Apps and devices
Why it matters Much tracking now happens outside the browser, in phone apps and smart TVs. Your browser's protections do not reach there, but a few settings on your phone and TV do.
The device's own badge
On the web, trackers had to invent IDs with cookies. Phones were built with one ready-made: a single advertising ID that every app can ask for. It is like a badge stitched into your coat that every shop can read.
Mobile advertising ID: a random ID your phone gives apps for advertising. On iPhone it is called the IDFA; on Android, the advertising ID. Because every app sees the same one, it links your activity across apps.
What the phone makers changed (checked October 2026)
- iPhone: since 2021, App Tracking Transparency requires an app to ask "Allow this app to track your activity?" before it can use the IDFA for tracking. If you say no, the app gets an ID of all zeros. Apple's rules also forbid apps from fingerprinting the device instead.
- Android: you can reset the advertising ID, and on Android 12 and later delete it. After deleting, apps that ask for it receive a string of zeros.
SDKs: companies inside the app
SDK (software development kit): ready-made code from another company that an app developer adds to their app, for ads, analytics, crash reports or sign-in. It is the app version of a third-party script.
You installed a weather app from one company, but it may contain SDKs from several others. Each SDK runs with the app's permissions. If you allowed the app your location, its SDKs may be able to read it too. This is why an app's privacy label in the app store can list data types you would not expect for a weather app.
Some SDKs try to build a device fingerprint when the advertising ID is zeroed out. It breaks the platform's rules, but it is one reason permissions matter: an app can only share what it can read.
Smart TVs that recognise the screen
ACR (automatic content recognition): a TV feature that takes small samples of what is on screen or playing, and matches them against a database to work out what you are watching.
Because it looks at the picture itself, ACR can recognise shows from any source: a streaming app, live TV, or a device plugged into an HDMI port. That viewing history can be used for advertising. Most TVs let you switch it off in the privacy or "viewing information" settings, but the name differs by brand and is often buried.
Try it On iPhone, open Settings, then Privacy & Security, then Tracking, and check which apps are allowed. On Android, look in Settings for Privacy, then Ads (the path varies by phone maker), where you can delete the advertising ID (checked October 2026). On your TV, search its settings for "viewing", "ACR" or "interactivity".
A common misconception
"My browser blocks trackers, so I am covered." Browser protections stop at the browser. Apps and TVs are separate programs with their own rules, so they need their own settings.
Recap
- Phones offer apps a shared advertising ID that links activity across apps.
- iPhone apps must ask before tracking; Android 12 and later lets you delete the ID (checked October 2026).
- SDKs inside apps share the app's permissions, so be careful which permissions you grant.
- Smart TVs can recognise what is on screen (ACR); switch it off in the TV's settings.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.