No smartphone that remains connected to a cellular network can be fully untraceable. Even the most privacy‑focused devices still expose hardware identifiers and baseband traffic, though they reduce the amount of data that can be collected.
Hardware identifiers you can’t hide
Every mobile device carries a permanent 15‑digit IMEI that the network reads as soon as power is applied. The SIM card adds an IMSI and an ICCID, giving the carrier three independent ways to identify the handset before any app runs. These numbers are hard‑coded and cannot be altered by software.
Baseband and the hidden operating system
The cellular modem runs its own closed‑source OS, separate from the phone’s main operating system. Because it is not open to scrutiny, state actors can exploit vulnerabilities to turn the phone into a passive listening device. Pegasus and similar exploits show that baseband backdoors can be activated without the user’s knowledge.
Cell tower triangulation still works
Phones must continuously communicate with nearby towers to maintain a signal. Even if location services are disabled, the baseband will exchange timing and handover messages that let a carrier pinpoint the device to a few hundred metres. In dense urban areas the accuracy can improve to tens of metres.
Privacy‑hardening operating systems
GrapheneOS and CalyxOS strip out Google Play Services and other background services that normally send usage data to servers. On a standard Android phone, the device may ping Google servers hundreds of times an hour; on a hardened device, outbound traffic drops dramatically. However, the hardware still carries the same IMEI and baseband firmware.
Physical kill switches and Linux phones
Purism Librem 5 and PinePhone feature sliders that physically disconnect the camera, microphone and cellular modem. When the switch is engaged, the phone cannot communicate with the network, but the lack of a usable interface limits everyday practicality. These devices are best suited for users who can tolerate a clunky experience.
Wi‑Fi and Bluetooth tracking vectors
When Wi‑Fi is on, phones send probe requests that reveal nearby networks. Even with MAC randomisation, many devices revert to a fixed MAC address during a real connection, allowing a retailer or a public hotspot to track the device across locations.
anonymity is a trade‑off
Full invisibility is unattainable for a phone that uses cellular connectivity. The most privacy‑focused options minimise data leakage but still expose hardware identifiers and baseband traffic. Users who need extreme anonymity must accept reduced functionality or use a device that can be completely disconnected from any network.