GrapheneOS and Recent News around Advertiser IDs

There has been some recent discussion in the news regarding Advertiser ID tracking.

https://krebsonsecurity.com/2024/10/the-global-surveillance-free-for-all-in-mobile-ad-data
https://www.texasobserver.org/texas-dps-surveillance-tangle-cobwebs

The basic idea presented in these articles is that companies are exploiting information related to a devices Advertiser ID to locate and identify individuals. This service is being sold to Law Enforcement entities. The process is more nuanced than this, but please refer to the articles if needed.

I have communicated with individuals who have access to tools like the ones mentioned in these articles and the basic summary of those conversations is that the ability is possible, but is very dependent upon a users settings. A traditional iOS or traditional Android user who allow excessive permissions to everything on their phone would be more at risk of being 'exposed' using this technology as compared to someone with more strict settings.

GrapheneOS & Google Play Services:

The FAQ section clearly discusses Non-Hardware identifiers, including Advertiser IDs

https://grapheneos.org/faq#non-hardware-identifiers

The advertising ID is a Google Play services feature not included in the baseline Android API, so it isn't an API included in GrapheneOS. The advertising ID is unique to each profile. It isn't unique to each app signing key like ANDROID_ID, but that makes little difference since apps within the same profile can communicate with each other with mutual consent. It's comparable to ANDROID_ID but provides an 128-bit value so it provides a strong cryptographic guarantee against collisions, although a device messing with apps could set it to the same value used in another profile. The advertising ID is exposed via the Settings app and can be reset to a new random value, unlike ANDROID_ID which remains the same for the lifetime of the profile, but apps can tie it to the previous ID since they can detect that it changed via their own ID in their app data. The advertising ID can also now be disabled (zeroed).

Using the search tool, these two previous discussions involve Advertiser IDs, but don't seem to end in a conclusion on the topic.

https://discuss.grapheneos.org/d/1997-automatically-delete-advertiser-id
https://discuss.grapheneos.org/d/566-cellular-carrier-discussion-thread/31

Finally, my questions assuming a GrapheneOS user installs Google Play Services in the manner suggested by GOS are below.

1) Given the sandboxed nature of GrapheneOS, what information could be derived being related to a GOS phone's Google Play Service's Advertiser ID?

2) Current user controlled settings allow a GOS profile to 'reset' the GPS Advertiser ID, but I do not see an option to disable it, or zero out the ID. Is this still an option?

Settings > Apps > Google Play Services > All Services > Ad Safety > Ads > Get new advertising ID

Thanks

ryrona

ads Given the sandboxed nature of GrapheneOS, what information could be derived being related to a GOS phone's Google Play Service's Advertiser ID?

I am uncertain what you are asking. But since Advertiser ID is a feature of Google Play Services, any app that talks to Google Play Services can obtain that same ID and associate more information to it.

Visiting websites using Vanadium should be safe even if Google Play Services is installed in the same profile. That will not leak your Advertiser ID. Only apps can obtain it.

ads Current user controlled settings allow a GOS profile to 'reset' the GPS Advertiser ID, but I do not see an option to disable it, or zero out the ID. Is this still an option?

This feature is provided by Google Play Services, so it is up to them to decide in what ways you can control the ID. There is nothing GrapheneOS can reasonably do about that, other than not including Google Play Services by default.

Upstate1618

ads
If you see Get new advertising ID , it means you do NOT have an advertiser ID now.
So the answer for Q1 is there's no info can be tied to it cause you don't even have one.
If you have an advertiser ID, then every app who communicate with Google Play could know it. They can sell your data along with the related ID to third party. For example,
App A knows your location;
App B knows your email;
App C knows your name;
A, B and C sell the info to a third party D. Then D can relate these info because they all have the same ID.

SovereignCopper

This might be more hacky than I anticipate, but could the GOS compatibility layer perhaps enforce a single Advertiser ID for all GOS devices?

@ryrona Thank you for the responses!

I am uncertain what you are asking.

I will rephrase Q1 so everyone following along can have clarity, but generally speaking you did answer it.

Q1 Rephrased) If a user installed GOS on a device and followed the instructions provided by GOS to install Google Play Services, what information could be obtained by Google or whomever is collecting information related to Advertiser IDs? The Advertiser ID seems to be included with Google Play Services.

Answer 1:

But since Advertiser ID is a feature of Google Play Services, any app that talks to Google Play Services can obtain that same ID and associate more information to it.

Answer 1 Follow Up:

It was my understanding that GOS provides a sandboxed version of Google Play Services.

Perhaps I am misunderstanding the concept, but GOS has a "compatibility layer" which assist in the functionality of GPS. Does this compatibility layer provide artificial information to to be associated with the included Advertiser ID which is a part of GPS? Or is it 'real' information generated by a users activities on the device?

https://grapheneos.org/usage#sandboxed-google-play

GrapheneOS has a compatibility layer providing the option to install and use the official releases of Google Play in the standard app sandbox. Google Play receives absolutely no special access or privileges on GrapheneOS as opposed to bypassing the app sandbox and receiving a massive amount of highly privileged access. Instead, the compatibility layer teaches it how to work within the full app sandbox. It also isn't used as a backend for the OS services as it would be elsewhere since GrapheneOS doesn't use Google Play even when it's installed.

Answer 2:

This feature is provided by Google Play Services, so it is up to them to decide in what ways you can control the ID. There is nothing GrapheneOS can reasonably do about that, other than not including Google Play Services by default.

Answer 2 Follow Up:

Since this appears to be something inherent to GPS not GOS, is there anyway to feed the ID useless information?

Thanks

ryrona

ads I don't know the answer to either of your follow-up questions, so I let someone more knowledgable about how Google Play Services and the GrapheneOs integration with it works answer instead.

Roadwork

It is possible to delete the device advertising ID on Android.

Pixel with factory Android 15 Firmware - Settings > Security and privacy > Privacy controls > Ads > Delete advertising ID

GrapheneOS Firmware - Have a look under Settings > Apps > Sandboxed Google Play

@ryrona - Thank you for your help. Hopefully someone with a better understanding can chime in. The ability to potentially identify the physical location of people in real time is concerning. Especially those who have taken steps like installing a more secure Mobile OS specifically to avoid concerns like this.

@Roadwork - Good suggestion, but perhaps you can provide some more clarity as to specifically where?

GrapheneOS Firmware - Have a look under Settings > Apps > Sandboxed Google Play

The only option to 'delete' anything is under Storage & Cache. We can navigate to this location (down below), but this only allows us to 'reset' (get new) Advertising ID. Not delete or zero out. Based on GOS's own documentation apps can still link the old ID with the new.

but apps can tie it to the previous ID since they can detect that it changed via their own ID in their app data.

Settings > Apps > Google Play Services > All Services > Ad Safety > Ads > Get new advertising ID

Probably9857

ads The ability to potentially identify the physical location of people in real time is concerning. Especially those who have taken steps like installing a more secure Mobile OS specifically to avoid concerns like this.

Advertising ID has nothing to do with real-time location. You would have to explicitly grant Location permission to Google Play Services, or to one or more apps that share your location with Google.

So if you are concerned about Google knowing your real-time location, just don't do those things, and you'll be fine.

@Probably9857 - The concern raised in the 2 articles linked in my OP is that companies are exploiting Advertiser ID information to locate people. I have communicated with people who use these tools and it's not sci-fi or conspiracy theory, it's actually possible. The specifics of 'how' are not entirely clear to me, which is partially why I am investigating this matter here. GOS provides mobile phone users the most control of their device and if the problem exist for us, then I feel that should at least be discussed in depth as other concerns here are.

However to your point, YES not allowing anything (GPS or any app) access to location services would be ideal. However many who adopt GOS do so because they want to use main stream apps in a safer way. You and I might use Uber (just an example) via web browser but the vast majority of users would use Uber via app and allow Uber access to their location, because that makes sense for that type of app. Many mainstream apps require GPS to function, which then requires an Advertiser ID be associated. Which would then attach a physical location to an Advertiser ID (in theory). Quite the pickle.

There are more nuances ways in which a persons location could be determined by utilizing Wifi APs but the ultimate point remains, Advertiser ID tracking is a real 'threat' for some.

Personally I believe that DNS filtering using a custom DNS with block list is a better approach as you can block an apps attempts to communicate with the entity collecting analytical info from an apps usage. Think something like app-measurement[.]com. However that is a messy solution and things can be missed.

Long rebuttal aside, my goal with this post is to better understand...

What information can actually be collected by an Advertiser ID from a GOS user with GPS installed
Is there anything from an Operating System level that can currently be done to distort or block an Advertiser ID since it is included by default by GPS

I appreciate everyone indulging this conversation.

Probably9857

ads What information can actually be collected by an Advertiser ID from a GOS user with GPS installed

Simple: whatever information the user allows Google Play Services or collaborating apps to access.

At worst it could be nearly everything. The default is nothing, because it's not installed.

Even if it is installed, only the sensor permission is granted by default, and can easily be revoked. Everything else is entirely up to the user to explicitly enable.

If avoiding tracking is important, then it behooves the user to carefully consider what apps they use, and what data they allow those apps to access.

It's unrealistic to expect to use privacy-invasive services without those services tracking, and potentially sharing your activity.

@Upstate1618 that actually makes sense, and would explain the behavior as to why traditional Android users (With linked Google acct) have different options.

Thanks for chiming in