A Simple Way to Make It Harder for Mobile Ads to Track You

Credit to Author: Lily Hay Newman| Date: Sat, 21 Sep 2019 12:15:40 +0000

Beating back the scourge of online ad tracking entirely is almost impossible. But you can futz with your smartphone's "ad ID" to slow it down.

If you're not careful, most of what you do online and in mobile apps will wind up fueling targeted advertising, all that data feeding into a composite profile of your likes, dislikes, and demographic information. But increasingly, even careful web users can't avoid being swept up in the digital marketing dragnet. While it's ridiculously difficult to get a handle on all this tracking, there is a simple step you can take right now to throw a tiny wrench in those industry-wide gears.

Both Android and iOS force apps to use a special "ad ID" for tracking smartphones, which gets linked to whatever data marketers collect from you. But the benefit of having a designated ad ID is that iOS and Android both allow you to reset it or zero it out. This means that with just a few taps on either platform, you can disrupt the profiles ad networks have collected about you, and keep them from growing any more, by turning on a feature in both Android and iOS that essentially sends out a dummy ID that's all zeros. If you turn this on, you'll stop the tracking that apps were coordinating through your ad ID.

To do it on Android, go to Settings > Privacy > Advanced > Ads and toggle on Opt out of Ads Personalization. On iOS, navigate to Settings > Privacy > Advertising and toggle on Limit Ad Tracking.

If you don't want to stop ad tracking altogether—you're getting ads anyway, might as well be relevant—you can navigate to those same screens and tap Reset advertising ID on Android or Reset Advertising Identifier on iOS to cycle your ad ID and essentially force advertisers to start a new profile on you. Android actually shows you your (very long) alpha-numeric ad ID at the bottom of this screen and when you initiate a reset you can watch it change. A clean slate never hurts.

"Limit Ad Tracking is actually an even more beneficial approach than cycling ad IDs," says Will Strafach, an iOS security researcher and founder of Sudo Security Group. "Just about every tracker out there—whether it's a generic analytics tracker or a creepy constant location tracker—will grab the ad ID if it can. It's another data point that can be used to fingerprint users, so I'm sure these companies love it when Limit Ad Tracking is off."



Android's changeable ID is called "Advertising ID" and iOS's is called the "Identifier for Advertisers." Apple started requiring that advertisers use only the IDFA in 2013, and Google began mandating advertiser use of its AAID in 2014. Before this, advertisers had open season on mobile to collect permanent device identifiers like serial numbers and other permanent sequences like your Wi-Fi network's MAC address. These are obviously useful IDs for advertisers to have, but their permanence is a problem. They gave users no way of escaping tracking for as long as they were using that given device.

The creation of dedicated, changeable ad IDs still hasn't solved everything, though. While Apple and Google have increasingly limited what apps collect for advertising purposes, those other hardcoded IDs still exist, and some apps have legitimate reasons to collect them. But this access also creates temptation to keep using device numbers or other permanent attributes for ad tracking.

"Resettable IDs are not a comprehensive solution. They aim to give the user some control, but often they only offer the perception of control," says Lukasz Olejnik, an independent cybersecurity adviser and research associate at Oxford University's Center for Technology and Global Affairs. "For the system to work, apps and ad networks need to honor the agreements about only collecting ad IDs and not re-sharing them. And if the agreements aren't fully enforced, apps and ad networks may be tracking users through other means."

Though it hasn't completely solved the privacy problem, the ability to cycle your ad ID or zero it out altogether does give you a concrete step you can take to reduce the data mobile apps are collecting about you for marketing. And regulators have started to acknowledge that the ad ID itself has become a valuable commodity. Jason Kint, CEO of the digital publishing trade organization Digital Content Next (WIRED parent company Condé Nast is a member), points out that these IDs are now legally considered personal data in Europe and California. But he adds that there is still a long way to go before users have as much control as they deserve.

"Ultimately users expect to be able to tell any and all companies not to track them when they’re not intentionally choosing to interact with them," Klint says. "Industry needs to catch up to consumer expectations."

https://www.wired.com/category/security/feed/