Analysis
Commercial location data harvested through mobile apps and advertising SDKs can still pinpoint where US military personnel are, and a bipartisan group of 14 lawmakers wants the Defense Department's inspector general to explain why. Senator Ron Wyden (D-OR) and Rep. Pat Harrigan (R-NC) led the request, The Register reported.
The Pentagon has known about the exposure since at least 2016. The Army, Air Force, Navy, Marine Corps and Special Operations Command have all disabled advertising identifiers on government-issued devices. Data showing military movements keeps appearing for sale anyway. The letter offers three explanations, and they are not mutually exclusive: some DoD components only disabled the identifiers as recently as July; disabling an ad ID may no longer meaningfully limit what the location pipeline captures; and much of the data originates on the personal phones of service members and contractors, which the department does not control.
Why the technical detail matters commercially
Zach Edwards, a threat researcher at Infoblox, put the responsibility upstream: "It's truly unfortunate that Google and Apple have not effectively reformed their mobile advertising IDs." That is the operative point for anyone in adtech or mobile measurement. The identifier is only the front door. Bidstream data -- the location and device signals broadcast to every participant in a real-time ad auction, whether or not they win -- keeps flowing regardless of whether an ad ID is reset or zeroed.
Data brokers have absorbed a series of enforcement actions on this over the past three years, and the industry response has largely been contractual rather than architectural. This letter puts national-security framing on the same facts, which historically is what moves legislation that consumer-privacy framing could not.
The limit here is real: an IG request is not a bill, and inspector general reviews routinely take a year. Nothing in it constrains a broker directly. But adtech companies pricing an exit should assume bidstream location becomes a diligence line item, not a footnote, in the next twelve months.
