This includes at least one iOS app, “Pumpkin Maker”, that shared location data without the prompt asking the user for permission to use their location.
Among all apps tested, the most widely shared detail was the
unique ID number assigned to every phone. It is effectively a
“supercookie,” says Vishal Gurbuxani, co-founder of Mobclix Inc.,
an exchange for mobile advertisers.
On iPhones, this number is the “UDID,” or Unique Device
Identifier. Android IDs go by other names. These IDs are set by
phone makers, carriers or makers of the operating system, and
typically can’t be blocked or deleted.
“The great thing about mobile is you can’t clear a UDID like you
can a cookie,” says Meghan O’Holleran of Traffic Marketplace, an
Internet ad network that is expanding into mobile apps. “That’s
how we track everything.”