Passive tracking is the observation of network traffic without changing it, blocking it, or injecting new packets. By watching metadata such as timing, destination, packet size, and connection setup details, an observer can infer behavior even when the content is encrypted. This can reveal what apps are used, which sites are visited, when a device is active, and how often a service is contacted.
In cyber security, passive tracking matters because it shows how much can be learned from traffic alone. Attackers may use it on public Wi-Fi, compromised network gear, or ISP-level vantage points to profile users and build intelligence. Defenders also use passive monitoring for network defense, anomaly detection, and forensic analysis, but privacy protections like TLS, ECH, VPNs, and traffic shaping aim to reduce what passive observers can see. These controls do not stop malware or account compromise, but they can shrink the metadata available for tracking.