Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Apparently, iOS 6 introduced IDFA, "identifier for advertisers", which identifies your device so that advertisers can track you and send you ads. It appears they also introduced IDFV, "identifier for vendor".

How do IDFA and IDFV work? What exactly do they identify? Are they different for each app on your phone, or are they the same for all apps on your phone?

What are the privacy implications of IDFA and IDFV? Can they be used to track you? How do they compare to UDID and to cookies on the web, as far as the privacy impact?

Do users have any way to tell which apps are gathering this information? Also, if you set "Limit Ad Tracking" to On in settings, what happens under the covers? How does that change what information apps receive?

Background: Apple Has Quietly Started Tracking iPhone Users Again, And It's Tricky To Opt Out; Apsalar's Take on Apple's Recent Announcement; How To Get Advertisers To Stop Tracking Your iPhone.

share|improve this question

2 Answers 2

up vote 0 down vote accepted

Ars Technica has an article with an overview of IDFA and IDFV. It explains how these new mechanisms provide users with greater control over their privacy.

IDFA is a persistent identifier that is consistent across all apps, and thus allows cross-app tracking. However, users can disable IDFA by setting "Limit Ad Tracking" to On.

IDFV is a persistent identifier that is different for each app. This still allows tracking of users, but does not allow correlating your activities with one app against your activities with another app.

The comments on that article clarify that, if the user sets "Limit Ad Tracking" to On, then this sets a global flag (advertisingTrackingEnabled) that advertising code is supposed to check before reading the IDFA. Advertisers are supposed to write their code to check this global flag and not collect the IDFA if it is set (though there is no technical measure that prevents them from doing so; they are on their honor). Thus, in this sense it is vaguely akin to the "Do Not Track" flag. Technically, it would be possible for an advertiser to still collect the IDFA even if the user has set "Limit Ad Tracking" to On. We have to hope that Apple has a way to detect that and would ban the advertiser from the app store.

share|improve this answer

The IDFA (advertisingIdentifier) identifies the device but is reset when the device is erased. The IDFA is intended for use by advertising networks which need to be able to identify users across apps.

As far as privacy is concerned, the IDFA is very similar to the UDID, but does the following to mitigiate the UDID privacy issues:

  1. Unlike the UDID, the user can prevent apps from accessing the IDFA, by turning on "Limit Ad Tracking" in the device settings.
  2. The IDFA is reset when the device is erased.
  3. Access to the IDFA is probably limited only to advertising networks and not available to most app developers. This is not known as fact, but is an assumption of the developers community.

The IDFV (identifierForVendors) is unique per app vendor so it doesn't present any real risk to privacy. I would guess that the IDFV is a one-way function of the UDID (which still exists - only the API was deprecated) and the vendor ID. Incidentally I suggested that Apple do this when they originally announced the deprecation of the UDID API.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.