What Are GAID and IDFA? Mobile Ad IDs Explained

What are GAID and IDFA?

GAID and IDFA are mobile advertising IDs: device identifiers that apps can read and that exist only for advertising and ad measurement. GAID, the Google Advertising ID, is provided on Android by Google Play services, and Google calls it simply the advertising ID. IDFA, the Identifier for Advertisers, is Apple’s equivalent on iPhone and iPad. Unlike a hardware serial number, users can control both, and when access is not allowed the ID is returned as a string of zeros.

Both look like a standard UUID, for example 00000000-0000-0000-0000-000000000000, which is exactly the value an app receives when the ID is unavailable.

GAID vs IDFA at a glance

IDFA and App Tracking Transparency

Apple’s developer documentation describes the IDFA as an alphanumeric string that is unique to each device and used only for advertising, and lists uses such as frequency capping, attribution, conversion events, counting unique users, ad fraud detection, and debugging.

Since iOS 14.5 and iPadOS 14.5, an app must request permission through the App Tracking Transparency (ATT) framework before it can read the IDFA. According to Apple, the identifier returns all zeros when:

• the app has not asked for tracking permission,
• the user declined,
• a profile or configuration restricts access,
• or the app runs in Simulator, on a Mac, or as an iPhone or iPad app in visionOS.

Users can change their choice at any time in the Tracking section of their Privacy settings. Apple therefore recommends not storing the IDFA and reading it fresh, checking the current authorization status.

ATT is about more than the ID. Apple defines tracking as linking user or device data collected from your app with data collected from other companies’ apps, websites, or offline properties for targeted advertising or advertising measurement, or sharing it with data brokers. Its user privacy guidance adds that, under the Apple Developer Program License Agreement, apps may not derive data from a device to uniquely identify it, which rules out fingerprinting as a replacement for the IDFA.

GAID and the Android 13 AD_ID permission

Google’s Play Console Help describes the advertising ID as “a unique, user-resettable, and user-deletable ID for advertising, provided by Google Play services.” Three changes matter for anyone using it today:

• Users can delete it. When a user deletes the advertising ID in Android settings, it is removed, and any app trying to read it receives a string of zeros. Google rolled this out from late 2021, on all devices that support Google Play from April 1, 2022.
• Apps need a permission. Apps that target Android 13 (API level 33) or later must declare com.google.android.gms.permission.AD_ID in their manifest. Without it, Google’s API reference says the returned value is all zeros. Some SDKs, such as Google’s Mobile Ads SDK, already declare it and it is merged into your app.
• Opt-out must be respected. If the user has opted out of ads personalization, Google’s Ads policy forbids using the ID for profiles or personalized ads, while still allowing contextual advertising, frequency capping, conversion tracking, reporting, and security and fraud detection.

For analytics and fraud prevention that are not about ads, Google points developers to a separate identifier, the App Set ID, which must not be used for ads personalization or measurement.

What about Privacy Sandbox on Android? Google had been building privacy-preserving advertising APIs for Android. On October 17, 2025, it announced it would retire most of them, including Topics, Protected Audience, Protected App Signals, the Attribution Reporting API, and SDK Runtime, citing ecosystem feedback and low adoption. That announcement did not mention the advertising ID, which remains part of Google Play services and its policies today.

How MMPs and ad networks use ad IDs

Ad IDs let different companies recognize the same device without knowing who the user is:

1. An ad network shows an ad inside an app and records the click together with the device’s ad ID, where it is available.
2. The user installs the advertised app. The measurement SDK in that app reads the same ad ID on first open.
3. The MMP matches the two and credits the install to the network, then reports later in-app events the same way.

Ad IDs also power frequency capping, retargeting, and fraud checks such as spotting one device claiming many installs. Where the ID is all zeros, measurement falls back to other methods: the Play Install Referrer on Android, Apple’s SKAdNetwork and AdAttributionKit on iOS, and click IDs passed through server-to-server tracking. What is an MMP? explains each of these in more detail.

Privacy rules for advertising IDs

• No linking to persistent IDs. Google’s Ads policy says the advertising ID may not be connected to persistent device identifiers, such as SSAID, MAC address, or IMEI, for any advertising purpose.
• Personal data only with consent. Google allows connecting it to personally identifiable information only with the user’s explicit consent.
• A reset is a reset. After a reset, the new ID must not be linked to the old one or to data derived from it without explicit consent.
• Ask first on iOS. No IDFA and no tracking without ATT permission.
• Disclose it. Both stores expect your privacy policy and store privacy labels to describe how you collect and use the ID.
• Local law still applies. In the EU, for example, the GDPR counts online identifiers as personal data when they can identify a person. Store rules are a minimum, not the whole picture.

Both stores also have stricter rules for apps aimed at children. This article is general information, not legal advice.

Frequently asked questions