Mobile devices expose unique identifiers that can be used to track users across applications without their consent.

Why is this an issue?

Mobile platforms provide access to device identifiers such as the Android ID or the iOS Identifier for Vendors. These identifiers are persistent across app sessions and can be used to track user activity across applications and devices. This rule raises an issue when code accesses such persistent device identifiers.

What is the potential impact?

Using persistent unique identifiers without user consent can lead to privacy violations. Users may be tracked across applications or devices without their knowledge, and the identifiers may be linked to personally identifiable information. Privacy violations can cause apps to be removed from app stores and can result in legal action or loss of trust from users.

How to fix it

Code examples

Instead of using a persistent device identifier, generate a random UUID. The UUID should be persisted in secure local storage (e.g. SharedPreferences, Keychain) so the same value is reused across sessions. This approach gives users control over their privacy, as the identifier is reset when the app is reinstalled.

Noncompliant code example

String uid = Settings.Secure.getString(contentResolver, Settings.Secure.ANDROID_ID); // Noncompliant
User user = new User(
    uid,
    "John",
    "Doe"
);

Compliant solution

String uid = UUID.randomUUID().toString();
User user = new User(
    uid,
    "John",
    "Doe"
);

Resources

Documentation

Standards