What is an advertising ID?

A random identifier that Apple and Google assign to every smartphone out of the box so the ad industry can tell devices apart. On iPhone it is called the IDFA, and since iOS 14.5 an app can only read it if you allow tracking. On Android it is called the advertising ID or AAID and is active out of the box. It contains no name. Because many apps send it to ad partners together with location and other details, it lets those partners merge data from different apps into one profile.

Should I reset or delete my advertising ID?

Delete it if your phone offers that option. On Android, deleting replaces the ID with a string of zeros, so apps no longer get a usable identifier. Resetting only issues a new ID: the link to your old profile breaks, but a new profile starts building straight away. On iPhone the equivalent of deleting is turning off "Allow Apps to Request to Track".

Does "Ask App Not to Track" stop location tracking?

Not on its own. It blocks the app from reading the IDFA and, under Apple's rules, from tracking you across other companies' apps with other identifiers. It does not take away location permission. An app that may read your GPS position can still collect it, and every app still sees your IP address, which gives away a rough location.

What were the Databroker Files?

An investigation by the German outlets netzpolitik.org and Bayerischer Rundfunk, first published on 16 July 2024 and later extended with WIRED and other partners. It started with 3.6 billion location points from Germany that a US data broker handed over as a free sample. Every point carried an advertising ID, which made it possible to rebuild movement patterns and identify people, including staff at intelligence and military sites.

What is a data broker?

A company that buys, combines and resells information about people, usually without any direct relationship with them. Location brokers buy from apps, ad platforms and other brokers, then sell subscriptions or one-off data sets. People-search sites are a different branch of the same industry; we cover them in our guide to searching yourself online.

Can I find out whether my location data was sold?

Not reliably. netzpolitik.org ran a checker for the first data set but took it offline on 8 July 2026. In the EU and UK you can ask apps that use your location what they stored and shared, under Article 15 GDPR. In several US states privacy laws give similar access rights. None of this reaches data that has already been resold abroad.

Advertising ID: what the Databroker Files reveal about your phone

This story starts on a data marketplace based in Berlin. In early 2024 a team from the German nonprofit newsroom netzpolitik.org and the public broadcaster Bayerischer Rundfunk (BR) asked around for phone location data. A broker in Florida answered by sending a sample, free of charge and without asking a single question about what they planned to do with it.

The sample held 3.6 billion location points from Germany, several hundred gigabytes of plain text. Every point had a date, a time and one more field that turned out to matter most: the advertising ID of the phone it came from.

The reporters published in July 2024 under the name “Databroker Files”. In November they followed up with WIRED and showed that the same data exposed US troops and intelligence staff on bases in Germany. This article retells that investigation, explains how an ordinary app feeds a market like this, and ends with the settings on your own phone that make you harder to follow, plus the places where those settings stop helping.

An open, unmarked cardboard box like a merchandise sample on a dark table, hundreds of tiny warm points of light spilling over the edge and spreading across the wood like fine sand — A sample is meant to sell the subscription. This one contained 3.6 billion locations.

A free sample, no questions asked

Data marketplaces work like wholesale. Buyers browse listings, sellers offer previews so customers can judge the quality. Some sellers insist on a video call first to find out who they are dealing with. Datastream Group, the Florida company behind this offer, did not. The contact ran through Datarade, a German platform that connects buyers and sellers and that had received seed money through Germany’s state-backed High-Tech Gründerfonds.

Asked about a similar investigation in the Netherlands, Datarade said it acts only as an intermediary, sells no data itself and allows only legal content on its platform. Neither Datarade nor Datastream answered the German reporters’ questions. Datastream now operates under the name Datasys.

The sample was the cheap part. According to netzpolitik.org, Datastream offered a subscription for a little over 14,000 US dollars a month, covering 38 million daily active users in up to 163 countries, refreshed every hour. The free slice covered roughly two months in the autumn of 2023.

It contained about eleven million distinct advertising IDs. The reporters are careful with that figure. They kept finding near-identical movement patterns under five or more different IDs and suspect that some IDs were altered, possibly to make the data set look bigger. The real number of phones is likely lower. One journalist on the team found his own ID, though with vague locations and a date when he was not even in town. Other profiles in the same file were accurate to a few meters.

How an advertising ID becomes a person

The data set held no names and no phone numbers. On paper, that sounds anonymous. In practice, two months of points tied to one ID show where a phone spends its nights and where it spends its working days. That gives you a home and an employer. The reporters found that a web search was sometimes enough to put a name to a profile. People in detached houses were especially easy, and plenty of people list their employer on LinkedIn or still appear in the phone book. To test whether the data was genuine, the team identified people in spot checks, some of them in their own circle of acquaintances.

A dark rural landscape at night seen from high above, scattered with thousands of tiny warm points of light that thicken into bright clusters, with a thin chain of evenly spaced points running along a road between them — Points gather where a phone sleeps and where it works. Between them runs the commute.

They then looked at places where people expect privacy. They found location points on the grounds of ten specialist clinics for psychiatry and addiction, plus swingers’ clubs, red-light districts and prisons. The team chose not to contact the people it traced to the clinics, to avoid retraumatizing patients or tipping off relatives who did not know. We follow that choice and name no facilities.

A lawyer at the German nonprofit HateAid called such profiles a “massive security risk” for people facing online abuse. Stalkers could use them to find a home address or intercept someone on the way to work, and a profile that shows a brothel visit or a clinic stay is leverage for blackmail.

US bases, German spies and a commute to Bad Aibling

One profile starts every morning at a house in Bavaria. The phone travels by car and parks at the Mangfall barracks in Bad Aibling, an outpost of Germany’s foreign intelligence service, the BND. The reporters could follow that commute dozens of times.

At Büchel air base, where US nuclear weapons are widely reported to be stored, the data set held 38,474 location points from 189 advertising IDs. There were profiles inside the barracks of Germany’s special forces command in Calw and at the joint counter-terrorism center in Berlin.

A tall chain-link fence topped with barbed wire at the edge of a remote training ground at dusk, a faint swarm of tiny warm points of light hanging in the dark sky above it — A fence stops people. The signals from their phones go straight over it.

The November 2024 follow-up with WIRED focused on US forces. Grafenwöhr, the largest US military training area in Europe, showed more than 190,000 location signals from 1,257 devices, including a device that spent hours on a tank gunnery range. Ramstein Air Base, headquarters of US Air Forces in Europe and Africa, showed more than 164,000 data points from up to 1,275 devices, according to netzpolitik.org; WIRED reported 164,223 signals from nearly 2,000 devices. In all, the reporters found hundreds of thousands of signals at no fewer than 13 particularly sensitive military and intelligence sites.

“It is outrageous that American data brokers are selling location data collected from thousands of brave members of the armed forces,” Senator Ron Wyden told WIRED. Unless the incoming administration and Congress act, he warned, “these kinds of abuses will keep happening, and they’ll cost service members’ lives.” Germany’s defense ministry wrote that it considered it “very likely” that every member of the armed forces, like every phone user, is exposed to this risk. And the head of Germany’s military counterintelligence service, Martina Rosenberg, told a parliamentary oversight committee in October 2024: “We can only raise awareness.”

That last sentence frames the rest of this article. If the agency tasked with protecting soldiers can only send warnings, the most effective switch is the one on each person’s phone.

Where the dots come from

Every iPhone and every Android phone with Google services has an advertising ID. Apple calls it the IDFA, Google the advertising ID. On Android, apps can read it out of the box. On iPhone, since iOS 14.5, an app only gets it if you allow its tracking request. netzpolitik.org compares it to a license plate that follows you through the app world. A broker told the reporters it was like a real name.

Its job is to join things up. A hiking route from one app, a dating preference from another, a quiz result from a third: each is a fragment, and with the same ID attached they become a profile. The 3.6 billion points could only be turned into movement patterns because every single one carried an ID. Store apps collect more than that ID, as the privacy notices behind grocery loyalty programs show.

Data leaves an app on two main roads.

SDKs. Almost no app is written from scratch. Developers embed ready-made code from third parties, called software development kits, for payments, crash reports or ads. That code runs with the app’s permissions. If the app may read your GPS position, an SDK can send it out together with your advertising ID. Datastream’s listing mentioned GPS data and SDKs. Which apps fed the 3.6 billion points, the company never said, despite repeated questions.

Real-time bidding. Every time an ad slot opens in an app, an auction runs within milliseconds. To let buyers bid, the app sends a packet of information through an ad exchange, including the advertising ID, the IP address and sometimes a precise location. That packet, known as bidstream data, goes to hundreds or thousands of companies, the losing bidders included. Anyone who quietly keeps a copy of those packets ends up with a location archive.

A wooden auction gavel on a dark lectern, dozens of small blank bidding paddles scattered around it, faint warm light from one side and deep shadows — Every bidder in an ad auction receives the data packet, including the ones who lose.

After that the data is bundled and resold, broker to broker, sometimes under new company names. By the end of the chain even the seller may not know where a given point came from. Legally, all of it rests on the consent you gave by tapping “Accept” the first time you opened an app, often with no real alternative but to stop using it.

Route	What happens	What travels with it	Evidence in this case
SDK inside the app	Third-party code collects data in the background	GPS position, advertising ID, device details	Datastream listing names GPS and SDKs; source apps unknown
Real-time bidding	Ad auction, every bidder gets a data packet	Advertising ID, IP address, app, device, sometimes GPS	Second data set of 40,000 apps likely came mostly from RTB, per the reporters
Resale	Brokers merge sources, rename, sell on	All of the above, combined	Datastream now trades as Datasys; Datarade as marketplace

40,000 apps in a single day

The first data set did not say which apps the points came from. In January 2025 netzpolitik.org and BR, together with WIRED, Le Monde, NRK and other partners, published a second set from the same broker: 380 million locations from 137 countries, all from one day in July 2024, and this time each point named its app. Around 40,000 apps appeared.

In Germany alone, about 795,000 phones were located that day. Near the top were two weather apps from the German company WetterOnline. Its Android app with rain radar ran on about 34,875 of those phones, often with coordinates to six decimal places, which suggests accuracy to the meter. Other well-known apps, including Tinder, Grindr and Candy Crush Saga, also showed up, but their users were apparently located only by IP address, with an error measured in kilometers. That difference matters again at the end of this article.

The WetterOnline case shows how slowly enforcement moves. The state data protection authority in North Rhine-Westphalia made an unannounced inspection and, according to netzpolitik.org in April 2026, opened fine proceedings. Its accusation: the company collected users’ location data for years without valid consent and processed it for advertising. The authority says the practice has since stopped. WetterOnline said in June 2025 that it had never “sold” GPS data, without explaining how its users’ locations reached the broker.

Date	Publication	Key finding
16 Jul 2024	Databroker Files launch	3.6 billion German locations, clinics, BND outpost, Büchel
20 Nov 2024	With WIRED: US military and NATO	Grafenwöhr, Ramstein, at least 13 sensitive sites
15 Jan 2025	Second data set	40,000 apps, 380 million points from one day
7 Apr 2026	WetterOnline	Fine proceedings by the state regulator
2 Jun 2026	Police as customers	Two German state police agencies confirm obtaining data from commercial providers
6 Oct 2026	Places of worship	More than a million points at churches, mosques and synagogues

The reporting team says it now holds more than 13 billion location points from various brokers, all received as free previews.

The pattern is familiar from the US. In 2021 a senior official of the US Conference of Catholic Bishops resigned after a Catholic publication obtained app data that pointed to his use of Grindr. The publication never disclosed where the supposedly anonymous data came from. A nameless ID led, via home and routes, to a person. If you want to see how family locator apps fit into this, our piece on how to stop sharing your location covers it.

What lawmakers did, and did not, do

In Germany the reactions were strong. The head of the parliamentary intelligence oversight committee said this was about the privacy of everyone living in the country. Germany’s consumer protection ministry said that treating personal data as a mere commodity was incompatible with data protection law. The head of Germany’s federal consumer organization said consumers were evidently at the mercy of the advertising industry.

The legal picture has barely changed. Brokers point to consent given inside apps, which regulators often consider invalid. Berlin’s data protection commissioner sees no grounds to act against Datarade under the GDPR, because the marketplace processes no data itself and only connects buyers and sellers. US brokers are hard for European authorities to reach. Germany has no law that bans the trade in location data. In the US there is no general ban either: Congress has restricted sales to a handful of countries of concern, and the Federal Trade Commission has taken action against individual brokers such as X-Mode, Gravy Analytics and Mobilewalla over the sale of sensitive location data. The WetterOnline proceedings show regulators can go after individual apps. They do not reach the market as a whole.

Reset or delete your advertising ID

The practical part comes last, and it is short. The advertising ID is what turns dots into profiles, and you can take it away. Android phones in 2026 still ship with it active, so there this is on you. On iPhone, since iOS 14.5, apps only get the IDFA if you allow tracking, which still leaves it just one tap on “Allow” away.

A single small vintage toggle switch with a round brass base on a dark wooden board, its slim lever flipped down, a small warm light on the tip of the lever while the rest fades into darkness — One switch, one minute. It takes away the brokers' easiest handle.

iPhone. Go to Settings, Privacy & Security, Tracking, and turn off “Allow Apps to Request to Track”. Apple says apps then cannot access the IDFA. If you pick “Ask App Not to Track” when an app asks, the app also loses the IDFA, and under Apple’s rules it is not permitted to track you with other identifiers such as your email address. The switch is locked for child accounts, managed devices and Apple Accounts created in the last three days.

Android. Go to Settings, Privacy, Ads, and tap “Delete advertising ID”. On some phones it sits under Settings, Google, All services, Ads instead. Google says apps then receive a string of zeros instead of an ID, on all devices with Google Play since April 2022. “Reset advertising ID” is a weaker step. It gives you a fresh ID, which cuts the link to your old profile, but a new one starts right away.

Location permissions. This matters at least as much. On iPhone, Settings, Privacy & Security, Location Services lists every app that may use your location. On Android, long-press an app, open App info, Permissions, Location. Go through the list. A navigation app needs location; a weather app works fine with a typed-in city; a game needs nothing. Where an app genuinely needs it, “While Using the App” is usually enough. Turn off “Precise Location” on iPhone, or “Use precise location” on Android, for anything that does not need meter accuracy. Android then only tells the app you are somewhere in an area of roughly three square kilometers.

What the switch cannot do

These settings remove the brokers’ easiest tool. They do not make you invisible.

Your IP address remains. The second data set showed many apps locating users by IP alone, down to a city or region. That kind of location needs neither an advertising ID nor location permission, although in the data set the advertising ID was still attached. Our guide to tracing an IP address explains how precise that is. A VPN moves that rough location to the provider’s server but does nothing against GPS read by an app; more in what a VPN really does.

An app with GPS permission and an SDK on board can still collect your location. Apple’s tracking ban is a policy developers must follow, not a technical wall against every other identifier, which is why trimming location permissions is the stronger half of the fix.

What has been sold stays sold. Points that have already been collected sit in data sets you will never see. In the EU and UK you can send an access request under Article 15 GDPR to apps that use your location; when netzpolitik.org did this with WetterOnline, data only arrived after more than a year and a complaint to the regulator, and it left questions open. Several US states give you comparable rights. Our guide to searching yourself online explains how such requests and opt-outs work.

And you cannot check the first data set anymore. The netzpolitik.org checker, which compared hashed IDs, went offline on 8 July 2026. Be wary of any site that asks you to enter your advertising ID, or pay, to find out.

Smart TVs have an advertising ID too, and many can also recognize what is on screen, see automatic content recognition.

Setting	Works against	Does not work against
iPhone: tracking requests off	Access to the IDFA, tracking under Apple’s rules	IP-based location, location collected by apps with permission
Android: delete advertising ID	The ID itself (apps see zeros)	IP-based location, other identifiers, apps with location permission
Reset advertising ID	Link to your old profile	A new profile building from now on
Location “Never” or approximate	GPS-accurate location by that app	IP-based location at city level
VPN	Location via your real IP address	GPS read by an app with permission
GDPR access request	Not knowing what an app stored	Data already resold to brokers abroad

What Google keeps in your own account is a separate question, covered in what Google knows about you.

If ads still feel like your phone overheard you, our myth check Is my phone listening to me? walks through what is actually going on.

What stays with you

The advertising ID was built so ads could find the right phone. The Databroker Files showed what the same identifier does in other hands: it turns a file without names into a map of people’s lives, and that map was handed out as a free sample. Germany’s military counterintelligence chief can only warn her soldiers about it.

You have a little more control than she does. Deleting the advertising ID takes a minute, cleaning up location permissions maybe ten. After that your phone no longer shows up on the map under one fixed label, and most apps only know which part of town you are in. The license plate came factory-fitted. Taking it off is up to you.

Sources: netzpolitik.org, Databroker Files: Company sells 3.6 billion locations of people in Germany (German), 16 Jul 2024 · netzpolitik.org, How data brokers endanger Germany’s security (German), 16 Jul 2024 · netzpolitik.org, How data brokers expose NATO and the US military (German), 20 Nov 2024 · WIRED, Anyone Can Buy Data Tracking US Soldiers and Spies to Nuclear Vaults and Brothels in Germany, 20 Nov 2024 · netzpolitik.org, New data set reveals 40,000 apps behind location tracking, 15 Jan 2025 · netzpolitik.org, WetterOnline faces fine over location data (German), 7 Apr 2026 · netzpolitik.org, German police apparently use data brokers unlawfully (German), 2 Jun 2026 · netzpolitik.org, Churches, mosques, synagogues: data brokers endanger believers in Germany (German), 6 Oct 2026 · netzpolitik.org, US senator calls in the Pentagon, German ministry demands EU laws (German), 19 Jul 2024 · netzpolitik.org, WetterOnline trickles out data (German), 20 Jun 2025 · netzpolitik.org, Databroker Checker, with note on its shutdown on 8 Jul 2026 (German) · BBC News, Senior US Catholic resigns over Grindr allegations, 21 Jul 2021 · Apple Support, If an app asks to track your activity · Google Play Console Help, Advertising ID · Android Help, Manage app location permissions

Frequently asked questions

What is an advertising ID?: A random identifier that Apple and Google assign to every smartphone out of the box so the ad industry can tell devices apart. On iPhone it is called the IDFA, and since iOS 14.5 an app can only read it if you allow tracking. On Android it is called the advertising ID or AAID and is active out of the box. It contains no name. Because many apps send it to ad partners together with location and other details, it lets those partners merge data from different apps into one profile.
Should I reset or delete my advertising ID?: Delete it if your phone offers that option. On Android, deleting replaces the ID with a string of zeros, so apps no longer get a usable identifier. Resetting only issues a new ID: the link to your old profile breaks, but a new profile starts building straight away. On iPhone the equivalent of deleting is turning off "Allow Apps to Request to Track".
Does "Ask App Not to Track" stop location tracking?: Not on its own. It blocks the app from reading the IDFA and, under Apple's rules, from tracking you across other companies' apps with other identifiers. It does not take away location permission. An app that may read your GPS position can still collect it, and every app still sees your IP address, which gives away a rough location.
What were the Databroker Files?: An investigation by the German outlets netzpolitik.org and Bayerischer Rundfunk, first published on 16 July 2024 and later extended with WIRED and other partners. It started with 3.6 billion location points from Germany that a US data broker handed over as a free sample. Every point carried an advertising ID, which made it possible to rebuild movement patterns and identify people, including staff at intelligence and military sites.
What is a data broker?: A company that buys, combines and resells information about people, usually without any direct relationship with them. Location brokers buy from apps, ad platforms and other brokers, then sell subscriptions or one-off data sets. People-search sites are a different branch of the same industry; we cover them in our guide to searching yourself online.
Can I find out whether my location data was sold?: Not reliably. netzpolitik.org ran a checker for the first data set but took it offline on 8 July 2026. In the EU and UK you can ask apps that use your location what they stored and shared, under Article 15 GDPR. In several US states privacy laws give similar access rights. None of this reaches data that has already been resold abroad.