Device Identifier
A unique code for a phone, computer or app installation, such as an advertising ID.
A device identifier is a code that tells systems which phone, computer or app installation they are dealing with, such as an advertising ID or serial number. It lets companies recognise the same device again and again, which makes it a tracking tool.
Meaning of Device Identifier
Device and advertising identifiers allow tracking of one device over time and across apps, so when linked to a person they are personal data. Collecting them for advertising calls for notice and consent.
Device identifiers come in several forms: hardware numbers such as IMEI and serial numbers, the MAC address of a network card, operating-system advertising IDs (Android Advertising ID and Apple IDFA), app-instance IDs created at install time, push-notification tokens and browser fingerprints built from screen size, fonts and settings. Some stay for the life of the device; others can be reset by the user.
On their own they are strings of letters and digits. But under Section 2 of the DPDP Act personal data is any data about an individual who is identifiable by or in relation to it. If an advertising ID is linked to an account, email, phone number or purchase history, or if it can single out and follow one user across apps, it relates to an identifiable person. Treating device identifiers as personal data is a sound working position for any business that uses them to profile or target people.
The DPDP Act does not mention them specifically, so the usual duties apply. Collecting an advertising ID for personalised ads requires notice under Section 5 and Rule 3 and consent under Section 6, which must be free, specific, informed and unambiguous and given by a clear affirmative action. Consent for the app to work is a different thing from consent to share the ID with ad networks, and the two should not be bundled. Where children use an app, Section 9 prohibits tracking, behavioural monitoring and targeted advertising directed at them.
Device identifiers also serve legitimate technical functions: spotting fraud, stopping duplicate registrations, delivering push messages and restoring a purchased subscription. Those uses are easier to justify than cross-app advertising profiles, but they still need a described purpose and sensible retention. Platform rules, such as Apple's tracking prompt and Android's ability to reset or delete the advertising ID, work alongside the DPDP Act, not in place of it.
Examples of Device Identifier
An app collects the phone's advertising ID and sends it to an ad network.
A casual game collects the advertising ID and shares it with three ad networks. After review, it adds an opt-in prompt that explains personalised ads, and turns off ad-network sharing for players who say no or who are under 18.
An e-commerce app uses a device ID to block fake accounts created in bulk. It records this in its notice as a fraud-prevention purpose, keeps the ID for the life of the account, and does not use it for marketing.
A news app uses push tokens to send alerts. When a user turns notifications off, the publisher deletes the token and stops matching it with the reader's profile.
Why Device Identifier matters
Identifiers are the glue for tracking networks. A single advertising ID shared with several partners lets them stitch together browsing, app use, location and purchases into one profile. If that happens without valid consent, the organisation risks complaints, a penalty of up to ₹50 crore for general breaches, and, where children are involved, up to ₹200 crore for failing the Section 9 obligations.
There is also a practical problem. App stores and operating systems increasingly require disclosure of tracking, and poor disclosure leads to removal or rejection of apps. Clean practice on identifiers protects distribution as well as legal standing.
How it works in practice
- 1Inventory all identifiers your app, website and SDKs collect. Review the code and network traffic; teams are often surprised by what third-party libraries gather.
- 2Separate purposes. Use an app-instance ID for functionality and fraud checks, and ask for advertising permission separately, with a clear explanation.
- 3Honour reset and opt-out. If a user resets or deletes the advertising ID or turns off personalisation, make sure your systems stop using the old ID and do not link the new one to it.
- 4Limit sharing. Contract with ad and analytics partners so that they use the ID only for the stated service, do not combine it with other data and delete it on request.
- 5Set expiry. Remove old IDs for uninstalled apps and inactive users, and delete linked profiles when consent is withdrawn.
- 6Do not use identifiers for children. Block advertising IDs in child-directed features and avoid behavioural analytics there.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming a random-looking ID is anonymous. If it can follow one device and be tied to a user, it is personal data.
Relying on a single "I agree" at install for everything. Consent must be specific to each purpose and withdrawable.
Ignoring SDKs. Your organisation answers for what the libraries inside its app collect.
Keeping device IDs after uninstall. Old IDs on file without a purpose should be deleted.
Compliance tips
Scan your app releases with a network inspection tool every quarter to find new identifiers and endpoints.
Hash or tokenise identifiers before they reach internal analytics wherever possible.
Write the identifier types into your notice using ordinary words, such as "a code that identifies your phone".
Give users a settings page where they can see and switch off personalised advertising.
Common questions about Device Identifier
Is a device ID personal data?
It can be. If it is linked to an account or used to track and profile one person over time, it relates to an identifiable individual. Treat device identifiers used for advertising or [profiling](term/profiling) as personal data.
Do I need consent to collect the advertising ID?
For personalised advertising, yes: you need a clear notice and consent that is specific and unbundled under Sections 5 and 6. For fraud prevention or app functions, you should still disclose the use in your notice.
Is an IMEI number personal data?
An IMEI identifies a handset, and if a telecom provider or seller can link it to a subscriber or owner, it relates to an identifiable person. Apps should not collect it unless there is a clear and lawful need.
What happens if I reset my advertising ID?
A new ID is created and old profiles should stop matching you. Companies must not link the new ID to the old one. If they do, that practice may breach the consent and purpose duties under the Act.