The advertising ID exists to solve a problem for the ad industry. Apps run in sandboxes and cannot freely read each other's data, so advertisers needed a stable label that follows you across apps to build a profile and attribute a purchase to an ad you saw earlier. The platforms obliged with a per-device identifier: Apple calls it the IDFA, the Identifier for Advertisers, and Google calls it the GAID or AAID, the Google Advertising ID.
It is a random-looking string, resettable in theory, and shared with any app you grant access. On its own it says nothing about you. Its power comes from what gets attached to it.
How one string becomes a profile
The advertising ID is a join key. It is the common column that lets otherwise separate datasets be stitched together into one record about a person.
A weather app logs your location against your ad ID. A game logs your session times and in-app purchases against the same ID. A shopping app logs what you browsed. A data company that buys or collects these feeds can align them all on the shared identifier and produce a dossier: where you sleep, where you work, which places of worship or clinics you visit, what you buy, and when you are awake. None of the individual apps intended to build that picture. The shared key made it assemble itself.
Browser cookies are partitioned by site and increasingly blocked. The advertising ID is one identifier that spans every app on the device, is legible to the whole ad ecosystem, and is tied to a phone that travels everywhere with you. It is a more durable link than most web tracking, aimed at your most personal device.
Where it goes: real-time bidding
When an app shows you an ad, the slot is usually auctioned in the milliseconds before it loads. This is real-time bidding, and the bid request broadcast to potential advertisers commonly includes your advertising ID, your approximate location, your device details, and the app you are in. Many companies receive that request even if none of them wins the auction, which means your data is distributed widely on every single ad impression, not just to the eventual buyer.
From there it reaches location data brokers. This is not hypothetical. The US Federal Trade Commission has brought enforcement actions against data brokers over the sale of sensitive location data tied to mobile identifiers, including a 2024 settlement with the broker X-Mode and its successor Outlogic that restricted the sale of precise location data revealing visits to sensitive places. Location traces keyed to advertising IDs have also been documented flowing to government contractors. The advertising ID is the thread that makes those traces attributable to a device.
The platforms pushed back, partially
In 2021, Apple introduced App Tracking Transparency, which requires apps to ask permission before accessing the IDFA for cross-app tracking. A large share of users declined, which meaningfully cut IDFA availability. Google runs a permission model on Android and has said it will let users delete their advertising ID outright, returning a string of zeros to apps that request it.
These are real improvements, but they are partial. The prompts and toggles still put the work on you, defaults vary by device and region, and the ad industry has responded with other techniques such as fingerprinting that try to reidentify you without the official identifier. Turning off the advertising ID closes the front door. It does not board up every window.
How to turn it off
This is one of the few high-impact privacy steps that takes under two minutes and costs you nothing. The exact menu labels change between operating system versions, so treat these as a guide rather than a fixed path.
| Platform | Where to look |
|---|---|
| iPhone / iPad | Settings, then Privacy & Security, then Tracking. Turn off "Allow Apps to Request to Track" so no app can access the IDFA. Also review Apple's own ad personalization under Privacy & Security, Apple Advertising. |
| Android | Settings, then Privacy or Security & Privacy, then Ads. Choose "Delete advertising ID" where offered, or reset it and opt out of personalization. The path varies by manufacturer. |
Two habits reinforce the switch. Be sparing with location permission, since location is the most sensitive field usually attached to the ID; set apps to "while using" or "ask every time" rather than "always." And prune the apps you do not use, because every installed app is another potential collector feeding the same profile.
The bigger frame
The advertising ID is a clean example of a pattern worth recognizing across your whole digital life. The exposure is rarely one dramatic breach. It is the steady, quiet accumulation of small identifiers and permissions that individually seem harmless and collectively describe you in detail. The same logic runs through cross-device tracking and the data broker economy.
The reassuring part is that this particular link is under your control, which is not true of most tracking. You cannot easily opt out of being profiled by a data broker after the fact, but you can stop handing them the join key today. It is worth doing, and then extending the same instinct to every default that was set to share by someone other than you.