PENTESTY · EDITORIAL ANALYSIS · · 4 min read
Advertising identifiers: what can your business control?
A privacy setting has a defined scope. Assess advertising identifiers and location collection without monitoring peopleâs movements.
By Pentesty
What the public documents establish
In letters published by Senator Ron Wyden, Wyden and Pat Harrigan requested an investigation into military location-data protections on September 4, 2026. Attached responses state that advertising IDs were disabled on managed equipment. The letter attributes reports of adversaries using commercial data to Central Command; it does not establish the cause of a specific attack. The source of remaining exposure is presented as an open question.
Define what the setting should prevent
Before selecting a policy, state the expected outcome: preventing particular apps from obtaining the advertising identifier, limiting unnecessary location access or reducing third-party sharing. Each objective needs its own check. A device-management compliance report establishes an administrative condition; alone, it does not demonstrate that all collection has stopped.
Apple explains that refusing tracking prevents access to the IDFA. Microsoft documents a specific policy for disabling the Windows advertising identifier. These descriptions have different scopes and should not become a promise of anonymity. Confirm the supported versions, editions and management modes for each device type in your fleet.
Test with a laboratory device
Choose a managed device and a fictional account. Record the configuration before and after policy application, synchronization and the effective state available on the device. Where the business owns a test application, check the value it receives through the permitted system interface. Do not install tracking tools to demonstrate that the control works.
Keep a separate test for the business function. A field-service app may need a single location to complete a work order. Check whether that need can be met without continuous collection or including data in advertising tools. Observe the authorized integration, using fictional positions where possible.
- Configuration evidence: policy, covered group, synchronization and the state observed on the device.
- Application evidence: requested permissions, transmitted fields and destinations needed for the approved function.
- Operational evidence: legitimate task completion and handling of denied permissions without silently expanding collection.
Show the management boundary in the inventory
Separate company equipment, personal devices approved for work and visitor devices. A work profile does not demonstrate that the rest of a device is covered by the same policy. Ask the provider to describe the effective scope and record what the company can configure, observe and require.
Agree with the responsible teams which activities are suitable for each arrangement. If an application depends on a control unavailable on a personal device, revise the workflow or provide suitable equipment. Our analysis of privacy in connected environments distinguishes permission to use a service, environmental capture and application access.
Review the application and contract alongside the device
For an application your business owns, maintain an inventory of third-party components receiving data and each transmissionâs purpose. Request retention and deletion evidence from the service owner. A change of SDK, provider or permission should reopen the affected assessment. Do not conclude that removing one identifier prevents correlation through every other data field.
When equipment is returned or assigned to another person, check which accounts and integrations remain linked. This resembles access handover in connected fleets: physically returning equipment does not, by itself, end every data relationship. Retain an acceptance record showing the result, observed limitation and owner of any exception.
Assess exposure without creating another sensitive history
The business does not need to purchase location datasets or reconstruct employeesâ movements to assess its applications. Use synthetic data and inspection of authorized components. Limit assessment records too: keeping real coordinates indefinitely can create the very problem the review was intended to reduce.
Frequently asked questions
Does disabling the advertising ID turn off location?
These controls serve different purposes. Check the identifier, location permissions and the data actually used by applications separately.
Does company policy cover an entire personal phone?
That depends on the platform and management arrangement. Document the demonstrated scope without assuming control over every personal application.
Do we need to buy commercial data for testing?
No. Use authorized devices and applications, fictional accounts and synthetic data to assess the controls defined in the agreed scope.
Do the letters demonstrate that risk was eliminated?
No. They record stated measures and a request to investigate remaining exposure; they do not independently validate that the risk has been eliminated.
Sources and references
- Senator Ron Wyden: request to investigate location-data protections
- Wyden and Harrigan: letter and public military component responses
- Apple: tracking permissions and the IDFA identifier
- Microsoft: Privacy/DisableAdvertisingId policy
Original Pentesty analysis, published October 16, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.