What are the privacy implications of IDFV?
Apparently, iOS 6 introduced IDFA, "identifier for advertisers", which identifies your device so that advertisers can track you and send you ads. It appears they also introduced IDFV, "identifier for vendor".
How do IDFA and IDFV work? What exactly do they identify? Are they different for each app on your phone, or are they the same for all apps on your phone?
What are the privacy implications of IDFA and IDFV? Can they be used to track you? How do they compare to UDID and to cookies on the web, as far as the privacy impact?
Do users have any way to tell which apps are gathering this information? Also, if you set "Limit Ad Tracking" to On in settings, what happens under the covers? How does that change what information apps receive?
Ars Technica has an article with an overview of IDFA and IDFV. It explains how these new mechanisms provide users with greater control over their privacy. IDFA is a persistent identifier that is consistent across all apps, and thus allows cross-app tracking. However, users can disable IDFA by setting "Limit Ad Tracking" to On. IDFV is a persistent identifier that is different for each app. This still allows tracking of users, but does not allow correlating your activities with one app against your activities with another app. The comments on that article clarify that, if the user sets "Limit Ad Tracking" to On, then this sets a global flag (advertisingTrackingEnabled) that advertising code is supposed to check before reading the IDFA. Advertisers are supposed to write their code to check this global flag and not collect the IDFA if it is set (though there is no technical measure that prevents them from doing so; they are in their honour). Thus, in this sense it is vaguely akin to the "Do Not Track" flag. Technically, it would be possible for an advertiser to still collect the IDFA even if the user has set "Limit Ad Tracking" to On. We have to hope that Apple has a way to detect that and would ban the advertiser from the app store.