What is an advertising ID?
Why it matters now
Spyware picked targets by ad ID. On 15 October 2026, Citizen Lab reported on an ad platform used to deliver spyware. Customers could select a person "based on their mobile advertising identifier (iOS or Android)", a browser ID or an IP address. At least 45 Al Jazeera devices were targeted with Candiru spyware this way Citizen Lab (15 Oct 2026).
Ad auctions leaked sensitive traits. Norway fined Xandr, an ad company now owned by Microsoft, NOK 92 million (about $9.6 million) over Grindr users' data shared in ad auctions Malwarebytes (13 Oct 2026).
Location brokers sold ad IDs. The FTC alleged Mobilewalla collected "more than 500 million unique consumer advertising identifiers paired with consumers' precise location data" FTC (3 Dec 2024).
It is a device-level tracking number that you control. Google calls it "a unique, user-resettable, and user-deletable ID for advertising, provided by Google Play services" Google Play Console Help (checked 16 Oct 2026). On Apple devices the equivalent is the IDFA (Identifier for Advertisers) Apple Support (19 Dec 2025). Windows "generates a unique advertising ID for each user on a device" Microsoft Support (updated 28 Sep 2026). Google TV and Android TV have one too Google TV Help (checked 16 Oct 2026) Android TV Help (checked 16 Oct 2026).
Why advertisers want it. Apps on the same device can read the same ID, so ad companies can link your activity across apps. Apple's App Tracking Transparency exists so you can "choose whether an app can track your activity across other companies' apps" Apple Support (19 Dec 2025). Microsoft says app developers and ad networks can use it "for their own purposes, including providing more relevant advertising in apps" Microsoft Support (updated 28 Sep 2026).
What can your advertising ID reveal about you?
On its own, a random code. Joined to other data, a lot. The risk comes from what gets attached to the ID as it travels through ad systems.
Ad auctions. When an app shows an ad, information about the person who will see it goes out to bidders in real time. Between July 2018 and April 2020, Xandr handled such auctions for Grindr users Malwarebytes (13 Oct 2026). Norway's data protection authority found that "simply being identified as a Grindr user was information that indicated sexual orientation" Malwarebytes (13 Oct 2026). Xandr relied on Grindr to get consent and did not check it was valid Malwarebytes (13 Oct 2026). The fine is NOK 92 million, about €8.5 million noyb (12 Oct 2026). Microsoft said it was "reviewing the decision and assessing its options" Malwarebytes (13 Oct 2026).
Location data brokers. The FTC alleged that Mobilewalla collected ad IDs with precise locations from ad auctions, even when it did not win the bid. The data was not anonymised and was sold on FTC (3 Dec 2024). The FTC also alleged that Gravy Analytics sold lists of people tied to medical events and places of worship FTC (3 Dec 2024). Both orders became final on 14 January 2025. They ban selling sensitive location data, such as visits to health clinics and religious sites FTC (14 Jan 2025) FTC (14 Jan 2025).
Ad targeting lists. Advertisers on ChatGPT can upload "Google Advertising IDs (GAID)" alongside emails and phone numbers to build a custom audience OpenAI Help (checked 16 Oct 2026). Our ChatGPT ads guide explains how that works.
How was an advertising ID used to deliver spyware?
This is targeted spyware, not a mass threat. It matters most for journalists, activists and officials. Citizen Lab calls the technique "AdFection" Citizen Lab (15 Oct 2026).
- The platform: Discover-Tech, an Israel-based firm presenting itself as an advertising company. Its Controlium panel let customers pick targets and push "controlled ads" Citizen Lab (15 Oct 2026).
- How targets were chosen: by mobile advertising ID, browser identifier and/or IP address. A server then decided, "apparently based on a combination of the source IP address and the advertising identifiers", whether to send attack code Citizen Lab (15 Oct 2026).
- No click needed: "the simple display of a targeted ad is enough for infection", the report says Citizen Lab (15 Oct 2026).
- Victims: at least 45 Al Jazeera Windows computers in 2024 and 2025, linked to Candiru spyware Citizen Lab (15 Oct 2026) TechCrunch (15 Oct 2026).
- Reach: Discover-Tech ads appeared in almost 200,000 apps and websites over four months. Google and IAB Europe removed the firm from their vendor registries in October 2026 Citizen Lab (15 Oct 2026).
Citizen Lab's Bill Marczak told TechCrunch: "it's time to disable ad tracking on your devices or even block ads altogether" TechCrunch (15 Oct 2026). Discover-Tech did not respond to TechCrunch, and Candiru's maker could not be reached TechCrunch (15 Oct 2026).
How do you delete or reset your advertising ID on each device?
Steps from each maker's own support page. Menus vary by version and phone maker.
| Device | Where to go | What it does |
|---|---|---|
| Android phone or tablet | Settings > Privacy > Ads > Delete Advertising ID Google Play Console Help (checked 16 Oct 2026) | Apps get "a string of zeros instead of the identifier" Google Play Console Help (checked 16 Oct 2026) |
| iPhone and iPad (apps) | Settings > Privacy & Security > Tracking; turn off Allow Apps to Request to Track Apple Support (19 Dec 2025) | Apps that are refused can't access the IDFA Apple Support (19 Dec 2025) |
| iPhone, iPad and Mac (Apple's own ads) | Privacy & Security > Apple Advertising; turn off Personalized Ads Apple Advertising & Privacy (11 May 2026) | Apple stops using your information for ad personalisation Apple Advertising & Privacy (11 May 2026) |
| Windows 11 | Start > Settings > Privacy & security > General; turn off "Let apps show me personalized ads by using my advertising ID" Microsoft Support (updated 28 Sep 2026) | Turning it back on gives you a new ID Microsoft Support (updated 28 Sep 2026) |
| Google TV | Settings > Privacy > Ads > Delete advertising ID Google TV Help (checked 16 Oct 2026) | No new ID is assigned Google TV Help (checked 16 Oct 2026) |
| Android TV | Settings > Device > Preferences > About, then the Ads options Android TV Help (checked 16 Oct 2026) | Reset or delete, as on Google TV Android TV Help (checked 16 Oct 2026) |
| Web browsers | No advertising ID. Firefox: shield icon > Protection Settings Mozilla Support (checked 16 Oct 2026). Google account: My Ad Center > Personalized ads My Ad Center Help (checked 16 Oct 2026) | Blocks cross-site trackers; stops Google personalising ads Mozilla Support (checked 16 Oct 2026) My Ad Center Help (checked 16 Oct 2026) |
Android. Google's steps are Settings, then Privacy, then Ads. Tap Delete Advertising ID and confirm Google Play Console Help (checked 16 Oct 2026). On some older Android versions the path is Privacy, then Advanced, then Ads, with an option called "Opt out of Ads Personalization" Google Play Console Help (checked 16 Oct 2026). Google's Android Help also lists ad controls under Settings > Google > All services > Privacy & security > Ads Android Help (checked 16 Oct 2026).
iPhone and iPad. App Tracking Transparency arrived in iOS 14.5. With Allow Apps to Request to Track off, "you won't get prompts from apps that want to track your activity" Apple Support (19 Dec 2025). In the same Tracking list you can switch permission off for any app you allowed before Apple Support (19 Dec 2025). Apple's Personalized Ads switch is separate and covers only Apple's own ads, such as in the App Store Apple Support (15 Nov 2023).
Windows 11. The switch is under Privacy & security > General Microsoft Support (updated 28 Sep 2026). Microsoft notes that turning it off "will not reduce the number of ads you see" Microsoft Support (updated 28 Sep 2026).
Smart TVs and streaming sticks. Google TV and Android TV have reset and delete options Google TV Help (checked 16 Oct 2026) Android TV Help (checked 16 Oct 2026). For Samsung, LG and Roku viewing data, see our smart TV tracking guide. We could not read current Roku, Amazon Fire TV or Samsung pages on their ad IDs, so we give no path for those.
Browsers. Websites track you with cookies and fingerprinting (reading your browser's settings to tell it apart), not an advertising ID. Firefox blocks cross-site tracking cookies, social media trackers and fingerprinters by default; Strict mode goes further Mozilla Support (checked 16 Oct 2026). If you use a Google account, My Ad Center has an on/off switch for personalized ads My Ad Center Help (checked 16 Oct 2026).
Should you reset or delete your advertising ID?
Delete it where you can. Resetting swaps the ID for a new one. Deleting means no new one is assigned Google TV Help (checked 16 Oct 2026), and apps get only zeros Google Play Console Help (checked 16 Oct 2026).
Why a reset is weaker. A reset only helps if nothing else links the old and new IDs. A 2020 study of smart TV apps found some sent the ad ID alongside a fixed serial number or device ID. A tracker could then "link an old advertising ID to its new value by joining on the serial number" Varmarken et al., PoPETs (2020). Apps can also make their own IDs or use fingerprinting Varmarken et al., PoPETs (2020).
Windows has no delete button. You can only turn the ID off. Turning it back on resets it Microsoft Support (updated 28 Sep 2026).
What does turning off ad tracking not do?
- It does not remove ads. Apple, Microsoft and Google all say you may see as many ads, just less tailored Apple Support (15 Nov 2023) Microsoft Support (updated 28 Sep 2026) Google TV Help (checked 16 Oct 2026).
- It does not hide your IP address. Controlium could pick targets by IP address as well as ad ID Citizen Lab (15 Oct 2026). See what your connection shows with our Connection Fingerprint tool.
- It does not cover your email or phone number. Ad platforms match those directly. ChatGPT custom audiences accept emails and phone numbers, plain or hashed OpenAI Help (checked 16 Oct 2026).
- It does not erase what brokers already hold. For that, use opt-outs. Our people-search removal guide covers the main sites.
What else should you do if you could be targeted?
Go beyond the settings. Marczak's advice was to disable ad tracking "or even block ads altogether" TechCrunch (15 Oct 2026). Practical layers:
- Delete or disable the advertising ID on every device you use for sensitive work, using the table above.
- Use a browser with strong tracking protection, such as Firefox in Strict mode Mozilla Support (checked 16 Oct 2026), plus a reputable ad blocker.
- Follow the high-risk steps in our phone tracking checklist, including spyware checks.
- Check what your browser leaks with our Cookie & Tracker Exposer.
Sources
Every source was read on 16 October 2026. The Norwegian authority's own page could not be read by our tools, so the fine is cited from noyb and Malwarebytes. FTC complaints are allegations; the orders are final.
- Marczak, Christl, Scott-Railton, Perry, Anstis, Deibert, The Citizen Lab — "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware" (15 Oct 2026)
- Zack Whittaker, TechCrunch — "Citizen Lab says governments are abusing online ads to hack people with zero-click spyware" (15 Oct 2026)
- Pieter Arntz, Malwarebytes — "Grindr users' sensitive data shared through ad auctions without valid consent" (13 Oct 2026)
- noyb — "Privacy win: Norwegian authority fines Microsoft's Xandr" (12 Oct 2026; noyb was a complainant)
- Federal Trade Commission — "FTC Takes Action Against Mobilewalla for Collecting and Selling Sensitive Location Data" (3 Dec 2024)
- Federal Trade Commission — "FTC Finalizes Order Banning Mobilewalla from Selling Sensitive Location Data" (14 Jan 2025)
- Federal Trade Commission — "FTC Takes Action Against Gravy Analytics, Venntel for Unlawfully Selling Location Data Tracking Consumers to Sensitive Sites" (3 Dec 2024)
- Federal Trade Commission — "FTC Finalizes Order Prohibiting Gravy Analytics, Venntel from Selling Sensitive Location Data" (14 Jan 2025)
- OpenAI Help Center — "Set up custom audiences for your campaign" (read 16 Oct 2026)
- Google Play Console Help — "Advertising ID" (read 16 Oct 2026)
- Android Help — "About Google Play services for ads safety" (read 16 Oct 2026)
- My Ad Center Help — "How personalized ads work" (Android version, read 16 Oct 2026)
- Apple Support — "If an app asks to track your activity" (19 Dec 2025)
- Apple Support — "Control personalized ads on the App Store, Apple News, and Stocks" (15 Nov 2023)
- Apple — "Apple Advertising & Privacy" (11 May 2026)
- Microsoft Support — "General privacy settings in Windows" (updated 28 Sep 2026)
- Google TV Help — "Change ad settings for your Google TV" (read 16 Oct 2026)
- Android TV Help — "Change ad settings for your Android TV" (read 16 Oct 2026)
- Mozilla Support — "Enhanced Tracking Protection in Firefox for desktop" (read 16 Oct 2026)
- Varmarken, Le, Shuba, Markopoulou, Shafiq — "The TV is Smart and Full of Trackers", Proceedings on Privacy Enhancing Technologies 2020(2) (copy hosted by the FTC)
Frequently Asked Questions
If I tap Ask App Not to Track on iPhone, can the app still track me another way?
Apple says that when you choose Ask App Not to Track, the developer cannot access the IDFA, and the app also cannot track you using other identifying information such as your email address.
Is an advertising ID personal data?
In the Xandr case, Norway's authority treated being identified as a Grindr user in ad auctions as sensitive information about sexual orientation. noyb says these systems use tracking identifiers to build profiles of people's interests and behaviour.
Can someone find where I live from my advertising ID?
Not on its own. The FTC alleged that brokers sold ad IDs paired with precise location, and its Mobilewalla order bans selling data that reveals the identity of someone's private home. Deleting the ID cuts that link for new data.
Does a VPN hide my advertising ID?
No. A VPN changes the IP address that websites and ad servers see. The advertising ID is read by apps on the device itself. You need both: the ID turned off, and a VPN if you also want to hide your IP address.
Do I need to do this again after a phone or Windows update?
Check after major updates and on every new device, because the setting belongs to each device. Windows creates an advertising ID for each user on each device, and turning the switch back on creates a new one.
Does ChatGPT see my advertising ID?
Advertisers on ChatGPT can upload lists of Google Advertising IDs, emails or phone numbers to target or exclude people. OpenAI requires at least 25,000 matched users before a list can be used to show ads, and says uploads are usually deleted within 24 hours.
Next step
Delete the ID on your phone now, using the table above. Then do your TV with our smart TV tracking guide, and see what your browser still gives away with the Cookie & Tracker Exposer.