With our phones and computers we see the screen, the apps and the notifications. What happens underneath, when nobody is using them, usually stays invisible. There are, however, a few clues that the device records on its own and that anyone can read without special tools. One of the simplest is data usage: how many megabytes and gigabytes pass through the connection, and which app used them.
Most of the time those numbers tell an ordinary story: videos, photos saved to the cloud, updates. Sometimes, though, they tell a story that does not add up. An app you rarely open uses more than all the others, traffic grows during the night, your gigabytes run out halfway through the month even though your habits have not changed. It may be a forgotten setting, or it may be an app sending data without your knowledge.
This recommendation — R28 of the Cyber Welfare Framework — asks you to make monitoring your data usage a regular habit, the way you glance at the mileage on a car: not out of anxiety, but so that you know what your normal usage looks like and notice in good time when it starts to drift away from it.
What this recommendation says
Recommendation R28 states that the data usage of your devices should be checked regularly: know what your usual usage is, set alerts and limits, and calmly look into any spike you cannot explain.
Within this rule there are three habits:
- looking: knowing where the system shows data usage, both in total and app by app;
- comparing: having a sense of your normal usage, so that you can recognise what falls outside it;
- investigating: when you see a spike, looking for the simplest explanation first and, if there is none, digging deeper.
Two terms come up often. Mobile data is the traffic that goes through your mobile network, the allowance included in your plan and counted in gigabytes. Background data is the data an app uses when it is not open on the screen: syncing, notifications, updates, but also, in the worst cases, transfers you never agreed to.
What it is not. It is not an invitation to be suspicious of every app, nor to spend your evenings poring over statistics. And it is not a check that replaces your other defences: data usage is a clue, not a diagnosis. A spike does not prove there is a problem; the absence of spikes does not guarantee that everything is fine.
Where it applies. To smartphones and tablets, which have detailed per-app counters, and also to computers: operating systems show, in their network settings or activity monitor, how much data each program uses. It covers mobile data and, where the system allows it, traffic on your home or office Wi-Fi as well.
Why it matters
An app working behind your back almost always needs to communicate with the outside world. Whatever collects photos, messages or locations has to send them somewhere; whatever uses your phone to click on invisible adverts or to route other people’s traffic has to connect to the internet. All of this leaves a trace in the system’s counters. Malware — software designed to damage, spy on or exploit a device — can hide its own icon, but it can rarely hide the data it uses altogether.
That is why data usage is one of the few measurable signals of what is going on inside your phone. Other clues, such as sluggishness or a battery that drains faster, are vague and have a hundred possible causes. Here, instead, you have a number, a period of time and the name of an app.
Monitoring your data usage is also worthwhile for less dramatic and very practical reasons:
- costs — going over your plan’s allowance can mean extra charges or a slowed-down connection until the next renewal;
- continuity — if you work from your phone, you cannot afford to be left without a connection halfway through the month;
- privacy — many legitimate apps send more data than they need to, and seeing it helps you decide which ones to keep;
- tidiness — you discover forgotten apps that are still busy in the background.
| Benefit of monitoring data usage | Why it counts |
|---|---|
| Makes the invisible visible | Shows which app communicates, how much and when, even with the screen off |
| Gives you a point of comparison | Knowing your normal usage lets you recognise a genuine anomaly |
| Catches problems early | A spike noticed early costs less than a suspicious app discovered months later |
| Protects your budget | Alerts and limits prevent surprises on the bill and slowed-down connections |
| Lets you act in the right place | Suspicion falls on one specific app, not on the whole phone |
A concrete example
John runs a small heating and plumbing business. His phone is his office: quotes, photos of jobs, messages with customers, the map that gets him to each address. His plan has a generous amount of data and he has never given it a second thought.
One month his mobile provider sends him a message saying he has already used most of his data, and it is only the 12th. Rather than worrying, he opens his settings and looks for mobile data usage. At the top of the list is the app that backs up his photos to the cloud: since he changed phones, it has been syncing over mobile data as well as Wi-Fi. That is an ordinary explanation. John sets the backup to Wi-Fi only and the problem goes away.
From then on he gets into the habit of glancing at the list at the start of each month. Three months later he notices something different: in third place is a document-scanning app he installed once to send a form to a customer and never opened again. It has used more data than his email, almost all of it in the background. There is no reason for it to do that.
John blocks background data for that app, checks the permissions he had given it and then uninstalls it. He runs a full security scan of the phone. The following month his usage is back to normal.
He does not know for certain what that app was doing, and he does not need to: he has cut off a flow of data that had no reason to exist, and he spotted it because he knew what his normal usage looked like.
When to apply it
The check works best when it becomes a small routine, but there are moments when it is especially useful.
- Once a month. A few minutes at the start of your billing period are enough to see the list of apps and compare it with the previous month.
- When you receive a usage alert. The message from your provider or your system saying you have used most of your data is the natural moment to see who used it.
- After installing new apps. Especially free and little-known ones: in the first few weeks you can tell whether their usage matches what they actually do.
- When your phone behaves oddly. A battery that drains while idle, a device that runs warm for no reason, adverts popping up outside apps: data usage helps you work out whether a particular app is involved. The wider set of signs is covered in the recommendation on spotting the signs of malware on your phone.
- If you share your connection. When you use your phone as a hotspot, sharing its connection with other devices, usage can include traffic that is not yours: one more reason to protect your mobile hotspot password.
- After changing phone or system. On a new device, backup and sync settings often start again from their defaults.
How to apply it
You do not need extra apps: the essential tools are already in your operating system’s settings.
- Find the counter. In your phone’s settings, usually under the mobile network or connections section, there is a data usage page. It shows the total for the period and a list of apps, sorted from the one that uses the most. On a computer, look for data usage in the network settings or the activity monitor.
- Match the period to your plan. Many systems let you set the day your billing cycle starts, so that the figures on your phone line up with your provider’s.
- Observe for a month and note your normal usage. How many gigabytes you use in total, which three or four apps use the most, whether traffic clusters at certain times of day. This is your reference point.
- Set an alert and, if you like, a limit. An alert warns you when you pass a threshold, such as three quarters of your allowance; a limit switches off mobile data when you reach it.
- Look at the difference between foreground and background. Many counters separate the data used while an app is open from the data used with the screen off. High background usage by an app you never open is the thing to notice.
- When you see a spike, start with the simple explanation. Photo backups, system or app updates, high-quality video, video calls, a trip with maps running all day: in the vast majority of cases the spike has an obvious name. Which spikes really matter is covered in detail in the guide to spikes in data usage.
- If there is no explanation, restrict first and then decide. Block background data for that app, check its permissions and ask yourself whether you still need it. If you do not recognise it or do not use it, remove it. Apps you do not remember installing deserve a separate check: see how to go about finding and removing unknown apps.
- Run a full security scan. Use the protection built into your system or a trusted antivirus tool downloaded from the official app stores. If the unusual usage continues even after the app is gone, follow the guide on what to do if your phone has malware.
Common mistakes to avoid
- Looking only at the total. The overall figure tells you whether you have gone over your allowance, but not who did it. The useful information is in the per-app list.
- Panicking at the first spike. A major system update or an evening of streaming explains most jumps. Suspicion should be kept for what has no plausible cause.
- Forgetting about Wi-Fi. Many people only check mobile data. An app sending data in secret may do most of it when you are at home, where the connection costs nothing and no provider counter flags it.
- Not knowing your normal usage. Without a point of comparison, any number looks high or low at random.
- Relying on any old monitoring app. The system’s own features are enough for almost everyone. An unfamiliar monitoring app will, in turn, ask for access to a great deal of information.
- Stopping at the limit. Cutting off data protects you from costs, but it does not explain why an app is using data unusually.
How this connects to the Cyber Welfare Framework
R28 moves security from the level of rules to the level of observation: you learn to read a signal your device already offers you.
| Pillar | How this contributes |
|---|---|
| Skills | Knowing where the counters are, reading usage app by app and setting alerts and limits |
| Awareness | Understanding that a hidden app needs to communicate, and that this traffic leaves a trace |
| Secure Behaviour | Checking data usage regularly and calmly looking into any spike that has no explanation |
Digital maturity levels.
- FL1 — Basic. You do not look at your data usage, or you only notice it when your gigabytes run out. It is a common situation, not a fault.
- FL2 — Beginner. You know where to find the counter, you know which apps use the most data and you have set at least one usage alert.
- FL3 — Autonomous. You know your normal usage, you check it every month, you restrict background data and you can tell a harmless spike from a suspicious one.
- FL4 — Skilled. You also keep an eye on your computer and your home network, and you know when a spike calls for a closer look.
- FL5 — Expert-Guide. You help family members, colleagues or staff read their own usage and recognise an anomaly without alarm.
R28 is the key step from FL1 to FL2, and it becomes an increasingly precise tool at every level after that.
How to check you are applying it properly
Three questions, to be answered honestly.
- Could I say, without looking, which three apps use the most data on my phone?
- If my usage this month doubled, would I notice before my gigabytes ran out?
- Is there an app on my list that uses background data and that I do not remember opening recently?
Quick checklist
- ☐ I know where to find the data usage counter on my phone and my computer
- ☐ The counter’s period matches my plan’s billing cycle
- ☐ I have a sense of my normal monthly usage
- ☐ I have set at least one usage alert
- ☐ Backups and large updates happen on Wi-Fi only
- ☐ I have checked the background usage of the apps I rarely open
If a box stays empty, you already have your next step. If you would like a more structured measure of where you stand, you can take the digital resilience self-assessment.
In short
Data usage is one of the few concrete, measurable signals of what is happening on your devices, even when you are not using them. Reading it does not require technical skills: your system settings and a few minutes a month are enough.
The rule boils down to this: know where to look, know your normal usage, set alerts and limits, and when you see a spike, look for the simple explanation first. If there is none, restrict the app, remove it if you do not need it and run a full security scan.
This is not about watching your phone with suspicion. It is about knowing it well enough to tell when something changes.
Something to think about. If an app on your phone sent data every night, how long would it take you to notice?
Explore this recommendation
This recommendation is the pivot of a content unit. Each post looks at a different aspect.
- Impact of hidden data traffic — what gets hit, in terms of the confidentiality, integrity and availability of your data and your device
- Consequences of unusual data usage — the concrete effects on the operational, financial, legal, reputational and personal levels
- How to limit background data — the mitigations, from prevention to recovery
- Spikes in data usage — the indicators to check and what they mean
- Tools for checking data usage — the features of your system, your router and your provider, with their advantages and limits
- Data exfiltration from phones — the ways a hidden app takes information out and uses your connection
Related resources
Short reads from the Resources section, for anyone who wants to focus on a single aspect:
- Unexpected Phone Charges: When the Bill Is the Signal
- Phone Running Slow: Malware, or Just an Older Device?
- Home Network Attack Surface: Counting What Is Connected
Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.
