Syllabus Lesson 110 of 156 · Apps and devices
Apps and devices

Mobile identifiers in depth

Why it matters Your phone carries several different IDs, and they do not all reset together. Knowing which is which tells you what the "Ask App not to Track" button and the "Delete advertising ID" button really change, and what they leave behind.

A key ring, not one key

Think of your phone as carrying a key ring. One key opens every shop in town (the advertising ID). Some keys open only the shops of one chain (vendor IDs). Others open one shop only (an app's own install ID). And your account login works wherever you sign in. Throwing away one key does not throw away the ring.

IDWho can read itCan you reset it?Links you across apps?
Advertising ID (IDFA on iPhone, advertising ID on Android)Any app you allowYesYes, every app sees the same one
Vendor ID (IDFV on iPhone)Apps from one developerOnly by removing all their appsOnly across that developer's apps
Android IDOne app (since Android 8 it differs per app developer and per user)Factory resetNo
Install IDThe app that made it, and its SDKsReinstall the appNo, unless shared
Account ID or hashed emailWherever you sign inNoYes, across apps, devices and websites

Hashed email: your email address run through a hash function (a one-way scrambler), such as SHA-256. The same email always gives the same hash, so two companies can match you without swapping the address itself. It is still an ID for you.

App Tracking Transparency on iPhone (checked October 2026)

App Tracking Transparency (ATT): Apple's rule, since iOS 14.5 in April 2021, that an app must ask your permission before tracking you across other companies' apps and websites.

  • If you tap "Ask App not to Track", the app gets an IDFA of all zeros.
  • Apple's rules also say the app must not track you another way instead: no fingerprinting the device, no swapping hashed emails with data brokers for tracking. Saying no covers the purpose, not only the ID.
  • Since 1 May 2024, apps and the SDKs inside them must declare a reason, from Apple's approved list, for using certain system features often used for fingerprinting. Examples are the device's boot time, free disk space, file timestamps and the list of installed keyboards. These are the required-reason APIs, declared in a file called a privacy manifest.

The Android advertising ID (checked October 2026)

  • You can reset the advertising ID at any time, which gives you a fresh one.
  • On Android 12 and later you can delete it. Apps that ask for it then receive a string of zeros.
  • Apps built for Android 13 or later must also list a permission called AD_ID in their settings file, or they get zeros instead of the advertising ID.

Why some SDKs fingerprint anyway

An advertising ID of zeros is a problem for an SDK whose job is to recognise you. A device fingerprint is a workaround: combine traits like phone model, screen size, time zone, language, free disk space and boot time into something nearly unique. It breaks Apple's rules, and reviewers cannot see every SDK's behaviour from outside.

Look back at the FitFox capture from the last lesson. InstallTrack received a zeroed IDFA, but also device_model, screen and timezone, plus FitFox's own install_id. That does not prove fingerprinting; there can be innocent reasons for each trait. It is the shape worth asking about.

A common misconception

"I reset my ad ID, so I am anonymous now." The reset changes one key. Your account, your hashed email and each app's install ID carry on, and so does anything an SDK built from device traits. The reset still helps, because it breaks the one link every app shares.

Try it On iPhone, open Settings, then Privacy & Security, then Tracking. Turn off "Allow Apps to Request to Track" to say no to every app at once (checked October 2026). On Android, open Settings and look for Privacy, then Ads (the path varies by phone maker), and delete the advertising ID. While you are there, change location for any fitness or weather app to "only while using" and, where offered, "approximate".

Recap

  • Phones carry several IDs; only the advertising ID is shared by every app and easy to reset.
  • On iPhone, saying no gives an all-zero IDFA, and Apple's rules forbid tracking by other means, with required-reason APIs since May 2024 (checked October 2026).
  • On Android 12 and later you can delete the advertising ID, and apps then get zeros (checked October 2026).
  • A zeroed ID plus a pile of device traits is the shape of fingerprinting, worth questioning.

Spotted a problem in this lesson? Report it

Code · runs in your browser
Output

        

      

      
      

        Back