What identifiers do apps use in lieu of AAID?

[kasnder]

We discussed in #56 that apps may use their own identifiers. This raises the question whether and how apps use alternative identifiers for user tracking, e.g. a Facebook ID.

[wesley-tan]

I will look into other settings that could be helpful to disable/point out (e.g. Location History)

[kasnder]

Maybe, we'll eventually be able to automate the Android privacy settings, e.g. with the Accessibility API.

[kasnder]

There's also the collection of diagnostics data in the Google settings.

[n-aggarwal]

In response to the phase out of the AAID, apps must surely come up with alternative. Facebook's Advanced Matching and Google's Enhanced Conversions fall into this category. What other approaches do apps use?

I imagine, for example, that some apps may use the same intent-based approach that I used in my early GPC for Android prototype, but for tracking.

[wesley-tan]

Some other indicators are:

First-party data: Apps can rely more on first-party data, which is collected directly from users within the app ecosystem, such as user preferences, app usage patterns, and in-app interactions. This data can be used for personalization and targeting while complying with privacy regulations.

• This is somewhat like the Facebook ID mechanism. Honestly not sure what we can do about this since these are permissions that users of the respective apps have to agree too. Device graph: This approach involves linking multiple devices used by the same user to create a "device graph." This can be done using various data points, such as IP addresses or login credentials. By understanding the relationship between devices, apps can track user behavior across devices without relying on AAID.
• For instance, Developer Chainfire released an app named Pry-Fi for Android. It gives your phone a pseudo-IMEI that changes regularly. (For situations in which a store tracks you by MAC address). And that’s about the only legitimate use an app would have to access the MAC address. (But not the IMEI - the phone doesn’t do anything with it - it’s the phone’s serial number and, in conjunction with the SIM card’s number, your phone gets authenticated to the cellphone network.)
• https://developer.android.com/about/versions/10/privacy/changes. Some relevant functions include
• getImei()
• getDeviceId()
• getMeid()
• [getSimSerialNumber()](https://developer.android.com/reference/android/telephony/TelephonyManager#getSimSerialNumber())
• [getSubscriberId()](https://developer.android.com/reference/android/telephony/TelephonyManager#getSubscriberId())

[n-aggarwal]

Here is a look at Instagram's ad-tracking mechanism:

https://github.com/privacy-tech-lab/gpc-android/assets/121606501/ad11f131-6c78-4fcc-a9f0-f13b06e835a3

[SebastianZimmeck]

Closing for now. Nothing more to say for now ...