Is Someone Monitoring Your Phone? How to Check Safely, and What Indian Law Says

Almost every guide to this subject does two things, and both are wrong. It tells you to watch for a hot phone and a draining battery, which proves nothing in either direction. And it then tells you to find the app and delete it, which in the situation most readers are actually in is the single most dangerous instruction available. This guide puts the order the other way round, because that is what the organisations working on this subject advise.

There are two completely different problems under the word spyware, and advice written for one is useless for the other. Commercial stalkerware is bought off the internet and installed by hand, usually by a partner or family member. The Coalition Against Stalkerware notes that it requires no particular technical skill, and that on Android the person almost always needs physical access to the unlocked device. Mercenary spyware, of the kind associated with state actors, is delivered without you touching anything, costs a great deal, and is aimed at what Apple describes as a very small number of specific individuals, often journalists, activists, politicians and diplomats. Apple states plainly that the vast majority of users will never be targeted by attacks of that nature. If the person you suspect has had your phone in their hands or knows your account password, you are almost certainly in the first case, and the rest of this page is written for that.

Why the symptoms everyone lists prove nothing

The Coalition Against Stalkerware addresses this directly on its page for survivors. Unusual behaviour such as a rapidly draining battery, spikes in data usage or strange notifications may be a sign of monitoring software, it says, but it does not have to be, and some monitoring software runs without any such side effects. That single sentence covers both failure modes: symptoms without monitoring, and monitoring without symptoms.

The ordinary explanations are documented by the platform makers themselves. Apple's support page on a warm device lists first time setup, restoring from a backup, a major software update, wireless charging, processor-intensive apps and video streaming, and says these conditions are normal. Its battery page explains that a battery's capacity diminishes as it chemically ages and that performance management can cause longer app launch times, dimming and background apps reloading. Google's battery page notes that a phone drains much faster when hot, and that after a software update it is normal for the battery to drain more than usual while the phone optimises. None of those pages mentions spyware, because they are not about spyware. They are about the ordinary causes of exactly the symptoms that get attributed to it.

What the Coalition offers instead is a better signal, and it is behavioural rather than technical: the most common sign is the other person's own change in behaviour, when they know too much about your activity and there is no other explanation. They also suggest keeping a written log of what you are experiencing, which helps establish a pattern and gives you a history if you later go to the police.

The checks that actually establish something

These are settings audits, not scans. Neither platform offers a spyware scanner, which is covered further down.

On an iPhone

The one conclusive, user-runnable test on either platform is the configuration profile check. Apple's own personal safety guide explains that configuration profiles and mobile device management tools may allow access to data or location information on the device, and gives the path: Settings, then General, then VPN and Device Management. Apple's wording is unusually definite: if you do not see any profiles, then no device management profile is installed. Note Apple's own caution alongside it, that if the device belongs to a school or employer you should check with the administrator before deleting anything.

Apple's Checklist 1 adds several manual reviews that are quick and rarely mentioned anywhere else. Review the devices signed in to your Apple Account under Settings and your name, and remove any you do not recognise. Review the apps installed for anything you do not remember installing. Check whether iPhone Mirroring is set up. And check the device for an unexpected Face ID or Touch ID fingerprint, which takes seconds and which no competitor page we inspected mentions at all.

Safety Check is the Apple feature closest to this situation, at Settings, then Privacy and Security, then Safety Check. It lets you review who has access to your information including your location, stop sharing with everyone at once through Emergency Reset, review the devices connected to your Apple Account and reset app privacy permissions. It covers sharing through Apple features such as Find My location, Shared Albums, Shared Notes, Shared Passwords, Home and Health, and third party app access to things like the camera, microphone, contacts and location.

Two warnings about Safety Check matter more than the feature itself. Apple provides a Quick Exit button precisely because, in its words, individuals in abusive situations may need to rapidly hide their use of Safety Check. But Quick Exit hides your use of the settings screen, not the effect of the change. Apple nowhere states that the other party is not notified when you stop sharing, and its own documentation says that some apps or services notify you when sharing resumes. Any page telling you the other person will not notice is making a claim Apple does not support. Apple's own instruction is to plan for your safety before making changes.

On Android

Four screens matter, and three of them are not where most guides send you. Start with the full app list at Settings, then Apps, then See all apps, which is a different surface from the launcher's app drawer. Then Device admin apps, under Security, which Google describes as where you find or remove apps that can administer your phone. Then Accessibility, where a service with permission to inspect window content can read text from the screen and act on your behalf. Then Special app access, under Apps, which holds notification access and usage access.

That last point is the correction worth carrying away: accessibility services, notification access, usage access and device admin are not entries in the Permission manager. Content telling you to check Permission manager for monitoring software is pointing you at the wrong screen for the three grants that matter most.

It is also worth knowing why some apps resist removal. Android's own developer documentation states that to uninstall a device admin app, users need first to unregister the app as an administrator. That is the sourced answer to a question readers ask constantly.

Two false alarms to avoid. Android has a legitimate private space feature where apps are hidden from the app list when it is locked, and a work profile on a managed device legitimately shows apps badged with a briefcase. Neither is evidence of anything.

On scanning, Google Play Protect checks apps for harmful behaviour and may deactivate or remove them, and it analyses apps requesting sensitive permissions such as reading text messages or controlling accessibility features. Google also notes it is on by default but can be turned off, which is the practical limit: an all clear from Play Protect means little if somebody else has had administrative access to the handset. Independent testing published by the Electronic Frontier Foundation with AV-Comparatives in November 2025, across seventeen monitoring products, found detection varied widely between security products, with Play Protect among the weakest, and the Foundation's own explanation is that because it is the default on so many phones, some monitoring software ships with instructions for disabling it during installation.

Sometimes there is no app at all

This is the case that defeats every scanner and most advice. The Coalition Against Stalkerware notes that some iPhone and iPad monitoring works by taking data from backups stored in iCloud, and suggests checking whether iCloud Backup is enabled when you did not enable it yourself, under Settings, your name, then your device. It says plainly that if someone is secretly tracking your online activities, monitoring software may not be involved at all.

Look at what Apple's own remediation tools actually address and the point becomes obvious: signed in devices, trusted phone numbers, shared location, shared albums, shared passwords, calendars and notes. Those are accounts and sharing, not malware. A device scan cannot find any of it, and a factory reset does not fix it, because the access lives in the account rather than on the handset.

One thing worth switching on now

Google added an optional feature called Intrusion Logging, within Advanced Protection, which records device activity including app installations, updates and removals, network connections and when the device is locked and unlocked. The logs are end to end encrypted, stored for a rolling twelve months, and decryptable only by you, since Google states it does not know your screen lock or password. The path is Settings, then Security and privacy, then Advanced Protection.

Why it matters here: installing commercial monitoring software requires hands-on access, and this is the first platform feature that gives an ordinary user a tamper-resistant record of app installation events. The Coalition Against Stalkerware, writing on 21 October 2026, noted that although the feature was designed with more advanced spyware in mind, it also helps detect commercial stalkerware, and is especially useful where someone is supporting a survivor directly and can set up logging and then read through the activity with them.

Its limits are real and should be stated. It is prospective only and cannot detect intrusions retroactively, it requires a Google account, and it has to be enabled before anything happens. On version, Amnesty's analysis and the Android developer documentation describe it as Android 16 or later, while Google's October 2026 announcement describes the wider Advanced Protection feature set as available on Android 17 devices. If you suspect monitoring today, this answers nothing about today. It makes the same question answerable later.

Why a detector app is not the answer

On an iPhone the obstacle is architectural. Apple's platform security documentation states that all third party apps are sandboxed, that sandboxing is designed to prevent apps from gathering or modifying information stored by other apps, and that system files and resources are shielded from apps. Apple documents no mechanism by which an App Store app could inspect other apps or walk the filesystem, which is why there is no real antivirus on iOS and why an iPhone spy app detector cannot do what its name implies.

On Android the honest answer is different, and the blanket dismissal you will read elsewhere is wrong. Android's developer documentation explains that from Android 11 the list of installed apps is filtered by default, treating it as personal and sensitive user data, and that an app needs a declared queries element or the approved QUERY_ALL_PACKAGES permission to see more. A security app with that approval can enumerate installed packages and match them against known monitoring software, which is exactly how the testing above was possible. What it still cannot do is read inside another app's sandbox, or find the account-compromise cases above, because there is no app involved in those at all.

What Indian law actually covers, and who it leaves out

Two provisions of the Information Technology Act, 2000 do the work, and they are a pair. Section 43 covers a person who, without the permission of the owner or the person in charge, accesses a computer or downloads, copies or extracts data from it, and makes them liable to pay compensation. Section 66 makes the same conduct a criminal offence where it is done dishonestly or fraudulently, punishable with up to three years or a fine up to five lakh rupees or both. The difference between the civil wrong and the crime is entirely the state of mind.

Two procedural facts follow that nobody seems to publish. Under section 77B an offence punishable with three years is bailable, and section 66 carries a three year maximum, so it is cognizable but bailable: a first information report can be registered without a magistrate's order, and equally an arrest does not follow automatically. And section 78 of the same Act requires that an offence under it be investigated by a police officer not below the rank of Inspector, which is worth knowing if a constable turns you away.

Section 43 also has a compensation route most people never hear about. Under section 46 an adjudicating officer, an official not below the rank of Director to the Government of India or the equivalent in a State, decides claims up to five crore rupees, with larger claims going to a court. The one crore ceiling that older articles mention was removed by the 2009 amendment.

Where the person monitored is a woman and the person monitoring is a man, section 78 of the Bharatiya Nyaya Sanhita, 2023, in force since 1 July 2024, is directly on point. Its second limb covers a man who monitors the use by a woman of the internet, email or any other form of electronic communication. Phone monitoring software whose whole function is to capture messages, calls and browsing is monitoring the use of electronic communication in the most literal sense, with no analogy required. Note two things about that limb: unlike the first limb it needs no repetition and no prior indication of disinterest, which makes it materially easier to establish. It carries up to three years on a first conviction and up to five on a second.

Now the gap, stated plainly in both directions. The stalking offence is gender specific both ways. It can be committed only by a man, and only against a woman. A man whose phone is monitored by his wife has no remedy under it, and we could not find a gender neutral Indian stalking offence. But he is not without remedy, and the common claim that men have no protection is wrong: sections 43 and 66 of the Information Technology Act both apply to any person, and so does the interception offence under the Telecommunications Act, 2023. The accurate line is that the computer misuse offences are gender neutral and the stalking offence is not.

On parents monitoring a minor child, and employers monitoring a company device, the honest answer is that the Indian position is unsettled. Both sections 43 and 66 turn on acting without the permission of the owner or the person in charge of the device, and a parent or an employer may well be the person in charge, which if accepted would mean no contravention at all. We found no Indian judgment deciding the point either way. What is clearer is platform policy, which is not law: Google Play's own stalkerware policy permits monitoring apps only for parents monitoring children or enterprises monitoring employees, requires a persistent notification at all times while running and a unique identifying icon, and states in terms that these apps cannot be used to track anyone else, a spouse for example, even with their knowledge and permission.

The court judgments people are misreading

Indian courts have recently made it easier to use material obtained by spouses as evidence. They have not made it lawful to obtain. Confusing the two is the most consequential error available on this subject, and it is being made in both directions.

In a decision of 14 July 2025 the Supreme Court held that the spousal privilege in section 122 of the Evidence Act does not apply in proceedings between married persons, so a recording made by one spouse of their own conversation with the other is not barred, and remarked that the phone on which a conversation is recorded is no different from an eavesdropper. That case concerned a spouse recording his own conversations. It contains no holding that installing software on another person's phone is lawful and no finding on criminal liability at all.

What happened when an Indian court did face an admitted installation is more instructive. In two judgments in April 2026, the Bombay High Court at Goa recorded that a husband had loaded a named commercial monitoring app onto his wife's phone, admittedly without her consent. In the first the data had never been forensically examined and the husband was not a qualified expert, so the evidence was rejected as unreliable and the appeal dismissed. In the second the court held there was no proof of the electronic evidence and no compliance with the certificate requirements, that relying on it would be unsafe, and dismissed that appeal too. An admitted installation, twice, and the material it produced was thrown out both times.

One further absence is worth recording. A search of reported Indian judgments on 24 October 2026 found no conviction, and no reported judgment, under section 43, 66 or 66E of the Information Technology Act arising from a partner or family member installing monitoring software on another's phone. The only reported Indian judgments in which such an installation appears at all are those two matrimonial appeals. Nor could we find any Indian enforcement action against the sellers of these apps, which is part of why they remain openly purchasable here.

Where help actually exists in India

This is where most pages on this topic give you nothing at all. Of four competitor pages we inspected, not one gave an Indian reader a single helpline number.

On 181, one detail is worth more than the number itself. The Ministry of Women and Child Development's own scheme page, last updated on 23 October 2026, states that the Women Helpline is presently operational in all States and Union Territories except West Bengal. Every page we inspected lists 181 flatly as a national number. A reader in West Bengal following that advice reaches nothing.

You may also see 1091 recommended. Treat it as city or state specific rather than national: Delhi Police publishes it for women in distress, but it does not appear on the National Commission for Women's own list of helplines, so check what your own city actually publishes before relying on it. One Stop Centres, sometimes called Sakhi Centres, bring police facilitation, medical aid, legal aid and counselling together in one place and work alongside 181.

Two honest gaps. There is no Government of India helpline specifically for technology-facilitated abuse. Every number above exists for another primary purpose, and none is scoped to someone monitoring your device. And the organisations capable of forensically answering whether a phone is infected, such as Amnesty International's Security Lab and the Access Now Digital Security Helpline, restrict their mandates to journalists, activists and human rights defenders, so an ordinary person monitored by a partner generally will not qualify. Internationally the Coalition Against Stalkerware maintains information for survivors and a directory of support organisations, which is genuinely useful, but it is a directory and an information resource rather than a helpline, and it handles no cases itself.

If you decide to act

The order matters more than any individual step, and this is where the organisations working with survivors disagree sharply with most published advice.

Make a safety plan first, developed on a safer device and, where possible, with a support organisation. Preserve what exists before changing anything, because deleting monitoring software deletes the evidence you would need to report it. Attempt removal only if you believe it is safe to do so, because removal or any significant change may be noticed by the person who installed it and can increase the abuse. Expect that it may be reinstalled. On getting rid of it, the Coalition's own assessment is that the best way is a new phone, with a factory reset almost as effective. And if the access is through your accounts rather than the handset, neither a new phone nor a reset will help until the accounts are secured.

One practical note about our own work, because it bears on who can help. The forensic tool most often named in this area, Amnesty's Mobile Verification Toolkit, is licensed on a consensual use condition: the owner of the data must explicitly consent, free of coercion and fully informed. It is also documented by its own authors as a tool for technologists and investigators that is not intended for end-user self-assessment. A firm running it on someone else's phone at a client's request would be breaching that licence, and we will not do it.

What a sweep can and cannot establish

A room or vehicle sweep looks for physical devices in a space. It does not examine a phone, and the two are separate pieces of work that have to be agreed in the scope. Where a phone is the concern, the realistic route is the settings and account audit above, kept alongside a written log, rather than any instrument.

Even forensic analysis cannot tell you a device is clean. Amnesty's own documentation states that public indicators of compromise are insufficient to determine that a device is clean and that relying on them alone can miss recent traces and give a false sense of security. Anyone promising a definitive clean result for a phone is overstating what is possible. Our national guide covers how a sweep is scoped, the guide to hidden cameras covers rooms, the guide to vehicle trackers covers cars, and the guide to office indicators covers the workplace version of the same question.

Frequently asked questions