In this case study, US monetisation and promotion company W3i explains how it tested one workaround.
With the release of iOS 5 in October 2011, Apple has deprecated the use of the 'uniqueIdentifier' property on UIDevice (the uniqueIdentifier property is commonly referred to as UDID).
Apple's Developer documentation states:
Deprecated in iOS 5.0
uniqueIdentifier: An alphanumeric string unique to each device based on various hardware details. (read-only) (Deprecated in iOS 5.0. Instead, create a unique identifier specific to your app.)
Apple proposes that developers create their own app-specific unique identifier. However, this proposed replacement is not effective when trying to track users across multiple apps.
A solution
Listening to other developers discuss alternatives to UDID, the most common solution mentioned is to use the MAC address of the iOS device's Wi-Fi network interface as a replacement for UDID.
Wikipedia on MAC Address:
A Media Access Control address (MAC address) is a unique identifier assigned to network interfaces for communications on the physical network segment.
MAC addresses are used for numerous network technologies and most IEEE 802 network technologies including Ethernet.
Logically, MAC addresses are used in the Media Access Control protocol sub-layer of the OSI reference model. MAC addresses are most often assigned by the manufacturer of a network interface card (NIC) and are stored in its hardware, the card's read-only memory, or some other firmware mechanism.
Key considerations
Will capturing Wi-Fi MAC address cause Apple to reject an app?
Is it possible to reliably capture Wi-Fi MAC address on all iOS devices?
How unique is Wi-Fi MAC address across iOS devices?
Research
The purpose of our Wi-Fi MAC address research effort was to determine if Wi-Fi interface MAC address can be captured reliably across multiple device types and with different configurations (Airplane mode, Wi-Fi off/on, not in range etc.).
Our test was performed by adding code to one of our proprietary apps, AppAllStar, that collected MAC address upon application launch.
The app was approved on 5 October and re-approved on 10 October to correct some non-test related app errors.
During the timeframe of 10/05 10/22, we collected MAC addresses on 78,662 devices. To understand uniqueness, we compared the MAC address against the UDID that was also collected.
Findings
Will capturing Wi-Fi Mac address cause Apple to reject an app?
No. We successfully submitted AppAllStar twice with an explicit intent on collecting the Wi-Fi Mac address. We made it obvious that this is what we were doing by placing the code at a very high level while also naming the classes appropriately using Wi-Fi Mac address.
Is it possible to reliably capture Wi-Fi MAC address on all iOS devices?
Yes, we captured 100 percent of the MAC addresses on over 78,000 devices. The test captured this information from iPhone, iPod touch, and iPad devices spanning multiple iOS versions.
How unique is Wi-Fi MAC address across iOS devices?
Out of the 78,662 devices 99.96 percent of them returned unique addresses.
Thirty-three devices had duplicated Wi-Fi addresses. It is suspected that the devices that are duplicated are possibly hacked (jailbroken) devices or knock-off devices; of those thirty-three devices there is a subset that has a spoofed UDID meaning UDID is not 100 percent accurate.
Below is a breakdown of the country origin for the duped devices as it is rather interesting.
Recommendations
Based on the 99.96 percent accuracy rate, W3i recommends the following:
- App publishers continue to collect and store UDIDs
- Begin collecting and storing Wi-Fi MAC address with the associated UDID
- Modify application logic to use both UDID and Wi-Fi MAC address
By completing the above steps as soon as possible, app publishers will ensure user tracking capabilities are not interrupted when and if Apple moves the UDID property from deprecated to a restricted or removed state.
Remember to continue to follow privacy best practices by providing disclosures giving the users consent, choice and control.
You can find out more about working with W3i via its website.
