Anyone with a seat on a prominent ad exchange gets access to the millions of requests per second that include IDFA/AAID, a timestamp, the request source (e.g. a

Anyone with a seat on a prominent ad exchange gets access to the millions of requests per second that include IDFA/AAID, a timestamp, the request source (e.g. app or web URL) and the likely location of the device to be used as a targeting option-- in some cases the device's phone number may even be populated in requests. Anyone with the resources can store (probably violating exchange's TOS) this firehose of data and do something similar. De-anonymizing the IDFA/AAID is probably pretty trivial, so who knows who else has this information-- essentially anyone posing as a DSP or advertiser on an exchange.