Understanding Persistent App Tracking — Would GrapheneOS on Pixel Help Break It?

lao229

Hi everyone,

I've been trying to wrap my head around how some apps manage to track me across different devices, OS reinstalls, and even between Android and iOS. Years ago, I used some social apps like Slowly and Tandem, and ever since, I’ve noticed that new accounts I make on fresh setups tend to get flagged very quickly — almost like they "know" it’s still me, even after changing phones, SIMs, and networks.

The only time I didn’t see this happen was when I used a de-Googled ROM with MicroG on an old Galaxy S9+. That made me wonder how much telemetry is being leaked through Google Play Services, especially via Firebase.

I’m now seriously considering switching to a Pixel device just to run GrapheneOS and gain better control and isolation. Before I make the jump, I wanted to ask:

With GrapheneOS and no Play Services installed, is Firebase-based tracking (or similar SDK-level fingerprinting) still a concern?

Can apps still access persistent identifiers like Wi-Fi MACs, device-level sensors, or anything else that might leak identity, even if I'm using separate user profiles or network restrictions?

Would it make sense to use additional tools like a firewall or DNS-level filtering (e.g., RethinkDNS or AdGuard) on top of GrapheneOS, or is that overkill?

Is there a reliable way to test what’s still being sent out? I’ve captured HAR files before but don’t know how to interpret them deeply.

My goal isn’t to evade bans or anything — I’m just trying to understand how deep the tracking goes, and whether GrapheneOS can help wipe that slate clean from a technical standpoint.

Thanks in advance to anyone who can help shed light on this.

de0u

lao229 I've been trying to wrap my head around how some apps manage to track me across different devices, OS reinstalls, and even between Android and iOS. Years ago, I used some social apps like Slowly and Tandem, and ever since, I’ve noticed that new accounts I make on fresh setups tend to get flagged very quickly — almost like they "know" it’s still me, even after changing phones, SIMs, and networks.

I don't know why Slowly or Tandem intend to flag users, or how they do it, but somewhere at the core they presumably think they are flagging users in response to some behaviors. Unless their system misfires to the point of randomness, over time users exhibiting those behaviors (or other behaviors that happen to look similar) seem likely to be flagged, with users exhibiting more of them getting flagged faster.

Tandara

The best advice would be to read GrapheneOS FAQ page - it explains all the preventative measures GOS takes better than anyone out here.

Tandara

Even in the worst-case scenario where Android ID is used to identify you, GOS devs added profiles feature. Each profile generates a different Android ID, so you can prevent that tracking as well just buy switching profiles.

For Firebase tracking, I remember there were multiple discussions on this forum shedding the light on it.

other8026

Tandara GOS devs added profiles feature.

Profiles are an AOSP feature, but GrapheneOS has made some improvements.

DeletedUser495

Tandara I think you are being a little naive here, profiles are still on the same device and share global settings and configurations and other hardware and performance based stats and values that can be correlated.

other8026

This post by the project account addresses this question very well: https://discuss.grapheneos.org/d/5775-device-fingerprinting-test-results-concerns-and-questions/20

Tandara

DeletedUser495 Technically, anything can be used for fingerprinting, even something like logging out of one profile and going into another -> apps 'cooperate' and combine session data with stats like battery -> fingerprinted. It all depends on how hard app devs decide to go. The only thing that would solve it is standardizing environments with vms, but it's not possible yet on Android (at least per-app). I have heard GOS devs are debating whether the use of private space isolation per app is doable.

dawt

I used some social apps like Slowly and Tandem, and ever since, I’ve noticed that new accounts I make on fresh setups tend to get flagged very quickly — almost like they "know" it’s still me, even after changing phones, SIMs, and networks.

It's basically impossible to track someone if they changed phones, ISPs, and phone #s. If they're still flagging you, it's probably not because they identified you specifically, but rather you tripped some sort of risk score. Using a VPN? That increases your risk score. Same for certain email domains, or failing safetynet attestation.