A mobile advertising ID, often shortened to MAID, is a random string that a phone's operating system assigns to the device so that apps, and the advertising companies working inside them, can recognise it for targeting, frequency capping and measurement. Apple's version is the Identifier for Advertisers (IDFA). Google's is the advertising ID, usually written GAID or AAID. The identifier exists because apps, unlike web pages, share no cookie jar. Each runs in its own sandbox, and without a common value an ad network cannot tell that the person who saw an ad in a puzzle game later installed a retailer's app. Before MAIDs, the industry bridged that gap with permanent device identifiers that users could neither reset nor refuse.

How the identifier moves

Both platforms format the value as a universally unique identifier (UUID): 32 hexadecimal characters in five hyphenated groups. An app, or a software development kit (SDK) embedded in it, reads the value through an operating system call, ASIdentifierManager on iOS and AdvertisingIdClient on Android. Every app on the device receives the same string. Tracking SDKs from ad networks, mediation platforms and measurement firms collect it alongside device and event data.

The value can be reset at any time, and since Android 12 it can be deleted outright. On iOS 14.5 and later, an app must first ask permission through the App Tracking Transparency (ATT) prompt. Where a user refuses, deletes the ID or opts out of personalisation, the system hands the app a string of zeros instead. Apps targeting Android 13 must also declare the AD_ID permission in their manifest, or the advertising ID "is automatically removed and replaced with a string of zeroes", according to Android developer documentation.

In auctions, a supply-side platform (SSP) copies the value into the ifa field of the OpenRTB device object. The specification defines it as an "ID sanctioned for advertiser use in the clear (i.e., not hashed)", expected to be "derived from a call to an advertising API provided by the device's Operating System". Beside it sits lmt, the limit ad tracking flag, where 1 means "tracking must be limited per commercial guidelines". IAB Tech Lab's iOS 14 guidance added device.ext.atts, carrying the ATT status as 0 (not determined), 1 (restricted), 2 (denied) or 3 (authorised), and told sellers to set lmt to 1 unless the status is 3.

On the buy side, a demand-side platform (DSP) checks the value against audience segments, frequency counters and conversion logs. Mobile measurement partners historically matched a click to an install by finding the same identifier on both events. Advertisers also upload MAID lists as custom audiences.

Connected television (CTV) platforms issue their own equivalents, such as Roku's and Amazon Fire TV's. IAB Tech Lab's guidelines for over-the-top (OTT) platforms, released in draft on April 3, 2018 and finalised that December, require such IDs to be resettable, separate from hardware identifiers and accompanied by a limit ad tracking signal. Display & Video 360 caps frequency across apps on one television when that identifier appears in the bid request.

Early mobile advertising used whatever the device exposed. On iOS that was the unique device identifier (UDID); on Android, the Android ID, the IMEI or the MAC address. OpenRTB carried hashed versions in fields such as didsha1, dpidmd5 and macsha1, all deprecated in version 2.6.

Apple introduced the IDFA with iOS 6 in September 2012, alongside a Limit Ad Tracking switch. On March 21, 2013, it told developers that from May 1 the App Store would no longer accept new apps or updates that accessed UDIDs. Google followed on October 31, 2013, when Google Play services 4.0 added "a new, anonymous identifier for advertising purposes (to be used in place of Android ID)", with compliance expected by August 2014. Google Play policy still bars linking it to persistent identifiers without explicit consent. From iOS 10 in 2016, a device with Limit Ad Tracking switched on returned zeros.

Apple announced ATT on June 22, 2020, postponed it on September 3 and enforced it with iOS 14.5 on April 26, 2021. Apple defines tracking as linking data from an app with data from "other companies' apps, websites, or offline properties" for targeted advertising or measurement, or sharing it with data brokers. Zeros became the default; a user had to tap "Allow" to change that.

Google took a softer route. It announced on July 28, 2021 that opted-out users would receive zeros, starting with Android 12 devices in late 2021 and extending to all Play devices from April 1, 2022. Apps aimed at children may not transmit the ID at all. On February 16, 2022, Anthony Chavez, Google's vice president for Privacy Sandbox, said Android would move to solutions that "operate without cross-app identifiers, including advertising ID", with existing features supported "for at least two years". That plan did not survive. On October 17, 2025, Google retired Topics, Protected Audience, Attribution Reporting and the SDK Runtime on Android, according to its Privacy Sandbox blog. The advertising ID remains in service.

Why it matters

For most in-app advertising, the MAID is the join key. A January 2025 complaint by the Electronic Privacy Information Center and the Irish Council for Civil Liberties' Enforce unit said Google's real-time bidding system reached 91% of Android apps and 75% of iOS apps, with MAIDs among the identifiers it broadcast.

ATT showed what losing that key costs. Research by Kraft and colleagues, cited in a 2026 study by economist Reinhold Kesler, estimated that the share of trackable US users fell from 72.6% to 17.9%. Meta's chief financial officer, Dave Wehner, told investors on February 2, 2022 that the impact of iOS changes was "on the order of $10 billion" for that year, according to CNBC. Attribution on iOS moved to SKAdNetwork, which confirms an install without identifying the device. Android kept deterministic matching, so a single campaign now runs under two measurement regimes.

Consent has since edged up. Adjust, a measurement firm whose business depends on attribution, put the average ATT opt-in rate at 38% in the first quarter of 2026, up from 35% a year earlier.

Limitations and disputes

A MAID is pseudonymous, not anonymous. European law treats pseudonymised data as personal data, and American enforcers have shown how easily the label fails. In its August 2022 complaint against Kochava, the Federal Trade Commission (FTC) said a sample dataset pairing MAIDs with GPS coordinates covered 61 million unique devices and made it "possible to identify a mobile device that visited a women's reproductive health clinic and trace that mobile device to a single family residence". In December 2024 the agency said Mobilewalla had collected more than 500 million advertising identifiers paired with precise location between January 2018 and June 2020, partly from bid requests in auctions it lost. In May 2026, Israeli firms were reported to market systems linking advertising identifiers to Starlink terminals; one claimed to have deanonymised about 200,000.

ATT itself is contested on competition grounds. France's competition authority fined Apple 150 million euros in March 2025, finding that the design made users consent twice to be tracked but refuse only once. Italy's authority followed with 98.6 million euros on December 22, 2025. Germany's Bundeskartellamt found that Apple does not use the IDFA for its own advertising, seeking consent through a separate prompt that steered users towards agreeing; on August 13, 2026 it accepted commitments to redesign the ATT prompt rather than impose a fine. Andreas Mundt, its president, said the aim was "expressly not" to maximise consent. Apple has said the prompt is consistent for all developers, including itself, and cited "strong support" from consumers, privacy advocates and data protection authorities.

Restricting the ID also pushed data collection elsewhere. Among surviving apps, Kesler found, the share disclosing data linked to users rose from 10.4% to 24.1% by 2025. France's data protection regulator, CNIL, fined game publisher Voodoo 3 million euros on December 29, 2022 for reading the identifier for vendors (IDFV) for advertising after users had refused ATT.

Not the same as

Identifier for vendors and app set ID. The IDFV is shared only across one developer's apps on a device and needs no ATT permission, but it may not be combined with other data to follow users. Google's app set ID serves analytics and fraud prevention within one Play developer account and resets after 13 months without use.

Hardware identifiers. IMEI numbers, serial numbers, MAC addresses and UDIDs cannot be reset. Android 10 blocked most apps from reading IMEI and serial numbers.

App bundle ID. The bundle names the application, not the device, and carries no user information.

Cookie IDs. Browser identifiers are set per domain and need cookie syncing to cross between companies.

Recent developments

Courts and regulators are narrowing where the ID may travel. The Google real-time bidding settlement, approved on March 26, 2026, requires a user control that strips device advertising IDs from bid requests. The FTC closed its Kochava case in May 2026 with an order that counts MAIDs and IDFAs combined with location signals as precise location data. California's deletion platform for data brokers went live on January 1, 2026, yet by February 27 only 10% of requests carried a mobile advertising ID; since August 1 brokers have had to check it at least every 45 days.

Demand has not faded. OpenAI began accepting the Google Advertising ID for ChatGPT custom audiences on August 31, 2026. On September 16, Apple published a redesigned ATT prompt for Germany, France, Italy, Poland and Romania that drops the word "track" and relabels "Ask App Not to Track" as "Reject".

Timeline

  • September 2012: Apple introduces the IDFA and Limit Ad Tracking with iOS 6
  • March 21, 2013: Apple announces that from May 1 the App Store will reject apps accessing UDIDs
  • October 31, 2013: Google Play services 4.0 introduces the Android advertising ID
  • August 2014: Deadline for Android apps to use the advertising ID in place of other device identifiers for ads
  • September 2016: iOS 10 returns zeros when Limit Ad Tracking is enabled
  • April 3, 2018: IAB Tech Lab releases draft guidelines for advertising identifiers on OTT platforms
  • December 2018: IAB Tech Lab finalises the OTT identifier guidelines
  • June 22, 2020: Apple announces App Tracking Transparency
  • September 3, 2020: Apple postpones ATT enforcement
  • April 26, 2021: ATT takes effect with iOS 14.5
  • July 28, 2021: Google announces that opted-out Android users will receive zeros
  • February 2, 2022: Meta puts the 2022 impact of iOS changes at about $10 billion
  • February 16, 2022: Google announces Privacy Sandbox on Android and plans to move beyond the advertising ID
  • April 1, 2022: Zeroed advertising IDs extend to all devices supporting Google Play
  • August 2022: FTC sues Kochava over location data tied to MAIDs
  • December 29, 2022: CNIL fines Voodoo 3 million euros over advertising use of the IDFV
  • December 3, 2024: FTC acts against Mobilewalla and Gravy Analytics over location data
  • January 16, 2025: EPIC and ICCL Enforce file an FTC complaint over Google's real-time bidding data
  • March 2025: France fines Apple 150 million euros over ATT
  • October 17, 2025: Google retires Privacy Sandbox technologies on Android and Chrome
  • December 22, 2025: Italy fines Apple 98.6 million euros over ATT
  • January 1, 2026: California's data broker deletion platform goes live
  • March 26, 2026: Final approval of the Google RTB settlement requiring a control that strips device advertising IDs
  • May 2026: FTC closes the Kochava case with a consent order
  • August 13, 2026: Bundeskartellamt accepts Apple's commitments to redesign the ATT prompt
  • August 31, 2026: ChatGPT ads begin accepting the Google Advertising ID for custom audiences
  • September 16, 2026: Apple publishes a redesigned ATT prompt for five EU countries

Summary

Who. Apple and Google issue the identifiers on iOS and Android, as Roku, Amazon and other television platforms do on CTV. App developers and their SDKs read them; SSPs pass them to DSPs; measurement partners, data brokers and advertisers use them. IAB Tech Lab defines how they travel, and competition and privacy regulators in the US and Europe set the limits.

What. A mobile advertising ID is a random, user-resettable UUID that the operating system exposes to every app on a device for advertising purposes. It travels in the ifa field of OpenRTB bid requests and returns as a string of zeros when a user refuses, deletes or opts out.

When. Apple introduced the IDFA in September 2012 and Google its advertising ID in October 2013, both replacing permanent device identifiers. Apple made access opt-in with ATT on April 26, 2021; Google zeroed the ID for opted-out users from late 2021 and, in October 2025, abandoned the Android Privacy Sandbox APIs meant to replace it.

Where. It operates inside mobile apps on phones and tablets and, through platform equivalents, on connected televisions and streaming devices. It does not exist in web browsers, where cookies fill the same role.

Why. Apps share no cookies, so advertisers need a common value to target, cap frequency and attribute installs across them. The same persistence that makes it useful for advertising lets data brokers and others tie a device's movements to a person, which is why platforms, regulators and courts continue to restrict it.