[derkades]

Indeed they shouldn't be able to know that without deliberately bypassing the phone's security features using vulnerabilities. Maybe confirmation bias is at play here?

[ncpa-cpl]

I guess it could be the same IPv6 address, or IPv4 + user agent matching with a third party ad categorization service.