Topic starter
02/08/2026 12:14 pm
TL;DR: Mobile app fingerprinting can uniquely identify devices and users by combining analytics, advertising and telemetry signals, even without login, according to NowSecure’s analysis. Persistent identifiers and SDK-driven data flows turn routine app behaviour into privacy, compliance and enterprise liability risk.
Editorial analysis by NHI Mgmt Group, based on content published by NowSecure: “Inside Mobile App Fingerprinting: What Your Apps Know About You”.
Key questions
Q: What breaks when mobile apps combine analytics and advertising data into a fingerprint?
A: The control that breaks is the assumption that individual data points are harmless in isolation.
Q: Why do advertising IDs and SDKs increase tracking risk in mobile apps?
A: Because they create a reusable link between sessions, devices and services.
Q: What signs show that a mobile app is over-collecting identity signals?
A: Watch for repeated device identifiers, unexpected calls to ad or analytics endpoints, unusual volumes of pre-login network requests, and telemetry that includes network, battery or storage details without a clear product need.
Practitioner guidance
- Map mobile app telemetry to identity signals Catalogue advertising IDs, device attributes, session tokens and SDK outputs, then decide which combinations create persistent identity risk.
- Test live network traffic before release Use dynamic analysis to inspect the actual requests, headers and endpoints an app uses in production-like conditions.
- Review every third-party SDK for tracking scope Require owners to document which SDKs receive behavioural, device and location data, and whether each use is disclosed.
Bottom line: Mobile fingerprinting turns ordinary telemetry into a persistent identity mechanism that privacy notices may not fully capture.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:17 pm
Mobile fingerprinting is an identity governance problem, not just a privacy nuisance. When telemetry, advertising IDs and SDK outputs are merged into a stable profile, the app is effectively creating a non-human tracking mechanism that behaves like an identity system. That means AppSec and privacy teams must treat signal combination, not only data disclosure, as the control boundary. The practitioner conclusion is simple: identity risk is being generated inside the app runtime.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should privacy and AppSec teams approve mobile apps that use tracking SDKs?
A: They should require runtime evidence of what the app actually transmits, then compare it with the declared privacy model and approved data uses. If the live traffic shows richer identity signals than the notice implies, the app should not pass review until the collection scope is reduced, documented or explicitly accepted.
👉 Read our full editorial: Mobile app fingerprinting exposes identity, privacy and compliance risk