Android 10 Locks Away Permanent Device Identifiers

What Changed

Android 10, released in September 2019, restricted access to non-resettable device identifiers.¹ Apps now need a privileged system permission, READ_PRIVILEGED_PHONE_STATE, to read identifiers such as the IMEI and the device serial number. Ordinary apps from the Play Store can't get that permission. The restriction applies on every Android 10 device, even to apps built for older versions.²

If an app without the permission asks for these identifiers, Android returns an error or a placeholder instead of the real value, depending on the app's target version.¹

Android 10 also expanded other privacy protections, including randomizing the Wi-Fi hardware (MAC) address by default when connecting to networks. And it split location access in two: an app now needs a separate permission to read location while it's running in the background, so users can allow location while they use an app without allowing it all the time.¹ For marketers, that meant less background location data from apps, a common input to location-based audiences.

Why It Mattered

Google Play policy had required the resettable Advertising ID for ads since 2014, but permanent identifiers were still readable, so an app could still recognize a device after its user reset the Advertising ID.

Android 10 closed that gap technically rather than by policy. Once a user reset or deleted their Advertising ID, there was no permanent hardware identifier for an app to fall back on.

The change mirrored a shift Apple had made years earlier, when it retired the UDID. By 2019 both platforms had moved permanent identifiers out of reach, leaving the resettable advertising IDs as the only sanctioned identifiers for ads.

It also cut off a fallback in markets where phones ship without Google Play, and so without the Advertising ID. In China, attribution tools had relied on IMEI numbers, and moved to OAID, one of the other advertising IDs on devices without Google's services.³

For app marketers, the change mostly affected attribution partners rather than campaigns directly: they became more dependent on the Advertising ID, which users can reset or delete.