Inside the de-anonymization industry, where companies buy pseudonymized datasets with mobile advertising IDs and unmask the identities of people in the datasets
Unique IDs linked to phones are supposed to be anonymous. But there's an entire industry that links them to real people and their address. Tweets: @counternotions , @bergmayer , and @mjgault Tweets: Kontra / @counternotions : “Unique IDs linked to phones are supposed to be anonymous. But there's an entire industry that links them to real people and their address.” (Welcome to America, don't drink the water!) https://www.vice.com/... John Bergmayer / @bergmayer : these companies need to be legislated and sued out of existence https://www.vice.com/... Matthew Gault / @mjgault : doxing. at scale. a lovely growth industry. https://www.vice.com/...
Context & Ripple Effects
This VICE investigation lands in a documented arc of exposure around the mobile data supply chain. The Markup had already mapped how collectors, aggregators, and marketplaces monetize the roughly $12B location data industry, and back in 2019 Motherboard showed T-Mobile, Sprint, and AT&T selling real-time device location to middlemen for pocket change.
What VICE adds is the missing layer: the re-identification step that makes every downstream dataset personally dangerous. That layer is no longer hypothetical — Mobilewalla later confirmed in a letter to Sen. Wyden that its data fed warrantless tracking by DHS, the IRS, and the US military, and Bloomberg's reporting on Rayzone's Echo system showed ad-derived data being packaged into government surveillance tools.
First-order effects
- Data brokers and the buyers of pseudonymized mobile ad ID datasets — including government agencies exposed in the Mobilewalla letter — now face documented evidence that their 'anonymous' inputs are trivially reversible, sharpening the legislative case John Bergmayer and other advocates are pressing.
- Advertisers and app developers whose SDKs generate these unique IDs are implicated as unwitting upstream suppliers of the raw material for what Matthew Gault calls doxing at scale.
Second-order effects
- Regulators already engaged with this supply chain, notably Wyden's office after the Mobilewalla disclosure, gain concrete evidence that pseudonymization fails as a privacy safeguard — pushing pressure from location data specifically toward advertising identifiers generally.
- Companies in the $12B location data pipeline described by The Markup face a branding and compliance problem: any dataset marketed as anonymized becomes legally and reputationally contestable if de-anonymization firms can reverse it.
Third-order effects
- If the pattern holds — brokers feeding agencies, ad IDs anchoring surveillance tools like Rayzone's Echo — the durable outcome is regulators treating pseudonymized identifiers as personal data rather than a safe harbor, restructuring how the entire ad-tech and broker ecosystem can sell mobility data.
- The NYT's observation that online anonymity is becoming a threatened privilege rather than a right points toward a structural split: identity infrastructure controlled by a few platforms, with de-anonymization capability concentrated among those who buy it.
The trend: Mobile advertising IDs are being revealed not as an anonymity layer but as the backbone of a de-anonymization industry spanning brokers, advertisers, and government surveillance buyers.