Even with Android 6+ manual permission requirements, all an app has to do is implement some kind of gimmicky sound request (ie. Send us a recording in our app, saying ‘I want to win!’ and you will get a free T-shirt!), and it will always have that permission, even in the background. Bluetooth and audio beacon tracking are also very widespread in commercial areas.
“The 234 detected apps contain SilverPush functionality alongside their normal content. Many were developed for large companies such as McDonald’s and Krispy Kreme. At the moment, there are a limited set of countermeasures to prevent such tracking. For people using version 6.0 or higher, they can disable an app’s access to the device microphone. This is a good practice to follow in general, although it may prevent useful features such as voice-to-text from working. It’s also a good idea to limit the number of installed apps.”