Quick answer
A device ID is an identifier used to recognize a specific device over time. It can be an operating-system advertising ID (IDFA, Android advertising ID), a vendor- or app-scoped ID, or a random ID generated by an app or SDK at install.
What is a device ID?
A device ID is an identifier that distinguishes one phone, tablet, computer or other device from others. In apps and analytics, it lets a service recognize that events came from the same device over time: the same install opening the app on Monday and again on Friday.
"Device ID" covers several different identifiers with very different scopes and privacy rules. Some are set by the operating system for advertising, some are scoped to one app vendor, and many analytics SDKs simply generate a random ID when the app is first opened.
Types of device identifiers
| Identifier | Platform | Scope | Resets when | Consent and policy |
|---|---|---|---|---|
| IDFA (Identifier for Advertisers) | iOS | Shared across apps, for advertising | User resets it in settings | Needs App Tracking Transparency permission since iOS 14.5; zeros otherwise |
| IDFV (Identifier for Vendor) | iOS | All apps from one developer on a device | All of that vendor's apps are removed | No ATT prompt; not for cross-company tracking |
| Advertising ID (GAID / AAID) | Android | Shared across apps, for advertising | User resets or deletes it | Google Play policy limits use; returns zeros after the user deletes it |
| Android ID (SSAID) | Android | Per app signing key, user and device (Android 8+) | Factory reset or signing key change | Not for advertising |
| App-generated install ID | Any | One install of one app | Reinstall or clearing app data | Depends on what you store with it |
| Hardware IDs (IMEI, MAC, serial) | Any | Permanent | Never | Restricted by modern OS versions; avoid |
On the web there is no operating-system device ID. Websites use cookies, local storage or server-side visitor IDs, and fingerprinting combinations of browser attributes; see first-party cookie and browser fingerprinting.
How analytics uses device IDs
- Counting devices. Daily and monthly active devices are distinct device IDs with activity.
- Stitching sessions. Events from the same device across launches belong to one history.
- Linking to users. When someone logs in, the device ID is bound to the user ID, so earlier anonymous activity can be attributed to that person; see identity resolution.
- Deduplicating. One person with a phone and a laptop is two devices but one user.
Example from a sample week:
| Count | Value | Why it differs |
|---|---|---|
| Visitors (web, anonymous) | 18,400 | Browsers without login, no cross-device link |
| Devices (app, install IDs) | 6,200 | Each install counted once |
| Users (logged in) | 4,900 | 1,300 devices belong to people with more than one device |
Device IDs and privacy
Under the GDPR and similar laws, a device ID is generally treated as an online identifier and therefore personal data when it can be linked to a person. That means you need a lawful basis (often consent) before reading or storing it for analytics or advertising, should tell users about it, and must honor deletion requests. Practical rules:
- Prefer app-scoped, randomly generated IDs over advertising or hardware IDs for analytics.
- Do not read advertising IDs unless you actually need them for advertising and have permission.
- Delay writing any persistent ID until consent where required.
- Hash or avoid storing other identifiers alongside it; see hashing and pseudonymization.
Common problems
- Reinstalls inflate device counts. An app-generated ID changes on reinstall, so one person can appear as several devices.
- Shared devices (family tablets, store kiosks) merge several people into one ID.
- Emulators and test devices pollute counts unless filtered.
- Zeroed advertising IDs (all zeros) when users opt out are not unique and must not be used as identifiers.
In TapCub
TapCub counts in three layers: visitor, device and user. The website script does not write a device ID; anonymous web visitors are counted with a visitor ID derived on the server. App and mini-program SDKs write a persistent device ID only when the project is in identified mode, at collection tier 3, and with analytics consent; in anonymous mode they still send events but do not store a device ID and ignore identity calls. The identity map compares visitor, device and user counts for a date range so you can see how many extra devices identity removed. See identified vs anonymous and cross-device merge.
Sources
- Apple Developer. App Tracking Transparency.
- Android Developers. Best practices for unique identifiers.
- Article 29 Working Party. Opinion on device fingerprinting (WP224).
Was this explanation clear?
We use your answers to fix and expand this page.
Couldn’t send. Please try again in a minute.
Thanks for the feedback. We’ll use it to improve this page.You’ve already sent feedback on this page. Thanks.
Technical Engineer
Focuses on tracking code, SDKs, and API integrations, with practical guidance on implementation checks and troubleshooting.