The term Device ID covers several technical concepts with different scopes and legal frameworks. Each identification layer serves a distinct purpose: network connectivity, hardware, advertising, or fleet management. Confusing these layers can lead to an inaccurate assessment of tracking risks and the protection options actually available.
IMEI, ICCID, IMSI: three hardware identifiers you shouldn’t confuse
A smartphone has at least three identifiers associated with the mobile network, and none is interchangeable with another. The IMEI identifies the physical device, not the user or subscription. It remains tied to the device even after a SIM card or eSIM profile is changed.
The ICCID, by contrast, is associated with the SIM card or eSIM profile. It allows the carrier to identify the subscription medium inserted in the device. The IMSI identifies the subscriber on the network, regardless of which device they use.
This distinction has direct consequences. Blocking an IMEI after a theft prevents the device from connecting to the network, but does not protect the subscriber’s data if the SIM is removed. To understand how each layer relates to the product identifier (ID) in the broader sense, it’s best to think in layers rather than in terms of a single identifier.
Advertising identifiers on Android and iOS: how they work and their real limitations
The advertising identifier is the layer most users associate with Device ID, but it works very differently from an IMEI. It is generated by the operating system, not embedded in the hardware, and can (in theory) be reset or deleted.
Android: resetting and deleting are two different actions
Resetting the Android advertising ID assigns a new code, but does not stop tracking. Apps that have already collected the old identifier can combine other signals (Google account, IP address, hardware fingerprint) to rebuild a profile.
Deleting the advertising ID, an option available in recent Android versions, prevents apps from reading the code. It’s important to distinguish between “preventing access to the code” and “blocking all tracking”: an app may continue collecting data linked to a user account or other technical identifiers.
iOS: App Tracking Transparency doesn’t disable all data collection
Apple’s App Tracking Transparency setting lets users prevent apps from tracking their activity across other companies’ apps and websites. This choice applies to a specific identifier (IDFA), not to all data collection.
An app can still collect data within its own environment, including browsing or usage information. Apple’s framework limits cross-app tracking, not data collection within an app.
Consent and regulations: Device ID as a tracker under CNIL rules
French rules on trackers generally require prior consent before an advertising identifier is stored or accessed. These rules apply regardless of the type of identifier used for tracking, including device identifiers used for advertising purposes.
Failure to obtain consent for trackers can result in significant financial penalties. In recent years, the CNIL has investigated several mobile apps for accessing identifiers without prior consent.
The distinction between a hardware identifier and an advertising identifier is legally important here. An IMEI used by a carrier for network management is subject to a different framework from an advertising identifier accessed by a third-party app for targeting.
- IMEI and ICCID identifiers are subject to telecommunications regulations and do not require the same consent as an advertising tracker
- The advertising identifier (GAID on Android, IDFA on iOS) is subject to prior consent rules whenever it is used for cross-app tracking
- A fleet identifier (MDM) used in a professional context is governed by GDPR rules for employee data, with a legal basis distinct from consent
Device ID in fleet management: an underdocumented business use
In a Mobile Device Management (MDM) context, Device ID is used to enroll, configure, and secure business devices remotely. The identifier used is not necessarily the IMEI: MDM solutions often generate their own enrollment identifier, linked to the organization’s security policy.
In MDM, Device ID is used for access control, not ad targeting. It helps verify that a device is compliant (encryption enabled, operating system up to date) before granting access to company resources.
This use case shows why reducing Device ID to a simple “serial number” or an advertising tracking tool is a mistake. The same concept covers entirely different purposes, legal frameworks, and levels of user control.
Protecting your privacy from device identifiers
The available controls vary depending on the identification layer involved.
- Users cannot change the IMEI (and doing so is illegal in most jurisdictions). The only protection is to have the carrier block the device after it is stolen
- The Android advertising ID can be deleted in the privacy settings, preventing apps from reading it. Resetting it alone is not enough to stop tracking
- On iOS, refusing tracking through App Tracking Transparency blocks each app from accessing the IDFA
- In a professional context, the MDM identifier is managed by the fleet administrator, not the end user
No single setting covers every identification layer. Deleting the advertising ID does not affect the IMEI or ICCID. Refusing cross-app tracking does not block data collection within an app. Each layer requires a separate action, and some remain beyond the user’s control.
