someone27281 It'd be even better if it got added to FAQ also :)
There's also a post with a lot of info here: https://discuss.grapheneos.org/d/17118-identifiers-across-private-space-and-profiles/4. As you can see, the info there was shared by a project member. The project is open about these things. Maybe the FAQ doesn't list them out like in this post, but the FAQ does say that certain global info is available to apps.
someone27281 mediaDRM
https://github.com/GrapheneOS/os-issue-tracker/issues/2314
someone27281 SIM operator name
In the FAQ. Also, I believe you can disable the SIM for that (don't know for sure, so you can check that yourself), otherwise remove the SIM.
someone27281 OS details
In the FAQ
someone27281 I guess my question would an app be able to identify 2 user profiles as being the same user based on info that is common between them
(Kind of just started writing and went on a little rant here, but I don't feel like making it shorter, so here you go... Also, want to point out that I'm NOT a GrapheneOS developer, nor am I involved in making decisions for the project, so keep that in mind. Maybe a developer or someone who actually makes development decisions would have different opinions.)
This depends on a lot of factors, but I'd like to sort of quote a thing another forum member, de0u, sometimes says: I don't expect [insert feature here] to convert privacy-invasive apps into privacy-respecting apps. (from this post specifically).
In other words, I think what you're trying to do is to install and use apps that you don't expect will respect your privacy. GrapheneOS's privacy and security features already do a lot to help protect GrapheneOS users' privacy, but GrapheneOS users cannot expect the project to add features where the OS will reliably break apps that don't respect users' privacy in certain ways to block those apps' access to certain things, all while maintaining app compatibility.
Ultimately, it's a numbers game, but consider if toggles spoof everything, then possibly both profiles have the same spoofed info, so since GrapheneOS is a well-known OS, fingerprinting services/companies could then add some logic to their fingerprinting library or service to account for that and see over time "this phone is always at 50% battery, is never charging, its charge cycles never seem to change, storage is aways at 50%, the timezone is set to GMT, no mobile carrier, but it's clearly a phone based on the screen size so that's strange, etc." and they see the same info from another profile. So now a potentially bigger fingerprinting datapoint is right there: here are two "devices" that spoof almost everything. So, in effect, you stand out in a crowd even more that way.
So, clearly more thought needs to go into this sort of feature. Adding features without first considering these things is not helpful, and may actually end up being harmful to your privacy. So the features have to be even more complicated, meaning more resources need to go into development, etc., etc. Are toggles user specific? If so, more infrastructure needs to be added. Will spoofed data be random? If so, that needs to be planned and implemented in a way that works and is effective.
Anyway, simply adding toggles to supply fake data might end up being harmful, and GrapheneOS doesn't do dumb stuff like that. You could also consider that maybe no spoofing is the best way to not stand out. But I think it would be most ideal for upstream AOSP to limit access to these things so that the changes can made more cleanly and apps don't break or fingerprinting isn't easier because of downstream changes. Also cool because then GrapheneOS can work on more interesting features.