Stalkerware, explained: when the watcher is someone you know

Summary

• Stalkerware is software that lets one person watch another person's phone without that person's knowledge or consent. It is usually sold as parental control, anti-theft or employee monitoring software.
• It usually needs physical access to the phone, or a phone whose built-in protections were removed. Someone who already has the person's cloud account password may not need it at all.
• No source gives a reliable count. One security vendor counted 31,031 of its own mobile users affected in 2023. A 2014 NPR survey of more than 70 shelters found 85 percent worked with victims whose abusers had tracked them by GPS.
• U.S. enforcement has reached sellers: a federal guilty plea in 2014, and an FTC ban on one vendor and its chief executive in 2021. A 2022 federal law helps survivors separate a phone line from an abuser's plan.
• If you suspect it, the advice from advocates and the FTC is to get help from a safer device before you remove anything, because removal can make an abuser escalate and can destroy evidence.
• An examiner can often show that a monitoring app was installed. An examiner cannot say who installed it from the phone alone, and a clean result does not prove a phone was never watched.

What stalkerware is

The Coalition Against Stalkerware, formed in November 2019 by ten founding partners that include the Electronic Frontier Foundation, the National Network to End Domestic Violence (NNEDV) and several security companies, defines stalkerware by what the software does and not by how it is advertised. In short: software offered to individuals that lets a remote person watch another person's device without that person's consent and without a clear, lasting notice on the device. The same page says that most such software is sold as parental control or anti-theft software, which is why the definition looks at behavior.

What it can show the watcher depends on the product and the phone. Public descriptions of the category include messages, call logs, browsing history, location, photos, and in more invasive products the microphone and camera. This article does not name or compare products.

It is not the same thing as the spyware sold to governments, which LAB-0013 covers. The two sit on one spectrum, but the people involved, the cost and the access they need are very different. Stalkerware is the version that an ordinary person can buy with a card and a few minutes of access to a phone.

Some abuse needs no software. NNEDV's Safety Net project notes that a person who has physical access to a phone or access to its cloud accounts may not need stalkerware, so a clean phone does not close the question. A shared account, a location-sharing setting or a family plan can do the same work.

How it reaches a phone

NNEDV says almost all phone stalkerware needs physical access to install, then runs in a hidden mode that is hard to detect or remove. The FTC adds that some stalkerware works only on a phone that has been rooted (Android) or jailbroken (iOS), meaning its built-in protections were removed or bypassed. In its 2021 complaint against one vendor, the FTC alleged that Android buyers had to bypass device restrictions and that the company gave instructions for hiding the app. There are also accounts of other routes. In the case MIT Technology Review reported in 2019, a woman said the software arrived on her phone inside a disguised picture message from a man she had been dating for a few weeks.

Figure 1 puts these public descriptions in order and says what each one means for a person and for an examiner. It gives no method and no product detail.

How common it is

Nobody can give a reliable count, because the software is built not to be seen and the people who find it are mostly the people who go looking. Public numbers are partial, and the ones in Figure 2 count different things. They are shown together so that you can see what each one does and does not measure. They should not be added up or compared.

The vendor's own report says its figures cover only its users and that stalkerware is often marketed as anti-theft or parental control software, which makes it look legitimate. The Coalition Against Stalkerware says a legitimate app can also play a part in an abusive situation, and keeps its definition narrow for that reason.

What the public record says about sellers and the law

Selling a monitoring app is not illegal by itself in every case, and what is lawful depends on the facts and the place. This article is not legal advice. The public record shows a few places where U.S. authorities have acted.

• 2014. The chief executive of a company that sold a mobile spyware app pleaded guilty in federal court in Virginia and was fined $500,000, with forfeiture of the app's source code. It was reported as the first U.S. criminal conviction for advertising and selling a mobile spyware app.
• 2021. The FTC announced a consent order that bans a stalkerware vendor, Support King (SpyFone), and its chief executive from offering, promoting or selling any surveillance app or service. The FTC alleged that the company secretly collected and shared people's data, failed to secure it, and that a hacker obtained data on about 2,200 consumers in 2018. The order also requires deletion of the data and notice to the owners of the phones. The FTC called it only its second case against stalkerware apps and the first with a ban. These are the agency's allegations and the terms of a consent order.
• 2022. Congress passed the Safe Connections Act (Public Law 117-223). It lets survivors ask a mobile provider to separate their line from a shared plan. The FCC adopted rules for it in November 2023: a provider must act within two business days of a complete request, and calls and texts to covered hotlines are kept out of consumer-facing logs.

In 2019 the Citizen Lab at the University of Toronto assessed the marketing of eight stalkerware products popular in Canada, the United States and Australia. It found that most companies' blog and search content referred extensively to spousal monitoring. That is relevant to a reader's own case: the way a product is advertised is public evidence, which can matter in a complaint.

Signs, and why none of them is proof

The FTC lists two kinds of sign. On the phone: a battery that drains faster than usual, unexpectedly high data use, overheating, and the phone turning off and on by itself. In the other person: knowing your exact location when you have not said where you are, referring to private conversations with others, knowing who you text or call or which sites you visit, and having had access to your phone unsupervised.

The phone signs have many ordinary causes, such as an old battery or a heavy app. NNEDV says the most common sign is the other person's behavior, such as knowing too much about your phone activity, and advises trusting your instincts and looking for patterns. A pattern that shows up together, with a person who has had access to the phone or accounts, is worth taking seriously. A single sign is not a finding.

If you suspect it

This summarizes advice from the FTC and NNEDV. It is general information, not a safety plan. A domestic violence advocate can plan for your situation. The National Domestic Violence Hotline in the United States is 1-800-799-7233, by chat at thehotline.org, or by texting START to 88788. If you are in immediate danger, call 911.

1. Do not rush to remove it. Both the FTC and NNEDV warn that removal may cause the person to escalate, so talk with an advocate first.
2. Use a device the person cannot watch to ask for help, such as a friend's phone or a prepaid phone. Anything you do on the monitored phone may be seen.
3. Write down what is happening. Keep notes, and preserve what you want to keep, such as photos, before you reset or replace the phone. Police or a forensic examiner can look for evidence on the device, and removal may destroy it.
4. Choose a clean start. A new phone with accounts the person cannot reach is the safest option according to the FTC. A full factory reset removes stalkerware in most cases. Do not restore apps or files from a backup, which can reinstall it, and set up a new cloud account if the old one may be known.
5. Close the other doors. Keep the phone in your hands, use a passcode of at least six digits that the person does not know, install updates, use strong passwords and two-factor authentication, and review what you share. On an iPhone, Apple's Safety Check lists the people and apps you share with and can stop sharing, and it also has an emergency reset.

What an examiner can and cannot conclude

An examiner who is asked whether a phone was monitored can often say whether a monitoring application, or the settings it needs, are present, and what the phone recorded about them, such as when they were installed. The Coalition's practice of flagging apps by their behavior, and not by their marketing, is a sensible model: report what the app is able to do and what the phone shows it did.

An examiner cannot say who installed it. The phone shows an installation, not a person. The phone also rarely shows what was collected or who read it, because the watcher's view is on another device and the vendor's servers. Account-based watching, such as a shared cloud account or a location-sharing setting, leaves no app to find, and a factory reset removes the app and much of its trace. A clean result is a statement about what was examined. Lab work on empty results explains the rule: a claim that nothing happened needs a store that could have recorded it (LAB-TR-0034; see also LAB-0005 on what settings leave behind).

For a survivor, the practical point is order. Ask for the evidence to be collected before the phone is wiped, and ask for the person's safety plan to come first. Both can be done, and the order matters.

What this article does not claim

Sources

Every number and claim, and where it comes from. Web pages were read on 2026-11-08. Items from an earlier newspaper version of this article that could not be confirmed from a primary or reputable source were left out. LAB-TR-0034 is a Lab Technical Report available on this site (LAB-TR-0034).

Version history and corrections

Corrections log

No corrections have been published for this article. Corrections to any article are listed on Corrections, with the version they apply to.

Related