16% of my phone's traffic was tracking

I turned on a DNS filter on an ordinary Android phone and counted one session: 613 queries, 98 blocked. Where that shows up, and what you can do.

A phone sitting idle in your pocket is not quiet. It asks for addresses constantly — to sync, to fetch a notification, to load an ad. Each of those questions is a DNS query, and it is the one part of the traffic you can read without breaking any encryption.

So I counted.

What was measured

A Xiaomi 2201116PG running Android 13, in ordinary use — no synthetic test, no opening sites on purpose. A DNS filter turned on, checking every domain name the apps asked for against the public StevenBlack/hosts list, which collects known ad, tracking and malware domains.

In a single session:

DNS queries613
Blocked98
Allowed515
Apps that talked to trackers5

About 16% of everything the device asked for was tracking. This is not traffic the user requested: it is what apps do on their own, in the background.

Why 16% and not 50%

The number deserves honesty. It does not mean 16% of your data allowance goes to ads — a DNS query is a few hundred bytes, and a video is megabytes. What it measures is contact frequency: of every six addresses the phone looked up, one belonged to a domain that privacy tools block.

It also depends heavily on which apps are installed. A phone with free games and coupon apps shows much higher numbers. A phone with only a bank and a messenger shows much lower.

Where this shows up in practice

Three effects you can notice without any instrumentation:

What you can do without installing anything

Android has Private DNS built in since version 9, under Settings → Network & internet → Private DNS. Point it at a resolver that already filters — there are several free public ones — and you get two things at once: your queries travel encrypted, and a good share of tracking domains stop resolving.

It is the simplest option there is, and for many people it is enough. What it does not give you is visibility: you cannot see what was blocked, or which apps were asking.

What an on-device filter adds

The difference is seeing the list. Knowing that adashx4ae.ut.taobao.com showed up 40 times is different from knowing that “something was blocked” — because from there you can decide. Maybe you want to allow that domain because an app stopped working. Maybe you want to uninstall the app that made those 40 calls.

Without the list, the only choice is everything on or everything off.

The limits, stated up front

Filtering by domain does not solve everything, and anyone who says it does is selling something:


The numbers in this article come from our own measurement, taken with hado99 on a real device. The blocklist used is public and auditable.

Sources

‹ All articles