The IDFA is device universal, and is only reset when the user takes manual action. Apple was aware of the privacy challenges of this, and laid out the rules fo

The IDFA is device universal, and is only reset when the user takes manual action. Apple was aware of the privacy challenges of this, and laid out the rules for using IDFA in this WWDC 2014 presentation. https://developer.apple.com/videos/play/wwdc2014/715/ https://developer.apple.com/videos/play/wwdc2014/715/ It's a video with no transcript, but if you click the link to the slides, you can see on slide 7 that the lifetime of the Advertising ID is "Reset Advertising ID." Each time you submit an app binary to Apple for review, you have to click a box that solemnly swears that you're using the IDFA to attribute activity to an advertisement, proving that the advertisement did its job. "I, USER NAME, confirm…" I don't know whether the solemn vows really do anything; I get the impression that IDFA abuse is detected via privacy researchers making noise in the tech press. But it has been enforced a few times.