Most people who dig into their phone’s privacy settings expect to find a simple location toggle and little else. Buried a few menus deeper, though, sits a separate identifier that quietly links location history, app activity and advertising profiles together, and privacy researchers keep pointing to the same fix: turning that one setting off. The advice has stayed remarkably consistent for years even as phones have added dozens of new privacy controls around it, largely because the underlying identifier does something none of those newer controls fully replace.
The Advertising Identifier Hiding Inside Every Phone
Every modern smartphone carries a unique advertising identifier, called an IDFA on Apple devices and an AAID on Android devices, that apps and ad networks use to recognize the same phone across different services without needing a name or email address. On its own, the identifier reveals nothing, but once it is paired with location data collected by apps, it becomes a durable thread that ties a person’s movements, habits and interests together over months or years. The mechanics of phone tracking depend heavily on exactly this kind of persistent identifier, since it survives even when a person clears cookies or switches between apps that otherwise share no data with one another. Data brokers that specialize in location information have built entire businesses around collecting exactly this kind of identifier-plus-location pairing from thousands of apps at once, then reselling aggregated movement patterns to advertisers, insurers and other buyers with little visibility for the phone owner into where their own data ultimately ends up.
How iPhones Let Apps Request Location Access
Apple’s approach requires each app to separately ask for permission to track a device across other companies’ apps and websites, a system layered on top of the phone’s ordinary location permissions. Digital rights researchers have recommended disabling the advertising identifier entirely rather than relying on a case-by-case decision for every app that asks, since resetting or disabling the identifier severs the link between old and new tracking data in a way that declining individual requests does not always guarantee. Apple’s system also surfaces a running list of which apps have requested tracking permission and how they responded, giving a phone owner a rare direct view into a process that, on most other platforms, happens invisibly in the background without any comparable log to review later.
Android’s Separate Advertising ID Toggle
Android phones handle the same problem through a distinct advertising ID setting, tucked inside the privacy section of the settings app rather than alongside location permissions. Newer versions of Android allow the identifier to be deleted outright rather than merely reset, which strips it from apps entirely instead of just issuing a fresh number that can eventually be re-linked to the same usage patterns through other signals. Security researchers describe this as the more durable option of the two, since a reset identifier can still be tied back to a device profile once enough other data points accumulate again. Because the setting sits under a general privacy or ads menu rather than alongside the more commonly used location permissions, it is one of the settings device owners are least likely to stumble across on their own without a specific guide pointing them to it.
Precise Location Versus Approximate Location
A second, related setting controls how exact the location data shared with an app actually is. Many phones now let a person grant an app only an approximate location, accurate to a wide radius, instead of the precise coordinates needed for turn-by-turn navigation. A weather app or a local news app rarely needs pinpoint accuracy to function, and defaulting unrelated apps to the coarser setting cuts down on how finely a location history can be reconstructed even if the underlying data is later exposed in a breach or sold to a data broker.
Why Security Researchers Keep Repeating the Same Advice
None of this is new advice, which is part of why it keeps resurfacing. Guidance from consumer protection offices, including a state privacy office’s own tips for limiting mobile device tracking, continues to list disabling the advertising identifier and tightening app-by-app location permissions among the most effective steps available to an ordinary phone owner, precisely because the underlying tracking infrastructure has changed little even as public awareness of it has grown. The setting works because it targets the piece of the system that ties everything else together, rather than trying to block every individual app or ad network one at a time, a task that would be far harder to keep up with as new apps and trackers appear. That is also why the advice rarely changes from one year to the next even as headlines about new tracking scandals keep appearing: the fix does not depend on knowing which specific company or app caused the latest privacy story, only on cutting off the identifier that made a wide range of similar stories possible in the first place.
This article was produced with the assistance of AI and reviewed by Morning Overview editors.
More from Morning Overview
- More than 60,000 people flee the Spokane area as complex fires overrun 600 structures
- 11 engines built to run well past 200,000 miles
- Card skimmers hidden on gas pumps and ATMs are draining accounts, and here’s the tell
- The FBI says hackers are hijacking outdated home routers, and it named the models to check
