01
Nov
unnamed
Last Updated: November 3rd, 2013

Advertising revenue is a huge part of doing business in the mobile apps space for a large number of developers. As such, from that practice have emerged methods to send advertisers information about you to better serve appropriate ads. Oftentimes, the way your advertising "profile" is specifically identified is less than ideal from a security standpoint. Many apps use your phone's IMEI - a potentially personally-identifying number - as your advertising identification number because every modern smartphone has one.

Another common practice that has emerged in mobile advertising is a lack of opt-out capabilities for such systems. This means users are often left with the choice of either accepting that some form of hopefully non-identifying personal information is being transmitted to an advertiser, or simply choosing not to use a particular app.

Screenshot_2013-11-03-01-00-21

Google wants to fix these problems, and as such, yesterday it announced the Advertising ID, part of the new Google Play Services 4.0. The advertising ID is a standard UUID code (Apple uses them in iOS) - a unique, software generated identifier - that will be associated with your Android device and Google account (presumably, one UUID per device on your account). In order to gain access to your advertising ID, apps will need to interface with Google Play Services, which will then initiate a check against your Google account to see if you have personalized ads disabled. If you do, the app will not be granted access to your ID, and no personalized ad information can then be associated with it.

Google also allows you to reset this identifier at any time in the Google Settings app, at which point a new UUID is generated. Apps are forbidden from linking the info from your old ID to the new one. Apps are also not allowed to tie your advertising ID to any persistent device identifier (IMEI, ESN, SSAID, MAC address, etc.) to skirt around the requirements for honoring resets and opt-outs. Google expects all developers to comply with this new policy by August 2014, 9 months from now. If they don't, they'll be in violation of the Google Play Developer Content Policy, and their apps subject to removal from the Play Store. Just how vigorous enforcement of the advertising ID will be, though, remains to be seen.

If you want to read more about the advertising ID from a technical perspective, check out this page on Android Developers.

David Ruddock
David's phone is whatever is currently sitting on his desk. He is an avid writer, and enjoys playing devil's advocate in editorials, and reviewing the latest phones and gadgets. He also doesn't usually write such boring sentences.

  • naysayer

    Sounds good!

  • zhuowei

    So how would this work on Android forks such as Amazon's Fire OS, which doesn't have any Play services APK?

    • http://www.androidpolice.com/ David Ruddock

      It won't. That's all there is to that.

      • Tony

        That's going to be a slight pain for developers (mostly the Ad Networks' developers) because then they're going to have to check for the existence of this new Advertising ID, and if it doesn't exist they will have to fallback onto whatever ID they were using before. If it comes down to having to make several APKs for each app store just to accommodate this, then that's going to be an even bigger pain.

    • Danny Holyoake

      This involves Google Play. Amazon doesn't involve Google Play. This changes nothing for Amazon's OS.

  • Primalxconvoy

    Would it be possible to create an app that can automatically reset your data periodically in the background (with your permission), this creating a new id to "foil" this new system?

    • GryphKid44

      Couldn't you just disable personalized ads to get the same result?

    • Tony

      If by "reset your data" you mean reset this new Advertising ID, then no. At least not officially, because the docs specifically mention there is no API to perform this reset (you can only request to read the ID). Only the user can reset the ID by going through the Google Settings app.

    • Guest

      You can reset your id within the app...

  • Tony

    @rdr0b11:disqus Where can I find the announcement of this deadline?

    This sounds more like something the Ad Networks' developers will have to worry about. I've used a lot of third party Ad Network SDKs and I've never had to provide a device ID (whether it be the IMEI, ANDROID_ID, or any other UUID) manually. Usually their SDK will grab the IMEI (if they use it) on its own as long as you have the required READ_PHONE_STATE permission.

    That said I hope the many Ad Networks out there update their SDKs so we devs don't get dinged for their code (since it'd be hard to tell if they're accessing the IMEI without looking at their source code"). On the same note, I wonder as well how Google will be able to tell which apps are violating there new terms without the source code or reverse engineering the APK.

    • Jsilvermist

      My guess would be to run it on an emulator with a packet monitor and see what it reports to the ad server,
      Easiest thing that comes to mind at least.

  • raindeer

    Many shenzen phones have forged IMEIs. So is this an attempt tot protect USERS or is it to get more data? Thouh maybe if the IMEI is forged it is also likely there are no Google services on The phone

  • Razr HD
  • CharlesTF

    Still doesn't explain why the app icon is gray on my phone and on the two other phones I installed the same apk.
    PS: I didn't sideload the apk, I got it from the staged rollout.

  • Bruno Correia

    Hello!

    I have a app/game that uses AdMob for advertising.
    Am I forced to implement the Advertising Id, in order to comply with this new policy?

    Thanks!

    • Kevin

      Most likely the SDK developer will update their SDK and once you integrate new ads SDK you should be good to go.