Is My Phone Wiretapped?

Is My Phone Wiretapped?

The person most likely to surveil your phone is someone you know. Not a federal agent in an operations room, not an intelligence analyst reviewing your metadata for patterns of interest, but a spouse, a former partner, a business associate who remembered your iCloud password from a quieter time. The question “is my phone wiretapped?” carries with it an assumption about the source of the intrusion that, in eleven of the fourteen consultations we conducted this year, proved incorrect.

The federal government can intercept your communications. Title III of the Omnibus Crime Control and Safe Streets Act of 1968 established the framework, and it remains operative. But obtaining a Title III order requires probable cause, judicial authorization, a demonstration that conventional investigative methods have failed or would prove too dangerous, and the approval of a senior Department of Justice official before the application reaches a judge. The Supreme Court, in Carpenter v. United States, extended Fourth Amendment protections to cell site location data, holding that the government’s acquisition of 12,898 location points over 127 days constituted a search. The Court recognized what practitioners had perceived for years: that the phone in your pocket is an archive of your private life, not a convenience you have volunteered to the world.

The government’s capacity for surveillance is real. Its likelihood, for the person reading this article, is low.

The Tap That Was Never a Tap

What most people describe as “wiretapping” no longer resembles a tap on a wire. The image persists from an earlier architecture of surveillance: a physical splice on a copper telephone line, a pair of headphones, a van on a residential street. That image is a relic. Modern interception bears no resemblance to it.

Commercial spyware applications can be installed on a device in under three minutes. Once present, they transmit text messages, call logs, GPS coordinates, browser history, and in certain configurations, live audio from the device’s microphone. The person who installed the application receives this information on a dashboard, formatted for convenience, updated in something close to real time. The applications cost nine dollars a month. Some cost less.

She described it as discovering that every room in her house contained a window she had not known existed, and that someone had been watching through all of them.

The Electronic Communications Privacy Act of 1986 was designed to address government interception and, to a lesser degree, private eavesdropping conducted through physical equipment. It was not designed for a world in which surveillance software is sold on the same internet it monitors.

What the Statute Constructed and What It Cannot Hold

The federal Wiretap Act prohibits the intentional interception of wire, oral, or electronic communications without the consent of at least one party. The Stored Communications Act, its companion statute, governs access to communications at rest: emails already delivered, text messages sitting in a server, voicemails stored on a carrier’s system. Together, they compose the primary federal architecture for electronic privacy.

The architecture has fractures.

The first is temporal. Federal wiretap law addresses interception during transmission. Courts have drawn a distinction between a communication in transit and a communication already stored. If someone accesses your text messages by logging into your cloud account with a password they obtained (through guesswork, through coercion, through the shared infrastructure of a family plan), the legal question shifts from the Wiretap Act to the Stored Communications Act, and the threshold for liability shifts with it. Plaintiffs must demonstrate that data was captured at the moment of transmission to invoke the Wiretap Act’s stronger protections. The distinction is a relic of the era in which Congress imagined that “transmission” and “storage” were separable events. On a modern smartphone, they are not.

The second fracture involves consent. In one-party consent jurisdictions (New York, Texas, and thirty-six others), a participant in a conversation may record it without informing the other parties. In two-party consent states (California, Florida, Illinois, Pennsylvania, among others), all participants must consent. The distinction determines whether a spouse who records a telephone call has committed a felony or exercised a right. It determines whether a private investigator’s work product is evidence or a criminal act.

State penalties vary with a severity that would surprise most people. A wiretap violation in Maryland is a felony, punishable by up to five years of imprisonment. In other jurisdictions, the same conduct constitutes a misdemeanor. Whether the court treats spousal surveillance as a privacy violation or a domestic dispute (a distinction courts continue to draw even though it possesses no legal basis) determines the trajectory of any remedy you might seek.

The third fracture runs deeper than procedure. The statutes were composed before the smartphone existed. Congress, in 1986, was legislating for a world of landlines and primitive electronic mail. The notion that a single device would function as a telephone, a camera, a GPS transmitter, a medical record, a financial ledger, and a journal of intimate correspondence did not occupy the legislative imagination. Carpenter acknowledged this gap. The Court observed that cell phones afford the government a capacity approaching “near perfect surveillance” and held that accessing historical cell site location information constitutes a Fourth Amendment search requiring a warrant. The ruling was narrow in its application. The principle animating it was not.

Whether Carpenter‘s reasoning will extend to the full range of data a smartphone generates, or whether it will remain confined to the particular facts of cell tower location tracking, is a question the lower courts are answering in contradictory fashion. In 2025, federal courts split on whether web tracking technologies (pixels, session replay scripts, analytics tags) fall within the Wiretap Act’s scope when deployed for commercial purposes. The same statutory language, applied to the same category of conduct, produced opposing results depending on the courthouse.

I have written about this before, in the context of digital evidence in family law proceedings. The law remains coherent in its purpose. It has not caught up to the thing it was written to govern.

The Person in the Next Room

Federal investigations account for a small fraction of actual phone surveillance in this country. The more common scenario involves proximity, not jurisdiction.

In divorce proceedings, spyware installed by a spouse has become routine enough that family law attorneys now inquire about it during intake. The software itself is illegal to install without the device owner’s consent in most jurisdictions. The fact that you purchased the phone does not confer authorization to monitor it. The fact that you share a household does not eliminate your spouse’s reasonable expectation of privacy. Courts have held this in case after case.

And the evidence obtained through illegal surveillance is, in most courts, inadmissible. The act of installing spyware can transform the surveilling spouse from the aggrieved party into the defendant. We have observed this reversal (in something like forty percent of the matrimonial cases we have reviewed involving digital surveillance, a proportion that has increased each year since 2021, and that shows no indication of stabilizing) operate with a swiftness that surprises the person who initiated it.

The penalties are concrete. Federal Wiretap Act violations carry up to five years of imprisonment and fines reaching $250,000. The person who installed the application to confirm an affair may discover that the confirmation costs more than the affair ever did. Most people do not call until it is too late. I understand why.

Employers occupy a narrower exception. The “ordinary course of business” doctrine permits monitoring of company devices and lines for legitimate business purposes. The exception has boundaries. Once an employer determines that a call is personal, continued monitoring may violate the statute. The reconciliation clause in most employment agreements functions the way a smoke detector functions in a building that has already been condemned: present on paper, absent in operation. The doctrine was conceived for an era of desktop telephones and switchboard extensions, not for the device on which an employee conducts the private business of an entire life.

What to Do When You Suspect

The instinct is to search for confirmation on your own. Battery drain, data spikes, a phone that stays warm when idle. These indicators appear in every article on the subject. For the most part, they are unreliable. A phone that overheats is more likely running a software update than hosting a surveillance operation. Modern spyware is designed to evade detection by the person carrying the device.

If you suspect surveillance, consult an attorney before conducting any counter-investigation. The reason is procedural. Evidence of surveillance, when it is documented through the proper channels, can form the basis of a civil action under the ECPA or a criminal complaint under state wiretap statutes. Evidence that you attempted to verify by tampering with the device may be compromised. An attorney experienced in electronic privacy law can direct the engagement of a forensic examiner, advise on evidence preservation, and identify which jurisdiction’s law applies to your situation.

The ECPA imposes a two-year statute of limitations, measured from the date on which the violation was discovered or reasonably should have been discovered. That window does not reopen.

The Larger Architecture

Every question about phone surveillance is a question about what privacy means when the device closest to your body records everything and stores it in a location you do not control. The statutes were written for an older arrangement: physical wires, bounded conversations, clean separations between what was being said and what had already been said. That arrangement describes a world that no longer exists.

The law has not abandoned its original purpose. Carpenter signaled that the judiciary perceives the stakes. But the distance between the statutory framework and the technology it governs widens each year, and the people most affected by that distance are not intelligence targets or criminal defendants. They are the person in a difficult marriage who discovers an unfamiliar application running in the background. They are the employee on a company phone who assumes, without basis, that the device is private after five o’clock.

A consultation is where this conversation begins. Not because an attorney can determine, over the phone, whether your device has been compromised. But because the question you are asking is a legal one, and the answer depends on facts that only a careful inquiry, conducted within the framework the statute provides, can establish.