TrackerControl Android: monitor and control trackers and ads.
TrackerControl Android: monitor and control trackers and ads.
TrackerControl is an Android app that monitors and controls the widespread, hidden data collection in mobile apps about user behaviour ('tracking'). It uses Android's VPN functionality to analyse network traffic locally on the device — no root, no external VPN server by default, and no personal data leaves the device. TrackerControl also protects against DNS cloaking, a popular technique used to hide trackers, and offers optional Secure DNS (DNS-over-HTTPS) and remote VPN routing through providers like Mullvad and IVPN, for users who want to hide their traffic from their internet provider as well.
To detect tracking, TrackerControl combines the Disconnect blocklist (used by Firefox), the DuckDuckGo Tracker Radar for mobile apps, and an in-house blocklist created from analysing ~2 000 000 apps. Custom blocklists are supported, and tracker libraries inside app code are detected using signatures from ClassyShark3xodus / Exodus Privacy. The app also aims to educate about your rights under data-protection law, such as the EU GDPR.
This approach reveals the companies behind tracking, allows selective blocking, and exposes the purposes of tracking (analytics, advertising, etc.).
A feature-reduced iOS version (tracker analysis only, no blocking) is in the making — see ios.trackercontrol.org.
If you have missing features or bugs, join the community, use the issue tracker, or contact Konrad directly ([email protected]).
TrackerControl provides:
Unlike similar solutions, TrackerControl does not intercept SSL connections, minimising privacy risks and allowing usage on unrooted devices. Only metadata about network communications is logged and shown to the user.
Disclaimer: Use of this app is at your own risk. No app can offer 100% protection against tracking, and analysis results shown within the app may be inaccurate.
Two distributions exist:
| Feature | Play Store (Slim) | F-Droid / GitHub (Full) |
|---|---|---|
| Tracker Analysis | ✅ | ✅ |
| Traffic Log | ✅ | ✅ |
| Tracker & Ad Blocking | ✅ (Minimal mode) | ✅ (All modes) |
| Secure DNS (DoH) | ✅ | ✅ |
| Remote VPN routing | ✅ | ✅ |
The full version offers three Blocking Modes (the mode can be changed in Settings):
| Minimal | Standard | Strict | |
|---|---|---|---|
| Tracker lists | DuckDuckGo only | All (X-Ray, Disconnect, DDG) | All |
| Essential services | Allowed | Allowed | Blocked |
| Ambiguous shared IPs | Allowed | Allowed | Blocked |
| Granular per-tracker control | No | Yes | Yes |
| Auto-exclude known incompatible apps from VPN | Yes | No | No |
| Default for new installs | Yes | No | No |
Content category to reduce breakage.Content category and ambiguous mixed shared-IP cases where a tracker hostname and a non-tracker hostname resolve to the same IP.TrackerControl combines two analysis techniques: network traffic analysis and tracker library analysis.
Mobile trackers send personal data over the internet, so tracking can be detected from network traffic. This is TrackerControl's core functionality. The advantage over library analysis is that actual evidence of data sharing is gathered — libraries present in app code may never be activated at runtime.
TrackerControl analyses traffic locally using DNS-based detection. TLS Server Name Indication (SNI) extraction is disabled by default because it requires connecting to tracker servers, which would leak the user's IP address. SNI is enabled only when Research mode is turned on, for measurement purposes. The SNI itself is read locally, from the same traffic TrackerControl already inspects — no separate connection is made to read it — so if remote routing (WireGuard) is also enabled, the connection to the tracker goes out through the VPN tunnel and the tracker sees the VPN provider's IP rather than the device's real IP.
Follow the in-app steps to enable the VPN, then interact with the apps you want to inspect (apps must actually run to share data with tracking companies). Results can be exported via the menu ("Export as CSV"); exporting from the main screen produces data compatible with the visualisation tools by Hestia Labs.
Direct logging of contacted domains to the console can be enabled via the “Research” mode. This is helpful for research studies that instrument apps using an additional computer. Note that this disables blocking.
Analysis of system apps is disabled by default, since it can lead to unexpected behaviour and is intended for experienced users. Enable it via Settings → Advanced Options → Manage system apps. This is useful for inspecting Google Maps, YouTube, or Google Play Services, which other apps may piggyback on for tracking — though attributing such activity to specific apps is difficult, so a robust analysis benefits from uninstalling as many apps as possible first.
A traffic log is also available from the menu bar; if enabled, contacted tracking domains are highlighted in bold. The traffic log does not currently indicate ambiguity in contacted domains (unlike the per-app screens, which mark uncertain domains).
In addition to traffic analysis, TrackerControl can detect tracking libraries within app code. This may surface tracking that is not observed during lab testing but happens in real-world use. Just select an app of interest from the main screen.
By default, TrackerControl's built-in VPN stays on your device — it analyses and filters traffic locally and never sends your traffic to an outside server. As an optional second step, TrackerControl can also send your already-filtered traffic through a remote VPN provider, which hides your traffic from your internet provider.
The VPN tab supports three options:
| Option | What it does |
|---|---|
| Mullvad | Sets up a connection through Mullvad using just your account number, and lets you pick which country to route through. Only the account number and generated connection details are stored on your device. |
| IVPN | Sets up a connection through IVPN from your account ID, and lets you pick a country. |
| Custom (WireGuard) | Imports a configuration file from another VPN provider, your own server, or a workplace endpoint. (WireGuard is the underlying connection type these providers use.) |
When remote routing is on, TrackerControl still filters traffic locally first, then forwards what's allowed through the chosen provider. Secure DNS (DoH) automatically pauses if the provider supplies its own DNS, since DNS is then handled through the remote connection. Connection keys can be rotated from advanced settings.
Note: Android only allows one VPN at a time, so TrackerControl cannot run alongside a separate VPN app, and Android's "Private DNS" is not supported alongside TrackerControl.
In combination with F-Droid, this repository uses automated builds and follows a standard Android build pipeline.
You need:
wgbridge-rs/). The compiler, Android targets, and cargo-ndk version are pinned; install them and pre-fetch locked crates with:./scripts/setup_rust_android.shBuild from within Android Studio, or use the provided gradle wrapper — see the Android developer documentation. If you find any problems with these instructions, please file an issue.
Maintainers publishing the GitHub APK should follow the release build and local signing procedure.
TrackerControl is community-driven and welcomes contributions of all kinds — programming skills are not required.
Without programming, you can still help by:
You can also reach the main developer Konrad directly at [email protected] — every message is welcome and answered.
Missing translations are very welcome: https://crowdin.com/project/trackercontrol. If your language isn't listed, contact [email protected].
TrackerControl never sends personal data off your device, except to VPN providers like Mullvad or IVPN when this is enabled. The network communications it monitors itself qualify as personal data, but are processed only locally.
If the user consents, TrackerControl contacts the Google Play Store to retrieve information about installed apps. The app also automatically contacts GitHub to check for updates; this can be disabled in settings. Beyond what is strictly necessary for network communications (e.g. the user's IP address), no personal data is shared.
TrackerControl uses the ACRA library — an open-source, "good" tracker that could automatically send
No open issues yet, or sync has not completed.