They can't without the given permission from the browser to do so. While they can indeed track the mouse, when they try to access mobile motion sensors (I'm considering a CAPTCHA inside a webpage being accessed through a mobile browser such as Firefox mobile or Chrome for Android), they need to use an HTML5 API that, in turn, will ask the user for permission, something like "This site wants to use sensor motion data. Allow or block?"