Most people tap "I agree" when setting up a new phone or app without reading what they're actually agreeing to. Here's what is quietly collecting in the background, and what can actually be done with it.
Location: If you're signed into a Google account, your location history is probably being recorded. Not just GPS coordinates either. Google Maps builds a full Timeline of where you went, how long you stayed, and the routes you took. You can see everything stored at myactivity.google.com. Your daily activity: Android can detect steps, driving, walking patterns, and commute habits even if you never opened a fitness app. Over time this builds a behavioral profile of your routines. You can check which apps have access to this under Settings > Privacy > Permission Manager.
Your ad profile: Google categorizes you into interest groups based on your searches, YouTube history, and location. Advertisers then bid to reach those groups in real time. Your data gets shared across that bidding process, and Google has limited control over what happens to it after it leaves their systems. You can see how Google has labeled you at adssettings.google.com. ***What are they actually allowed to do with all of this?***
Quite a lot. The US has no single privacy law covering this. Google says it does not sell your personal data, and technically that's true. But your data does flow through advertising systems where it gets shared with third parties in ways that are perfectly legal. Google participates in real-time bidding, where your data is shared with every advertiser who joins an auction, not just the winner. Some of those participants are data brokers who collect what they receive and sell it on.
In most of the US, companies can legally collect and share your behavioral data as long as it's disclosed somewhere in their terms. None of this is hidden. It's in your settings and their terms of service. The problem is most people never look.