Notifications
Clear all
Topic starter
02/08/2026 12:14 pm
TL;DR: Mobile app fingerprinting can uniquely identify devices and users by combining analytics, advertising and telemetry signals, even without login, according to NowSecure’s analysis. Persistent identifiers and SDK-driven data flows turn routine app behaviour into privacy, compliance and enterprise liability risk.
NHIMG editorial — based on content published by NowSecure: mobile app fingerprinting and the privacy and compliance risk it creates
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities 46% confirmed, 26% suspected.
Questions worth separating out
Q: What breaks when mobile apps rely on fingerprinting instead of clear identity controls?
A: Fingerprinting breaks the boundary between intended service use and covert correlation.
Q: Why do advertising IDs and device IDs create governance risk for mobile teams?
A: They create governance risk because they act like shared identity keys across services, making it easier to profile a person or device over time.
Q: How can security teams tell whether a mobile app is collecting too much identity-linked data?
A: Look for repeated identifiers, SDKs that send device characteristics, and outbound requests that continue before login or after consent changes.
Practitioner guidance
- Map every identifier to a business purpose Catalogue advertising IDs, device IDs, local network fields and behavioural telemetry, then require a documented purpose for each field before release.
- Inventory third-party SDK data flows Review analytics, advertising and monetisation SDKs for the exact data they collect, where they send it and whether that data can be recombined into persistent tracking.
- Add fingerprinting tests to mobile release gates Run dynamic and network testing in CI/CD to detect persistent identifiers, repeated cross-app values and unexpected outbound telemetry before apps are approved for production.
What's in the full article
NowSecure's full analysis covers the operational detail this post intentionally leaves for the source:
- Packet-level examples showing which requests carried persistent identifiers and which endpoints received them
- Step-by-step testing methods using Burp Suite on Android to reproduce the tracking behaviour
- App-by-app comparison of Duolingo, Tubi and Block Puzzle telemetry patterns
- Practical mobile privacy controls such as advertising ID reset, DNS-level blocking and VPN routing
👉 Read NowSecure’s analysis of mobile app fingerprinting and tracking risk →
Mobile app fingerprinting: what it means for AppSec and privacy teams?
Explore further
02/08/2026 1:17 pm
Mobile fingerprinting is an identity governance problem, not only a privacy problem. When applications combine telemetry, advertising and analytics, they create a shadow identity layer that sits outside formal IAM and consent workflows. That layer can outlive a session, cross app boundaries and evade ordinary access review logic. Practitioners should treat mobile tracking as governed identity data, not merely as marketing instrumentation.
A question worth separating out:
Q: Who is accountable when mobile fingerprinting creates privacy or compliance exposure?
A: Accountability usually sits with the product owner, app engineering, privacy function and security reviewers together, because fingerprinting emerges from design choices across teams. If the app collects and shares identity-linked data without clear purpose limitation, the organisation owns the risk even when third-party SDKs help create it.
👉 Read our full editorial: Mobile app fingerprinting exposes identity, privacy and compliance risk
