What the internet actually knows about you

There is a sentence you have almost certainly heard, probably more than once, at a dinner table or in a group chat or while standing in a kitchen waiting for the kettle. It goes something like this: "He could see exactly who was looking at her profile." Sometimes it is an Instagram profile. Sometimes a LinkedIn one. Sometimes the speaker is recounting a friend's husband, or a colleague's stalker, or a wealthy acquaintance who, we are told, has "people who handle that sort of thing." The sentence is delivered with the air of an open secret — as if everyone really knows this is possible, and only the polite pretend otherwise.

It is, in nearly every version, untrue. Not partly untrue, not exaggerated, not technically-true-in-rare-cases. Untrue in the same way that the moon being made of cheese is untrue. The capability being described does not exist in the place it is being claimed to exist. And yet the sentence keeps appearing, because nobody at the dinner table is quite sure how to push back without sounding rude, or smug, or like one of those people.

This piece is a friendly tour of that gap. The gap between what we have come to believe the internet can see about us, and what it actually can. Some of it is reassuring. Some of it is more unsettling than the folklore. All of it is more useful to know than the version we have been quietly carrying around.

A short catalogue of persistent beliefs

If you collected, over the course of a year, the things people say with confidence about how the internet works, you would end up with a kind of modern bestiary. Strange creatures, half-glimpsed, repeated until they feel familiar. A few of the more common ones:

That Instagram, secretly, will tell you who has been looking at your profile, if only you know which app to download. That LinkedIn shows you only the polite version, and the real list of viewers is held back for premium users or, more colourfully, available to anyone who knows "a guy." That your phone is listening to your conversations and pushing matching ads — you said the word kettle out loud, and now you are seeing kettles. That Incognito mode makes you invisible to the websites you visit. That someone could, with effort, find your home address from your profile alone. That a stranger across the world can be "traced back" by their IP address to a specific company in a specific country.

Some of these are kernels of a real thing, blown up into something they are not. Others are entirely fictional, but so widely repeated they have acquired the texture of fact. The interesting question is not whether any individual claim is true. The interesting question is why we are, as a culture, so reliably wrong about the same things — and what that wrongness costs us.

Three different buildings, not gradations

Here is the simplest way I have found to think about it, after years of trying to explain this to friends, family, and the occasional alarmed dinner companion. When you open Instagram, or LinkedIn, or X, or TikTok, there are three different layers of information involved. They are not gradations of the same thing. They are different buildings, with locked doors between them, and almost everyone in everyday conversation is confused about which door leads where.

The first layer is what the app shows you — the ordinary user looking at a screen. Your feed. The little heart count. The number of followers. That is the lobby of the building. Everyone gets in.

The second layer is what the app shows the people who run a profile or page. The analytics dashboard. A celebrity, a small business, a journalist, your aunt with the cake-decorating account — they all see the same kind of thing here. How many people saw the post. Roughly where in the world those people are, bucketed by country or sometimes city. Rough demographics. Aggregate numbers. No names. No accounts. No IP addresses. This is a different floor, with a different keycard, and most people have never been on it.

The third layer is what the company itself records, deep in its own servers. Every connection. Every device. Every IP. Every session. This is the basement, and the only people with the keys are the platform's own engineers, plus law enforcement with a warrant. It does not connect to the second floor. Not for the famous, not for the rich, not for the persistent. The legal architecture and the technical architecture both say no.

Look at the three side by side and the folklore falls apart on contact.

This three-layer picture is the single most useful thing you can carry around in your head about social platforms. Once it clicks, almost every "did you know they can see…?" claim sorts itself instantly. You ask: which floor are you describing? And do you actually have a key to it?

Your phone is probably not listening

No claim in this catalogue is more durable than this one, so it is worth taking it seriously. The story goes: you mentioned a holiday in Sardinia, out loud, only out loud, never typed it anywhere, and the next morning Instagram showed you an advert for a hotel in Cagliari. It was listening. Friends nod. The conversation moves on.

Continuous microphone capture by major apps is, in principle, technically possible. In practice it would be detectable almost immediately by anyone competent enough to look. Apps run in sandboxes that disclose, very precisely, how much battery they use and how much data they send. Streaming audio continuously to a server is not a small footprint. Independent researchers have looked, repeatedly, and have not found it happening at the scale the folklore implies. The legal exposure for a company caught doing this would be catastrophic and immediate, in every jurisdiction at once.

The duller truth is harder to sit with, in some ways, because it is more accurate. The apps do not need to listen. They already know where you are, who you are near, what you have searched for, what your friends have searched for, what you bought last month, what time of year people in your demographic tend to think about Sardinia, and which of your contacts has just done the same. Add those signals together and the system can serve you a Cagliari hotel before you have said the word out loud — which means that, statistically, sometimes it will, and when it does you will remember it because you had just spoken about it, and you will not remember the thousand other ads that were not eerie.

So no, your phone is almost certainly not eavesdropping in the cinematic sense. But the system around it has been built, with great care and enormous expense, to know enough about you that it does not have to. Whether that is reassuring or troubling depends, I think, on what you walked in believing.

Why the folklore sticks

If these beliefs are so easily falsified — by anyone who has ever opened an analytics dashboard, or looked up how a battery monitor works — why do they keep getting passed around? Why does the friend-of-a-friend story always sound so confident? The answer is not that people are foolish. It is that several forces line up neatly behind each claim, and they are not going anywhere.

1. The aura of plausibility The internet is genuinely opaque, and we know we are being tracked in ways we cannot see. Any additional claim about surveillance sounds about right, even when it is architecturally impossible. Once you have accepted that the system is watching you, it becomes hard to draw a line at any particular claim about how.
2. The confident speaker A friend, a colleague, a relative says the thing with absolute certainty. They are not lying. They were told by someone equally confident, who was told by someone equally confident, in a chain stretching back to a half-remembered article or, in some cases, an app that lied about what it could do. Confidence is contagious in a way that uncertainty is not.
3. The available villain We already know that platforms harvest enormous amounts of data and that the system is tilted against us. New claims slot into a pre-built emotional architecture. Of course they can see who is looking at the profile. Of course the phone is listening. The specific mechanism doesn't need to be plausible if the general direction matches what we already believe.
4. The verification gap To actually check any of these claims requires either technical literacy, access to internal platform documentation, or willingness to read terms of service. None of these are dinner-table activities. By the time the conversation has moved on, the moment to verify has passed. The story stays.

None of this requires anyone to be acting in bad faith. It only requires that the cost of repeating a claim be lower than the cost of investigating it, and that the audience be unlikely to push back. Both conditions hold, in almost every social setting, almost always. That is why the folklore endures.

Why getting this right matters

It is tempting to file modern digital folklore under harmless dinner-party talk. Some of it is. But there are quieter costs to walking around with the wrong mental model of how the internet works, and they show up in places you might not expect.

The first cost is personal. If you believe your phone is listening, you will spend energy guarding what you say in front of it — energy that does almost nothing, because the actual prediction engine is running on signals you cannot guard against by lowering your voice. Meanwhile, the things you could meaningfully adjust — location permissions, ad personalisation settings, which apps have which access — sit untouched in a menu nobody opens. The folklore drains effort away from the levers that actually work.

The second cost is relational. The friend who insists, with great confidence, that her ex was tracking her profile views — and who organises her behaviour around it for months — is reacting to a capability that almost certainly does not exist. The actual ways someone can monitor a person online are, sadly, plenty real: shared accounts, mutual contacts who pass information along, photos and tags that reveal patterns of behaviour. The folklore version distracts from the real one. It points the worry at the wrong door.

The third cost is civic. We are, collectively, being asked to make decisions — as voters, as parents, as employees, as consumers — about systems most of us do not understand. Age verification online. AI training data. Encryption. Identity infrastructure. Those decisions need to be made by people whose mental models match what is actually happening. Every time the folklore version of the internet wins out over the architectural one, those decisions get a little less aligned with reality, and the reality gets a little harder to legislate. The misunderstandings do not stay at the dinner table.

The remedy, mercifully, is small and gentle. It is not to become the person at the table who explains TCP/IP unprompted. It is to hold, in the back of your mind, a slightly more accurate picture of what is happening when you open an app — and to be willing, occasionally, to ask the boring follow-up question. How would they actually see that? Which screen? On what app? With what kind of access?

Most of the time, the conversation will move on. Sometimes the person making the claim will pause and realise they have been repeating something they never actually checked. Both outcomes are fine. The point is not to win the argument. The point is that you, walking around in your own life, are operating with a clearer picture — one that frees up energy for the real privacy questions, of which there are plenty.

The internet is genuinely strange and genuinely watching, in ways that are worth taking seriously. It just isn't watching in the ways the folklore says. And once you can tell the difference, the whole thing becomes a great deal less frightening — and, in a quieter way, far more interesting.