If you want privacy on a smartphone you may ask the question, "Is there a way to be completely private or anonymous?" Complete privacy or anonymity on a modern smartphone is elusive at best and usually short lived. In this article we will discuss strategies to give you the upper hand when protecting your personal data. 

Start with a de-googled device

Let's begin by discussing the hardware and operating system. A de-googled device is an Android-based smartphone or tablet whose operating system has been replaced with a privacy-focused operating system like CalyxOS or GrapheneOS. Google no longer has direct access to any data or device identifiers like the International Mobile Equipment Identity (IMEI), MAC address, IP address, and serial number. This is because the proprietary (closed-source) software like Google Play Services (responsible for identification and tracking) has been removed. Background network queries like connectivity checks, network time protocol (NTP), and location services no longer communicate to Big Tech servers (at least in most cases).

Use apps that respect privacy

Pre-installed apps on a de-googled device such as the dialer, messaging, calendar, camera, and browser are open-source apps. Installing privacy-respecting apps that are open source and do not contain trackers is the best way to remain "degoogled".

CAUTION: Buying a de-googled phone and installing apps like Facebook, Google Maps, and Instagram defeats the purpose of being de-googled. Don't give Big Tech the opportunity to follow you again.

Privacy limitation of mobile networks

WARNING: A modern mobile phone is constantly communicating location data to cellular towers even when no SIM card is installed.

The base-band modem in your mobile phone is designed to constantly communicate with cell towers. Have you ever noticed the "Emergency Call" option is always enabled? In the United States, the Wireless Communications and Public Safety Act of 1999 required all mobile phones to transmit location information through the cellular towers for the purpose of locating someone when a 9-1-1 emergency call is placed. Even without a SIM card, an emergency call can go through. Therefore, your mobile phone is basically a location beacon. The only way to prevent this is to put the device in a Faraday bag.

Therefore, if a gov't authority has a reason to locate you, it can be done assuming you use a traditional wireless service or the phone's IMEI can be traced to you. 

Your identity on mobile networks

By installing a SIM card registered in your name from a mobile carrier, they immediately have access to your device's location, voice calls, SMS/MMS text messages, and any data that is not encrypted.

Every SIM card is assigned an International Mobile Subscriber Identity (IMSI) that the mobile carrier uses to identify you on their network. To be truly anonymous means signing up for a mobile plan without giving up any personal identity. This is known as "no-KYC" or know-your-customer. Even then, remaining anonymous is an even bigger challenge.

Strategies to maximize privacy and anonymity

Let's review several strategies to minimize data collection and protect your identity when making voice calls and texts, and browsing the internet.

Mobile plan / SIM from a traditional carrier that knows your identity

Mobile plan ID required

This is the least private option but we often compromise and accept that a wireless carrier will know our identity. However, for those that mainly want Google, Apple, and Big Tech out of their lives, this option may be a good solution. Use a VPN or route traffic through the TOR network with Orbot when browsing the internet, and try to get friends and family to use encrypted messaging apps instead of standard voice calls and texts. When the phone is not in use, put it in Airplane mode or a Faraday bag.

Mobile plan / SIM from a carrier with privacy features

Mobile plan Private

Companies like braxSIM unlisted, Cape,  Efani, and Silent Link offer mobile plans with enhanced privacy and security features.

  • BraxSIM unlisted, Efani and Cape provide SIM swap protection, minimal data collection, and secure global roaming. In some cases you can sign up without know-your-customer (KYC) requirements, make payments with cryptocurrency, and benefit from IMSI (identifier) rotation.
  • Silent Link is limited to data-only eSIMs, no voice calling, and inbound SMS. However Monero is accepted and zero personal data is collected, meaning the transaction is completely anonymous.

Even with enhanced privacy, remember your SIM has an IMSI (identity) that is tracked by the telecom company owning the infrastructure. Use VPN and TOR to encrypt network traffic and remain disciplined in how and where you use the device.

Mobile "data-only" plan + VoIP service

Data only VoIP Private

This option significantly reduces data collection by the wireless carrier. Even if the carrier knows your identity, they no longer have access to voice calls and texting data because calls and texts are made through Internet Protocol instead of the cellular network. First, pay for a data-only plan (no voice calling or texting) from Tello or JMP.chat. Then use a VoIP service from JMP.chat, Brax.me, or Hushed to make phone calls with a real phone number. You'll need to install their app to make calls. Remember to use a VPN for browsing the internet and secure messaging apps instead of SMS texting whenever possible.

Wi-Fi only + Secure messaging apps (no phone number)

WiFi only Messaging App Very Private

This in theory is the most private option and requires discipline to only communicate using encrypted voice/chat apps. The challenge will be to get all friends and family to use the same messaging apps. Then what about 2-factor authentication for banking, or calling an electrician or plumber? Ordering take-out? Maybe that's where a landline or second smartphone comes in handy.

Mobile plan / SIM from traditional carrier obtained anonymously

Mobile plan Anonymous

This option requires more effort up front and real anonymity may be short lived. At least in the United States, one can still purchase a pre-paid phone plan and physical SIM card from a retail store using cash. During registration with the carrier, a pseudonym is used instead of a real name, and temporary mailing address, and email alias are given. In some cases, registration of the SIM does not require any personal information. Once signed up, the monthly phone bill is paid with pre-paid gift cards. So in theory, the carrier doesn't know the user's real identity. Another option is to purchase the phone plan and a "Burner Phone". This method requires extreme discipline when using the device, otherwise true anonymity is short lived.

Conclusion

It is not easy to be completely private or anonymous and use a SIM card. Which configuration you choose depends on your threat level and how much personal information you're willing to give up. The right answer is what you decide is right for your particular use case.