Hashing phone numbers is better than plaintext, but you're right—it's still a fingerprint, especially paired with IP/UA. Reminds me of an article I read about Russia evacuating Bushehr; sometimes the "metadata" (like movement patterns) tells you more than the content.