The Android advertising ID: personal data, not a technical setting
Few Android apps know their users by name. Every one of them, though, can ask to read the same thirty-six character string: the advertising identifier. GAID, AAID or AD_ID depending on which documentation names it, it is the keystone of mobile advertising, and one of the pieces of data that leave a phone most often.
An identifier built to be shared
The advertising identifier is assigned to the device by Google Play services. Its decisive property fits in one sentence: every app on the phone reads the same value. That is its purpose, letting advertising actors join what each app knows about the same person, to target, cap and attribute an install to a campaign.
The user can reset or remove it in the settings. But while it is there, every SDK that reads it sends it along with the rest: phone model, system version, IP address. A stable identifier, shared across apps and tied to a profile, is exactly what tracking calls for.
Personal data in the full sense
The GDPR lists online identifiers among what makes a person identifiable (Recital 30), and this one is designed precisely to follow the same person from app to app: the advertising identifier is personal data.
In France, reading it on the phone also falls under Article 82 of the French Data Protection Act, like any reading or writing of information on a terminal. The CNIL’s recommendation draws the consequence: short of strict necessity for the service, the gesture requires consent, and the technical authorization granted by the system does not stand in for it.
What Google has already locked down
The platform itself has tightened access. Since Android 12, a user who turns off personalization gets an identifier replaced by a string of zeros. An app targeting Android 13 or higher must declare a dedicated permission, com.google.android.gms.permission.AD_ID, in its manifest: without it, the value served is zeroed as well.
A detail that matters for publishers: this permission can land in your app without anyone on your team ever writing it. An SDK declaring it in its own manifest is enough for it to be merged into yours. In other words, what your app embeds decides what it asks for, permissions included.
For a child audience, Google Play’s Families policy goes further: the advertising identifier must not be transmitted at all. A point that meets the front the CNIL has opened on apps used by minors.
Zeros are not a blank cheque
A string of zeros in place of the identifier is a readable refusal, not a gap to fill. The temptation exists all the same: compensating the loss with another device identifier, or with a fingerprint built from the model, the language and the screen resolution. That is exactly the kind of workaround authorities sanction: the CNIL has already fined a mobile games publisher 3 million euros for reading another identifier of the terminal for advertising purposes despite a refusal expressed at system level.
The reading rule is simple: the choice expressed covers the purpose, not the technique used. Switching identifiers does not switch the refusal.
What a publisher must be able to answer
Three questions sum up the subject, and they are an inspection’s questions. Does the identifier leave before consent is given? To which actors does it go, knowing each can join it with what it collects elsewhere? And after a refusal, is the zeroed value honored, or does another identifier take over?
None of these answers can be read in documentation. They are observed in the app’s real traffic, request by request, timestamps attached. That is exactly what a mobile app audit establishes: the list of actors that receive the identifier, and the moment of each send relative to the user’s choice, data point by data point.
Sources
Every finding in this article traces back to one of these documents.
- Google PlayAdvertising IDPlay Console Help, Google
- Android 13Behavior changes: Apps targeting Android 13 or higherAndroid Developers documentation, Google
- Google PlayGoogle Play Families PoliciesPlay Console Help, Google
- CNIL ’25Recommendation on mobile applications, amended versionCNIL, deliberation no. 2025-024 of 27 March 2025
- CNIL ’22Mobile games: the CNIL fined VOODOO 3 million eurosCNIL, deliberation SAN-2022-026 of 29 December 2022
- GDPRRegulation (EU) 2016/679, Recital 30: online identifiersOfficial Journal of the European Union
Common questions
- Is the advertising identifier personal data?
- Yes. It is an online identifier tied to a device, and so to its holder, and it is built to follow the same person from app to app. The GDPR lists online identifiers among what makes a person identifiable, and in France reading it on the phone falls under Article 82 of the French Data Protection Act.
- Is consent required to read the advertising identifier?
- As soon as it serves ad tracking, yes: it is not an operation strictly necessary to the service requested. The system’s technical authorization is not consent, and the CNIL’s recommendation says so expressly.
- What does an all-zeros identifier mean?
- That the user removed their identifier in the settings, or that the app, once it targets Android 13, does not declare the AD_ID permission. The zeroed value is a readable refusal: replacing it with another identifier or a device fingerprint amounts to circumventing the choice expressed.
- How do I know who receives my app’s identifier?
- By observing real traffic: the identifier shows up in outgoing requests, with the domain that receives it and the moment it was sent. An audit records those sends actor by actor and places them relative to consent.