Changing mobile OS doesn't eliminate tracking in Spain

Switching your phone's ROM evades tracking but does not remove it

The discussion opens with a stark warning: Google and Apple allegedly install tracking and location apps on phones "without any consent," citing user security as the excuse. The claim originates from a Xiaomi Note 7 running Android. The conclusion is that if someone insists so much on protecting you, something is brewing. This premise is never documented in the conversation, but the initial question—how to eradicate the mobile operating system—ultimately yields an uncomfortable answer.

Can you completely remove a mobile OS?

The first technical response is a cold shower. A smartphone is not a computer. The environment is closed, the bootloader comes locked, and many models don't even allow software replacement. Where possible, the standard route is LineageOS or GrapheneOS, requiring bootloader unlocking, installing a recovery like TWRP, and rooting with Magisk. An extreme case is noted: a Lumia with Windows 8.1 accepts nothing more than Windows ARM "and little else."

Even then, cleaning has limits. The baseband processor—the baseband—runs a proprietary system, the bootloader isn't free, and drivers remain closed. Not even GrapheneOS escapes this. Translation: you can evict the tenant, but the building still has an owner.

Automatic connections that survive a ROM change

Here lies the most disturbing data. Even with LineageOS and no Google services, the phone keeps knocking on several servers' doors as soon as it gets network access. This is verified by running a sniffer on the router while enabling Wi-Fi: a flood of requests falls through, which a firewall like AFWall+ lets pass, perhaps because they bypass it or are on its internal whitelist.

• connectivitycheck.gstatic.com and Google's captive portal mode
• time.android.com, the time server
• xtrapath1, xtrapath2, and xtrapath3.izatcloud.net, from Qualcomm
• A stream of Amazon domains

The recipe to block them: point the hosts file to the local loopback address and use three commands to disable captive portal detection. Another recommendation insists on downloading apps only from F-Droid: any APK from Play Store, Aurora, or Yalp drags trackers that connect to Google. The complete configuration, domain by domain, was the most useful part of the conversation.

Why does antenna-based tracking make much of the effort useless?

Because location doesn't depend on the operating system. The phone communicates with antennas, and that alone is enough to triangulate its position, regardless of the software. The carrier knows where you are; the State legally accesses this data. The usual defense is that what leaks is the number and line holder, not the content.

This nuance doesn't convince everyone. Some recall that MAC and IMEI addresses are burned into the hardware and broadcast to the network. There are also low-cost tools available to anyone: a HackRF from AliExpress for 60 euros scans nearby IMSIs—the phone's ID—and a 10 euro DVB-T dongle can build a homemade scanner. Stingray-type devices, already used by Vancouver police, fall into this same category.

What alternatives exist to WhatsApp and Signal?

The most repeated proposal involves XMPP, a federated messaging protocol: like email, anyone can set up their own server, avoiding reliance on a single company's infrastructure. The recommended client is Conversations from F-Droid, with OMEMO encryption. Signal remains a second option, with the drawback of requiring a phone number. Wire and Briar are also mentioned, the latter promising—still in development—to send messages via Bluetooth without internet.

Faraday cages and dumbphones: shortcuts that don't work

Phone cases with Faraday cages are dismissed as snake oil: while the phone is inside, it receives no calls, but once taken out to use, it sends location and data again. Turning it off isn't very effective, because, according to the thread, some models transmit even when powered off. The old-school alternative is a basic terminal: a Nokia from the good old days, without apps or email.

The underlying issue is raised by Snowden's book. It is said that the former analyst only connects via laptop for important matters and assumes that 90% of internet traffic passes through servers on US soil. Hence the obsession with routers, satellites, and infrastructure, rather than specific apps. The thread describes those who don't want to be identified as having multiple terminals, SIM cards registered to no one, and none linked to their real identity.

One gap remains unclosed. The list of connections can be cut, apps can be replaced, and the ROM can be flashed. The baseband, hardware, and antenna stay there. As long as that doesn't change, mobile anonymity is an aspiration, not a setting.