Your phone's ad ID is a key. Copy it before you throw it away.

Most advice says to reset or delete your advertising ID and stop there. That interrupts tracking through the ID, but it also discards a useful search key. Many location records are filed under the ID alone, with no name attached, and California's privacy agency asks for these IDs for exactly that reason: they can match records your name cannot. Once the phone replaces the ID, you cannot read the old one back.

Keeping the old ID widens what a deletion request can reach. Losing it does not take away your right to ask for deletion; requests still work on your name, email and phone number, and section 04 covers how to recover old IDs from a broker.

An ID looks like 32 letters and numbers in five groups separated by hyphens. All zeros means it is already deleted or withheld, and there is nothing to copy.

Android shows the ID in Settings, so this takes a few minutes and needs no app. Menu names vary by maker and version; searching Settings for "ads" finds the page on most models.

The iPhone works differently. Apple never shows you the ID, and the only way to read it is an app you allow to track you, which is the permission you are trying to withhold. For most people the right move is to restrict tracking now and recover old IDs another way (section 04). Reading the ID on the phone is an advanced, optional step.

Restrict tracking: three separate things

Apple's controls do three different jobs, and the master switch alone does not do all of them.

Advanced: reading the ID offline

Use this only if the switch is on now and you want the current ID for deletion requests. We have not validated a viewer app on current iOS, so the method below is built to limit what any viewer could do with the ID.

If you already reset or deleted the ID, or never could read it, the brokers that collected it may still have it, and you can ask them. Large marketing data companies link device IDs to people as part of their business. Acxiom's U.S. privacy notice lists mobile advertising IDs among the identifiers it collects, and in ObscureIQ's experience its access reports usually include them. Acxiom accepts access requests from consumers in every state, not only California.

A device can leave more than one advertising trail. Each reset starts a new trail without removing records tied to the old one, so a phone used for years may have carried several IDs, and you may be able to read only today's. Devices that exposed an ad ID may also have left records of their own.

If you live in California

The state's Delete Request and Opt-out Platform, DROP, sends one deletion request to every registered data broker, and it accepts advertising IDs, TV IDs and vehicle numbers alongside your name, emails and phone numbers. Identifiers are hashed, scrambled one way, when you submit them. Since 1 August 2026 brokers have had to download requests at least every 45 days, match them, delete matched information that is not exempt, and report a status. They must also keep enough hashed identifiers to check new records against your request, so data that arrives later is caught too.

Everywhere else

Send requests to specific brokers, through the request form each one publishes, rather than spreading your IDs widely. Start with the companies an access report names or those known for location data, check that the form belongs to the company, give only what the request needs, and keep a record of each request and answer. How brokers respond depends on your state's law and on the broker.

What it is

An identifier for advertising, set by the phone's operating system and stored on the device. Apple calls it the IDFA; Android calls it the advertising ID (AAID or GAID). It carries no name. What makes it valuable is that every app reads the same value, so separate records about one phone can be joined.

How it leaves the phone

Apps send it out in ad requests and through the analytics and advertising software built into them. When an ad slot is auctioned, the request, often with the ID and location, goes to many bidders at once. That auction is called real-time bidding.

What the record shows

The FTC's December 2024 cases show where that data goes. It alleged that Mobilewalla collected more than 500 million advertising IDs paired with precise location between 2018 and 2020, partly by keeping data from ad auctions it did not even win, and sold it on; the order was the FTC's first ban on collecting consumer data from those auctions. In the same week it alleged that Gravy Analytics and its subsidiary Venntel sold precise location data that was not anonymized, delivered daily or weekly, with customers able to search at least three years of history, to commercial and government clients. Data gathered to show an ad ended up as a searchable archive of where devices had been.

How it gets a name

Companies that link device numbers to people join the ID to emails, logins and households where they can. Where they cannot, the location record stays filed under the ID alone, which is why the ID can find records your name cannot.

How it can aim at you

The same system that lets an advertiser reach one device lets someone select one. Researchers at Citizen Lab and Confiant have documented ad delivery used to reach targets' phones with spyware, which turns a marketing number into a way to pick out a person.

How we got here

Apple introduced its ad ID in 2012 to replace a permanent device number, and Android followed in 2013; both were open to every app by default. In 2021 Apple began requiring apps to ask before reading it and retired the separate reset setting. Android added a way to delete it from late 2021. Google once planned to replace Android's ID with a different system, but retired the main parts of that plan in October 2025, so the ID is still in use.

Switching off the ad ID removes one widely used key to bulk location sales. Location collection, account-linked tracking and fingerprinting continue without it.

• Location permissions matter as much. An app allowed to use location still collects it. Set apps to Never or While Using, and turn off precise location where an area will do. Field Guide 05 covers the rest of location safety.
• Other identifiers still link you. IP addresses, account logins, scrambled email addresses and device fingerprints connect activity without the ad ID. Google notes that deleting the Android ID does not stop apps' own settings and data from shaping ads.
• Your browser is a separate problem. Websites cannot read your phone's ad ID. Ads in a browser expose your approximate location through your IP address and track you with cookies instead.
• Deletion is uneven. Some brokers will find and delete records by ID; others will not, and copies already passed on may not be recoverable.

For one person this is a ten-minute job. For a household with staff, old devices and a security team, it is a small program, and it works best when whoever keeps the household's device list owns it, because each phone and each reset adds an ID to track down.

You

• Copy each Android phone's ID before deleting it. On iPhone, reading it is optional and only offline.
• On iPhone, switch tracking off and revoke every app you allowed earlier.
• If you live in California, add every retired ID to your DROP request.
• Keep the list of IDs, and whose devices they were, out of email and shared documents.

A family office

• Inventory the household's phones, tablets and TVs, spares in drawers included, and record each ID before a device is wiped, sold or recycled.
• For staff-owned phones, offer the steps and explain why; do not collect the IDs or turn it into monitoring of personal devices.
• Keep a dated, access-restricted log of retired IDs beside the device inventory, and recheck the settings after every new phone or major update.

A security or legal team

• Send direct deletion requests to location brokers with retired IDs only, and log every status.
• Request access before deletion at large brokers such as Acxiom to recover linked device IDs, and treat what comes back as leads.
• Pair this with the wider device settings in Command Brief CB-075, since the ad ID is one key of several. This guide is analysis, not legal advice.

The best case against copying it

There are three serious objections. A written list of a household's IDs is a ready-made lookup key; if it leaks, someone can buy the history it points to. Deletion requests are uneven, and DROP works without the ID, so the effort may buy little. And on iPhone, reading the ID means granting tracking to a stranger's app, the exact thing the owner wants to avoid.

The answer

The list risk is real, which is why the association between IDs and people stays out of email and shared files. The brokers already hold every ID on it; the only new thing is the pairing with a name, and that pairing sits in the owner's own records. Deletion reaches some brokers and not others, but for location files that carry no name, the ID is the only reach there is, and DROP's ongoing checks cover records that arrive later. The iPhone objection is why reading the ID there is optional: restriction plus a broker access request reaches old IDs without granting anything.

How sure we are