Researchers say Xiaomi phones are tracking usage habits and browsing data even in incognito mode
“It's a backdoor with phone functionality,” quips Gabi Cirlig about his new Xiaomi phone. He's only half-joking. — Cirlig is speaking with Forbes after discovering that his Redmi Note 8 smartphone …
Context & Ripple Effects
Security researcher Gabi Cirlig found his Redmi Note 8 phoning home with usage habits and browsing data even in incognito mode, prompting Forbes to frame the device as 'a backdoor with phone functionality.' The finding lands on top of an established pattern: a year earlier, sources told Reuters that [[a:945174|Xiaomi scanned phones for lifestyle changes like divorce or promotion to feed credit scores]] in Indonesia ahead of its lending push.
The disclosure also fits a broader corpus arc in which incognito mode keeps failing as a privacy boundary — from Alibaba's UC Browser sending every visited URL to servers, to WeChat's Mini Program tracking, to the later-documented Meta and Yandex technique for recovering browsing histories from Android browsers.
First-order effects
- Redmi and Xiaomi phone owners face immediate exposure of private browsing behavior, and Xiaomi must answer publicly — which it does within a day by claiming the data is aggregated and non-identifying and that history syncs only when sync is enabled.
Second-order effects
- Xiaomi's aggregated-data defense becomes the template other vendors reach for when caught, while rival handset makers can market privacy defaults against Xiaomi in price-sensitive markets where its lending ambitions depend on exactly this behavioral data.
Third-order effects
- If the pattern holds across UC Browser, WeChat, and browser-level identifier reuse, incognito mode loses credibility as a user-facing privacy control, shifting pressure toward OS-level protections and regulator scrutiny of preinstalled software rather than app permissions.
The trend: Mobile data collection is converging on always-on behavioral telemetry that survives private-browsing modes, forcing privacy claims to move from app settings to platform architecture.