privacy terms-of-service
Facebook does not obey the Google Play&#39;s central opt out of the Ad ID
<p>Facebook states in this <a href="https://developers.facebook.com/docs/audience-network/faq#a17" rel="nofollow noreferrer">Terms and services</a> that it respects Google plays advertising id: </p>

<blockquote>
  <p>Yes, the Audience Network SDK for Android uses the Advertising ID and respects its limit tracking option in accordance with Google Play's terms and conditions. </p>
</blockquote>

<p>I checked it by sniffing its traffic, and it is true. But it is striking that it does not obey google plays opt-out mechanism:</p>

<p><a href="https://i.stack.imgur.com/PANYZ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/PANYZ.png" alt="enter image description here"></a></p>

<p>I still could see that it used the IDFA Header even after opting out.</p>

<pre><code>https://graph.facebook.com/network_ads_common/
MAKE:               LGE
IDFA_FLAG:          1
APPVERS:            1.1.10
ATTRIBUTION_ID:     
NUM_ADS_REQUESTED:  1
CARRIER:            
SDK:                android
SCREEN_HEIGHT:      592
VIEWABLE:           1
ADAPTERS:           AN
REQUEST_TYPE:       0
SDK_CAPABILITY:     [3,4,5,7,11]
CLIENT_EVENTS:      
COPPA:              false
PLACEMENT_ID:       ????
SDK_VERSION:        4.7.0
TEMPLATE_ID:        200
OS:                 Android
BUNDLE:             ???
DENSITY:            2.0
APPNAME:            ???
OSVERS:             4.4
SCREEN_WIDTH:       384
SCHEMA:             json
PLACEMENT_TYPE:     native
APPBUILD:           10
LOCALE:             en_GB
MODEL:              Nexus 4
IDFA:               a6a1bca3-1f90-408e-8a9b-960ba26aa60a
</code></pre>

<p>So is that behavior legal from Facebook and can I do something about that?</p>

<p><strong>Edit</strong>
It seems that they need to obey the opt out mechanism:</p>

<blockquote>
  <p>Usage. The Android advertising identifier must only be used for advertising and user analytics. The status of the “Opt-out of Interest-based Advertising” setting must be verified on each access of the ID.</p>
</blockquote>

<p>From:  <a href="https://play.google.com/about/developer-content-policy.html" rel="nofollow noreferrer">Google Play Developer Programe Policies</a></p>

<p>This question expresses two misconceptions:  first being that the terms of service agreement language cited governs whether Facebook uses the ID "at all," and in fact they likely need to use the ID to identify BOTH users who are opt-in, AND users who are opt-out.  So the ID is going to be present regardless...and second, that presence of the ID notwithstanding,this is not a question of "legality."  Ignoring their own terms of service is not "against the law," it's "against the contract."</p>
