I’m scared.

Of what? This is not a rhetorical question. Security starts with threat modeling, and your threat model dictates the precautions you need to take.

If you’re most people, your main privacy threat is advertisers and data brokers. Other comments have detailed how they collect data, and it’s usually “voluntary”. Defenses against this include a browser with good adblocking like Firefox with uBlock Origin, using websites instead of native apps as much as practical, using DNS-based adblocking, limiting or eliminating use of corporate social media, turning off voice-activated assistants, and preferring open source when practical.

It is not likely that advertising companies are activating the microphone or camera on your phone without your knowledge. The legal penalties for doing something like that in most countries would be ruinous for even the largest corporations, and the motivation for security researchers to check for things like that is substantial. If it did happen, the impact on your life would likely be a small payment from the resulting class-action lawsuit several years later.

If you live under a repressive regime that is known to routinely install spyware on phones, you may have different concerns. If an intelligence agency, large criminal organization, or multinational corporation is directly targeting you and willing to spend more money than most people have surveilling you, they’ll probably succeed even if you throw your phone in the ocean.

Smart phones aren’t magic. They are also not super high tech spy devices. They are dangerous because they promote you to willingly give all your personal information away. They usually aren’t spying on you in secret instead you’re giving them all the information you want. People get Google and Facebook accounts and tie their full name, date of birth, gender, family relationships, sexual preferences, upload photos of themselves and all their friends, then spend 6h a day using the services which gives them plenty of usage data to tell them what you like, what you hate, what engages you, what they can market to you, your fears, your fetishes, your secrets, etc. You may opt in to Google maps tracking your location history. You can literally check by going onto your Google account and checking your location history. It tracks everywhere you go. They have enough information to know where you go every Thursday at 1750 and who you’re with and how bad the traffic was and potentially even what beer you bought.

But they don’t do it in secret. They make sure to ask you first but hope you are too ignorant to question the point of it. You ever hear people say “it’s fine I have nothing to hide”? That’s the propaganda at work. Throw privacy away for the convenience of being able to look at ai memes on instagram.

You agree to allow your phone to listen all the time when you enable siri or Google assistant. You allow it to scan your face to use face unlock but it’s not that they’re collecting this information in secret. They don’t even need your camera footage and your secret voice recordings, or even steal your dick pics.

They already have everything they need. We gave it to them.

I an a certified mobile pentester and can tell you this is complete nonsense. There are real threats to your privacy and there are attacks that work against mobile devices. If you want to know what to do to protect yourself this EFF guide is a good place to start -> https://ssd.eff.org/playlist/journalism-student

Easy. Don’t believe the rumours.

the phone works even when it’s turned off

That is completely false, if you power down the phone then the phone is doing nothing as there is no power. If this is a genuine concern of yours mitigate it with a phone that has a removable battery.

records all the time you’re talking, and with neural networks you can find out what you said
Storing the audio is inefficient, if this were true it would likely transcribe the voice call to text. Think of the scale of phone networks how much data that would use.

even if you were ten meters away from the phone and in another room.
10 m away maybe, but not another room unless you are shouting.

the phone can see through objects,
Unless you specifically have a camera with a heat sensor then no. any amount of home insulation will diminish the effectiveness. A phone camera does not see through walls.

The thing about the phone seeing through objects is not true for all but 1 phone model: there was a phone released a while back that had an infrared camera which could see through thin plastics and clothes. Your phone can’t do this.

The other capability you mention of listening to everything all the time is technically possible if some three-letter agency or corp started targeting you specifically and got access to your phone to install literal spying software on it. You don’t have to worry about that. The mundane device that is actually doing that is your Alexa (if you have one).

If you are feeling seriously paranoid about this, you can factory reset your phone. On my Samsung phone, this is done by going to Settings, scrolling all the way down to General Management, scrolling all the way down again to Reset, and then selecting Factory Data Reset.

A more reasonable conspiracy theory thing to be worried about is that the government has access to a spyware program that can non-invasively (and therefore silently) take up space in your phone’s cache, relaying everything you do back to its user. However, since its not actually installed on your phone, restarting your phone once each day will mitigate the damage this can cause. I have set my phone to restart at 3 AM every day for this reason. (It’s also just generally a good idea to restart your phone regularly; it will run better if you do.)

A phone that’s off is off. No power supplied to the components, so it can’t record anything. It would be trivially easy to find out if it were otherwise, not to mention your battery would get drained.

The phone somehow “seeing through objects” is just straight up fiction. How is that supposed to work?

The truth is, it depends on your “threat level,” which is to say, the level of privacy you need to deal with the threats to your safety, or at the very least, your privacy.

It’s fairly well known in privacy circles that Android exists primarily to collect data. It’s the whole reason Google, an advertising company, bought the OS from a hobbyist about 20 years ago. It basically sucks up your data and uses it to build an advertiser profile on you.

Apple’s iOS isn’t much better, because Apple partners with Google on a few things, for example making Google the default search on iOS. Also, if you install Google apps, they will carefully tunnel around any extra security iOS offers, giving them almost as much data as if you used an Android phone. And because iOS is not open source, we don’t know what it’s phoning home to Cupertino. Apple advertises the iPhone as a privacy platform, but it’s not very privacy friendly. It certainly isn’t open to independent audit.

Cameras cannot magically see through things. That’s horseshit. There are AI apps that generate nude versions of people. They wouldn’t need that if cameras had magical X-ray vision. Cameras DO see more than they appear to capture, however. They can see outside of the angles at which they capture, but they ignore that information. They can also capture more light than they let on. They can’t see through a plastic or metal cap, though. Like one of those cases with a slide cover on the camera. Those cases also do not cover the front-facing camera, and the iPhone 17 series use a square front-facing sensor that can capture in landscape (horizontally) while you are holding the phone in portrait (vertical) orientation. What’s it doing with the information on the sides? You don’t know.

However, the microphone is pretty damn sharp. Apple has a feature called Live Listen that basically turns an iPhone paired with AirPods into a legitimate spy device. So as a test, I stuck my AirPods into my wife’s ears, then I went into another room. I set the iPhone down, then walked a room away and fucking whispered and she knew exactly what I said. This is an Accessibility feature for people hard of hearing — I can enable it from my Control Centre and just hold out my iPhone, and hear what is being said from across a room. It’s even more effective if I set my iPhone down somewhere (or hide it) and move to the end of Bluetooth range (about ten metres). So if Apple can let you listen to this, any app with microphone access can do the same. So setting your iPhone down in another room and moving away from it does not mean Siri can’t hear what you say. And I have no doubt the sensitivity on Android phones is just as good. Android itself may even offer a similar feature. In any case, modern Android phones and modern iPhones do display an indicator when an app (or the system) is accessing your microphone. I do not know if this can be disabled.

As for turning them off. You can’t separate most Apple devices from a power source. You can with the Mac, and the HomePod speaker, and the Apple TV box. The Apple Watch specifically has a mode for when it’s turned off that shows you the time when you tap the screen. That is, turning it off doesn’t turn it off, it boots into a stripped-down version of watchOS (itself a stripped down version of macOS) that tells you the time. I would not be surprised if iPhones, iPads, and MacBooks had a similar function.

Ask yourself this. Why would anyone bother to hear what you have to say all the time?