What is the best practice to identify id or something unique from android device without violating google play policies? I noticed that androidID is removed from device_info_plus, and when tested on android SDK 29+ it return null.
Best way to define unique android ID for SDK 29+, device info plus android ID removed/null
Viewed 36
1 Answers
You can use UUID generated by yourself along with the user-id for this purpose.
We use this policy because MACs can be randomized. Even if Device is same, the MAC can change.
So, use ${userId}-${UUIDForDevice}. That way, the user device is uniquely tracked. Once the UUIDForDevice is generated, store it in the secure storage. When user logs in, send the ${userId}-${UUIDForDevice} in the header.
Even if the user deletes the app and installs again. We are safe, because the app has lost authorization so, user will start from fresh. The change in the UUIDForDevice will pose no threat to us. User will have to verify himself again for that.
Everyone uses the similar approach. So, it's okay to use it as such. Otherwise, consider using the OpenIDConnect protocols for resource authorization, app authorization as such if needs be.
Related