, the same lists any advertiser can buy, and reselling them at a markup. Smart devices weren't sending voice data to Cox Media Group. There was no algorithm sorting anybody's conversations. The geography was fake too. A business paying to reach people within ten miles of Orlando got a list of people scattered across the country, with only a fraction of them anywhere nearby.

The Federal Trade Commission announced the proposed settlements in May and finalized the orders on August 27. Cox Media Group is paying $880,000. MindSift in New Hampshire and 1010 Digital Works in Wisconsin, the two smaller firms that supplied the sales materials, are paying $25,000 each.

Underneath the frightening name, this was the ordinary data-broker business. We've written that one up separately, in what a data broker is and what they have on you.

The strange part is who counts as the victim

The FTC's order sends that money to Cox Media Group's customers, meaning the small businesses that bought the service. That follows from what the agency found. If no microphone ever turned on, the businesses are the only ones out any money, and what they lost was an ad budget.

Sit with that for a second. The businesses in line for redress are the ones who read "Where do you want us to listen?" and reached for a credit card. They paid for a product sold on that promise.

They were lied to as well, and that matters. They were told the eavesdropping was legal because customers had agreed to it in an app's terms. Nobody knows how many of them believed that and how many just liked the sound of the product. But the people supposedly overheard at their own kitchen tables were never customers and were never recorded, so in the eyes of this case they were never the ones wronged. They were the product being described.

The companies also told advertisers that consumers had opted in to all of this. Their evidence was the terms of service you accept when you set up a phone or install an app. Cox Media Group put it this way to customers: "You may not realize it, but when you download apps, set up new devices you 'accept' the terms, and those terms include allowing them to access your microphone."

Clicking through mandatory terms of service, the agency said, doesn't amount to opt-in consent for a service that invasive or for voice data from inside somebody's home.

Then it went a step further. If Active Listening had worked the way it was advertised, that collection and use of voice data without adequate consent would itself have broken the law.

So the fine is for lying about the product. The regulator still went out of its way to say that building it for real would have broken the law.

Why you saw the ad

One company's sales pitch doesn't settle the bigger question. Nobody at the FTC opened up your iPhone, or Meta's ad system, or the thousands of apps sitting on your phone. So here is what the wider evidence does and doesn't cover.

Researchers have gone looking. The best known attempt gathered more than 17,000 Android apps from four app stores and put them through a mix of code inspection and live testing on real devices. In the live tests, nothing sent audio out. They were upfront about what that could miss. It was a slice of the app store, run for short sessions, on Android only, and audio turned into text before it left the phone wouldn't have shown up. That doesn't prove it can't happen. It means people went looking in thousands of apps and didn't find it.

Meanwhile the ordinary machinery keeps working, and any one ad usually has dozens of possible explanations behind it. Your phone carries an advertising ID, a long string that identifies the device across apps. Purchases, app activity, loyalty programs and location patterns get attached to a profile. Data brokers buy and sell the results. Advertisers then bid to reach people who match a description, and you match a lot of descriptions.

Two people in the same house already share plenty of signals. Same home address, same Wi-Fi, overlapping location history, probably some of the same stores and services. One person starts shopping for a leaf blower. The other person fits the audience too.

Two men in a kitchen. One sits at the counter looking at the phone in his hands while the other stands behind him talking on a phone
Two people in the same house look like one audience. Photo: Getty Images via Unsplash

And we notice the hits. We don't remember all the ads that had nothing to do with anything we said that afternoon.

If this system sounds familiar, it's the same one behind why two people can see different prices for the same item.

What your microphone does hear

There's one real exception, and it isn't a secret. Voice assistants record. That's their job. They listen on the device for a wake word, then start recording when they think they hear one. Sometimes they're wrong, which is how clips of people who never said "Hey Google" ended up in company hands. That's what Google's $68 million settlement was about, and Apple's $95 million Siri settlement before it. Neither settlement found that those recordings were used for advertising, and both companies say they weren't.

A small round fabric-covered smart speaker on a blanket, its four status lights lit, beside a phone showing a device setup screen that reads Welcome Home
A speaker waiting for its wake word. This is the one device in the story that really does record, and it says so on the box. Photo: Bence Boros via Unsplash

See who used your microphone

Both phone platforms will now tell you which apps used the microphone and when.

  • On an iPhone, open Settings, tap Privacy & Security, scroll down to App Privacy Report and turn it on. It only starts collecting from the moment you switch it on, so give it a few days, then come back and look at Data & Sensor Access.
  • On Android, open Settings, tap Security and Privacy or Privacy, then Privacy dashboard, then Microphone. It shows the last seven days on Android 13 and up, the last 24 hours on Android 12. Some phone makers rename these, so if Privacy dashboard isn't there, look one menu deeper under Privacy.
  • Watch the dot. On an iPhone, an orange dot at the top of the screen means an app is using the microphone, and a green one means the camera, or the camera and microphone together. On Android it's a green indicator in the top right corner, and tapping it tells you which app.

While you're in there, take the microphone away from anything with no business having it. A flashlight app doesn't need one.

Then change one setting that has nothing to do with the microphone. On an iPhone it's Settings, Privacy & Security, Tracking, and turning off "Allow Apps to Request to Track." On Android it's deleting the advertising ID under Settings, Privacy, Ads.

Neither is a cure, and neither empties a profile that already exists. Both do more about the ad than anything you can do to the microphone.

One company sold that exact eavesdropping service to small businesses for two years, and when the government opened it up, there was nothing inside but purchased email addresses. The ad still found you. It found you through a profile you helped build, using permissions you agreed to, sold on by companies you've never heard of, and none of it needed a microphone.

Go turn on App Privacy Report tonight. In a week you'll know what your phone has really been up to.

Sources:

Read more

[ Free every Tuesday, plus the Cache ]
Tech news without having to be tech savvy. Subscribe ×