Privacy risks of sensors in commercial mobile phones: A critical technical review of documented attacks and exposure during nonuse

Commercial mobile phones combine physical transducers, radio systems, biometric interfaces, and internal telemetry whose outputs can disclose information outside their intended functions, mo- tivating this review of direct collection, inference, hardware fingerprinting, cross-modal leakage, elec- tromagnetic emanations, active interrogation, and information retained after acquisition across the complete functional sensor taxonomy established here, including uncommon environmental instru- ments and internal monitoring circuits, with documented results encompassing motion-based input inference, acoustic information in inertial and camera measurements, magnetometer-based activity disclosure, pressure-based touch and speaker-activity detection, calibration fingerprinting, thermal and power-based application inference, radio-based linkability, and reconstruction of spatial envi- ronments, while distinguishing demonstrations on phones from adjacent-platform demonstrations, intended capabilities with privacy implications, and unvalidated hypotheses according to the con- straints imposed by modern access controls, physical coupling, application lifecycle restrictions, and experimental design. Merely not touching a phone does not terminate network participation, previ- ously authorized collection, or vulnerability to demonstrated zero-interaction compromise, although screen-off operation, airplane mode, software shutdown, and removal of electrical power remain ma- terially different states, supporting substantial confidentiality concerns about carrying a connected or compromised handset into a sensitive setting without implying that every sensor continuously records, every phone transcribes nearby speech, or a fully unpowered device operates as an electronic recorder, with a sensor-by-sensor coverage register identifying established findings and evidence gaps and a final assessment relating defenses to acquisition, inference, linkability, retention, and disclosure.