16% of my phone's traffic was tracking
I turned on a DNS filter on an ordinary Android phone and counted one session: 613 queries, 98 blocked. Where that shows up, and what you can do.
A phone sitting idle in your pocket is not quiet. It asks for addresses constantly — to sync, to fetch a notification, to load an ad. Each of those questions is a DNS query, and it is the one part of the traffic you can read without breaking any encryption.
So I counted.
What was measured
A Xiaomi 2201116PG running Android 13, in ordinary use — no synthetic test, no opening sites on purpose. A DNS filter turned on, checking every domain name the apps asked for against the public StevenBlack/hosts list, which collects known ad, tracking and malware domains.
In a single session:
| DNS queries | 613 |
| Blocked | 98 |
| Allowed | 515 |
| Apps that talked to trackers | 5 |
About 16% of everything the device asked for was tracking. This is not traffic the user requested: it is what apps do on their own, in the background.
Why 16% and not 50%
The number deserves honesty. It does not mean 16% of your data allowance goes to ads — a DNS query is a few hundred bytes, and a video is megabytes. What it measures is contact frequency: of every six addresses the phone looked up, one belonged to a domain that privacy tools block.
It also depends heavily on which apps are installed. A phone with free games and coupon apps shows much higher numbers. A phone with only a bank and a messenger shows much lower.
Where this shows up in practice
Three effects you can notice without any instrumentation:
- Battery. Each of those contacts wakes the radio. A radio that wakes often costs more than one that transmits a lot at once.
- Mobile data. Little per query, a lot over a month.
- Profiling. This is the effect you cannot feel. The same identifier appearing across different apps is what lets someone connect behaviours you never connected.
What you can do without installing anything
Android has Private DNS built in since version 9, under Settings → Network & internet → Private DNS. Point it at a resolver that already filters — there are several free public ones — and you get two things at once: your queries travel encrypted, and a good share of tracking domains stop resolving.
It is the simplest option there is, and for many people it is enough. What it does not give you is visibility: you cannot see what was blocked, or which apps were asking.
What an on-device filter adds
The difference is seeing the list. Knowing that adashx4ae.ut.taobao.com showed up 40 times is
different from knowing that “something was blocked” — because from there you can decide. Maybe
you want to allow that domain because an app stopped working. Maybe you want to uninstall the
app that made those 40 calls.
Without the list, the only choice is everything on or everything off.
The limits, stated up front
Filtering by domain does not solve everything, and anyone who says it does is selling something:
- Ads served from the same address as the content are not removed this way. That is the YouTube case, and no DNS blocker solves it.
- Blocking domains does not hide your IP from the sites you visit.
- Some apps depend on domains that appear on these lists and may break. That is why any serious tool has to let you allow a specific domain.
The numbers in this article come from our own measurement, taken with hado99 on a real device. The blocklist used is public and auditable.