An advertising ID is a resettable, operating-system-provided identifier that apps can read to recognize a device for advertising purposes, such as targeting, frequency capping and install attribution. The best-known examples are Apple’s Identifier for Advertisers (IDFA) on iOS and the Google Advertising ID on Android, and similar identifiers exist on smart TV and streaming platforms.
In the context of tracking, the advertising ID is the mobile counterpart of the third-party cookie: one value shared by every app on a device, which lets advertising networks connect activity across apps. Operating systems introduced it to replace permanent hardware identifiers, and they now place it behind user controls and permission prompts.
How an advertising ID works on a device
An advertising ID is generated by the operating system, not by individual apps, and is stored as a random 128-bit UUID written in a 36-character format. Any app that integrates an advertising or analytics SDK can request it through a system API, provided the platform rules and the user’s settings allow access.
Because the value is identical across all apps on the device, an advertising network embedded in many apps receives the same identifier from each of them. This allows it to build a cross-app profile, to attribute an app install to the advertisement that preceded it and to limit how often one device sees the same ad. When access is denied or the user deletes the identifier, the API returns a string of zeros instead of a usable value.
The identifier was designed to be user-resettable. Resetting it generates a new random value, which breaks the link between past and future activity, at least for parties that do not reconnect the profiles through other signals such as login data or fingerprinting.
Main platform advertising identifiers
Each platform implements the advertising ID with its own name and access rules. The table compares the two dominant mobile identifiers and a typical connected TV equivalent.
| Identifier | Platform | Default access | User controls |
|---|---|---|---|
| IDFA | iOS and iPadOS | Only after opt-in through App Tracking Transparency | Per-app permission, global tracking switch |
| Google Advertising ID | Android with Google Play services | Available unless the user deletes it | Reset or delete in privacy settings |
| Connected TV IDs | Smart TV and streaming platforms | Varies by platform | Reset and limit ad tracking settings |
Since iOS 14.5, released in 2021, apps must show the App Tracking Transparency prompt and receive permission before reading the IDFA for tracking. Without that permission, apps may still use the Identifier for Vendors (IDFV), which is shared only among apps from the same developer and therefore does not support cross-company tracking. On Android, apps targeting Android 13 or later must declare a dedicated AD_ID permission to read the Google Advertising ID, and a deleted identifier returns zeros.
Advertising ID compared with other tracking methods
The advertising ID differs from other tracking techniques in one important respect: it is an official, user-controllable identifier. The comparison below places it alongside its neighbors in the Topic.
| Technique | Environment | User can reset or refuse | Cross-context reach |
|---|---|---|---|
| Advertising ID | Mobile apps, connected TV | Yes, through system settings | All apps on one device |
| Third-party cookie | Web browsers | Yes, through browser settings | All sites embedding the domain |
| Device fingerprinting | Web and apps | Hardly, no stored value to delete | Potentially broad |
| Tracking pixel | Web pages and email | Partly, through blocking | Depends on linked identifiers |
| Hashed email | Logged-in services | Only by not sharing the address | Across devices and platforms |
Platform policies prohibit combining the advertising ID with persistent identifiers such as hardware serial numbers or MAC addresses, because that would defeat the purpose of the reset function. Fingerprinting to replace a refused advertising ID is likewise forbidden by Apple’s App Store rules and is treated by European regulators as tracking that requires consent.
Legal status and consent for advertising IDs
An advertising ID is personal data under the GDPR, because Recital 30 names online identifiers that can single out a person’s device as a means of identification. Reading it from a device also falls under Article 5(3) of the ePrivacy Directive, which requires prior consent unless the access is strictly necessary for a service the user requested.
The operating system prompt and the legal consent are not the same thing. An App Tracking Transparency approval satisfies Apple’s platform rule, but it does not automatically meet GDPR standards for informed, specific consent. Apps serving European users therefore commonly show their own consent dialog and pass the result to advertising partners through a consent framework signal.
| Purpose | Needs the cross-app identifier | Consent normally required in the EU |
|---|---|---|
| Personalized advertising | Yes | Yes |
| Install attribution | Often | Yes |
| Frequency capping | Yes | Yes |
| Fraud detection | Sometimes | Depends on necessity and scope |
| Aggregated campaign reporting | No, privacy-preserving APIs suffice | Usually not for aggregate APIs |
Practical consequences and common mistakes
Since tracking became opt-in on iOS, a large share of devices no longer provide a usable IDFA, which has shifted mobile measurement toward SKAdNetwork and AdAttributionKit on Apple platforms. These frameworks report installs in aggregated, delayed postbacks without exposing the device identifier.
- Reading the ID before consent: SDKs initialized at app launch often access the identifier before the consent dialog appears.
- Ignoring the zeroed value: treating a string of zeros as a real identifier merges thousands of devices into one profile.
- Storing IDs indefinitely: after a user reset, the old identifier must no longer be linked to the new one.
- Misreading the system prompt: platform permission and legal consent must both be obtained where applicable.
- Undeclared SDK access: privacy labels and data safety forms must reflect every SDK that reads the identifier.
A plain-language summary
An advertising ID is a random number that a phone gives to apps for advertising. Every app on the same phone sees the same number. Ad companies can therefore tell that the same phone used several apps.
Owners can reset the number or switch it off in the phone’s privacy settings. On iPhones, apps must ask before using it for tracking. In Europe, apps generally need real consent as well. Without it, the number should not be used to follow people across apps.
An example from practice
A mobile game publisher runs install campaigns across several ad networks. Its analytics SDK originally read the advertising ID immediately at app launch, before the European consent dialog appeared. A privacy review flagged that this violated the consent requirement for users in the European Union.
The team changed the start-up sequence so that advertising SDKs initialize only after the consent result is known. On iOS, the App Tracking Transparency prompt now follows a short explanation screen, and installs without permission are measured through aggregated attribution postbacks. On Android, the app handles zeroed identifiers correctly instead of grouping them into one fake device. The result is cleaner attribution data and a measurement setup that respects each user’s choice.