Identifiers used for personalized ads in smartphone apps have become a military security issue. It has been confirmed through an official letter and a Reuters report that several U.S. military organizations have disabled advertising identifiers on government-issued smartphones and computers.
Behind this lies commercial location data collected by the advertising industry and traded through data brokers. U.S. Central Command confirmed that there have been reports of hostile foreign actors using such data to track and target U.S. military personnel.
This measure isn't just a simple change to your privacy settings. Advertising data is operational security, that is, OPSECIt is important to note that the assessment that this could serve as a point of attack was actually reflected in the government's device policy.
| The effective dates varied by military branch
According to the released data, each military branch implemented ad identifier blocking at different times and in different ways. The U.S. Air Force enforced the settings on iPhones and iPads at the organizational level and applied the blocking policy to Windows and Android enterprise devices as well. The official letter states that by 2026, July 23 Start applying July 27 It says that the deployment of the troops is complete.
The U.S. Army told Reuters that it has been blocking advertising IDs in government-issued Windows environments since before 2021 and has blocked them by default on Android and Apple mobile devices since at least February 2026. The Army’s letter stated that the same policy applies across managed app environments and government-issued devices.
The U.S. Special Operations Command stated that it blocks mobile advertising identifiers on managed Android and iOS devices and recently disabled related identifiers on Windows systems as well. The Navy also confirmed that it uses blocking as a standard security procedure on government-issued devices and in managed app environments.
| What is MAID, and why is it linked to location data?
MAIDstands for Mobile Advertising ID, which is an identifier assigned to mobile devices for advertising and performance measurement. It can be used to link activity records scattered across different apps to the same device, so When various data sets are combined, they can serve as the key to consolidating long-term travel patterns into a single profile.
The advertising identifier itself is not a sensor that tracks location. However, when combined with an app’s location data or data generated during ad transactions, it becomes easier to piece together the movement history of a specific device.
Turning off identifiers can help reduce these connections. In its official response, the U.S. Navy explained that blocking advertising identifiers helps limit the generation of commercially sold bulk location data and metadata.
| A New Security Risk Created by Data Brokers
In the past, sophisticated location tracking was considered a field reserved for intelligence agencies and telecommunications network operators. But now, data from various apps and advertising systems can be sold like a commercial product through intermediaries.
In this structure, This raises the possibility that an attacker could identify sensitive movement patterns from data available on the civilian market without having to directly infiltrate the military's internal systems. The reason the U.S. military blocked advertising identifiers at the device level was also to reduce these indirect exposure pathways.
Senator Ron Wyden and Representative Pat Harrigan have asked the Department of Defense Inspector General to investigate just how effective existing policies and technical controls actually are. Given that sales of commercial data continue to be identified, they believe it is difficult to conclude that the problem has been resolved simply by making policy changes.
| Blocking alone won't make all tracking disappear
Disabling the advertising identifier is an important defensive measure, but it's not a complete solution. A privacy expert quoted by Reuters pointed out that when combined with information from other devices, network data, or location data collected by apps, more sophisticated forms of tracking could still be possible.
In particular, smartphones brought in personally by soldiers and contractors—rather than government-issued devices—could pose a separate security risk. An official letter from lawmakers also requested confirmation as to whether the commercial location data continuously being detected at Department of Defense facilities originated from personal devices.
Therefore, blocking advertising IDs should be viewed as just one of several protective measures. App permission management, policies for personal devices in sensitive areas, and security reviews during the data collection and procurement phases must work together to maximize effectiveness.
| An Example of How Personal Information Protection Has Expanded to Operational Security
The shift revealed by this measure is that the line between privacy and national security is becoming blurred. While ordinary advertising data may seem of little value when viewed on an individual basis, when aggregated on a large scale and linked to specific times and locations, it can reveal the activities of sensitive organizations.
There’s a similar lesson for businesses. In places where the mere exposure of a location can pose a risk—such as research facilities, data centers, and critical supply chains— Advertising and diagnostic identifiers on work devices, as well as app permissions, need to be addressed as part of security settings.
However, it may not be appropriate to apply the rules of the military environment directly to civilian employees. It is important to strike a balance by considering both the organization’s risk level and the likelihood of a personal data breach, and implementing controls only to the extent necessary.
| Growing Pressure to Regulate Data Brokers
Simply changing device settings won't eliminate the very structure in which data is already being traded on the market. This incident once again highlights why transparency and oversight are needed regarding what information data brokers collect and to whom they sell it.
Ad tech companies and app developers also We need to verify that location data is retained only for the necessary period and within the necessary scope. If it is possible to reconstruct the same profile using other identifiers even after a user has restricted ad tracking, the policy may lose its effectiveness.
As more national security cases come to light, calls to restrict the sale of commercial location data, regulate the handling of data related to sensitive locations, and strengthen government procurement standards are likely to grow.
| Points to Review Going Forward
Senators Wyden and Harrigan asked the Department of Defense Inspector General to review the effectiveness of existing responses and October 2, 2026They asked us to provide a plan for the investigation up to that point. The next issue is whether the inspector general will actually launch an investigation and whether the scope will be expanded to include personal devices and contractors.
It is also important to understand how each military branch verifies the scope of the blocking settings and whether they are being followed. This is because even if there are policy documents in place, gaps can still arise depending on the device type, operating system, and whether the device is subject to management.
This change signals that advertising identifiers are now being viewed not merely as marketing tools, but as data links that must be managed for security purposes. Going forward, verification results showing whether commercial location data has actually decreased will be more important than announcements about policy changes.
Tags
#U.S. Military #Cybersecurity #Privacy Protection #Advertising Identifier #MAID #Location Information #DataBroker #Mobile Security #Operational Security #OPSEC #Information Security #Security and Privacy
