The same data pipeline that serves you sneaker ads after browsing Nike’s website was reportedly being used to track American troops in a live Middle East combat zone. Mobile advertising identifiers — unique device codes (IDFA on iPhones, AAID on Androids) that let apps and data brokers map your location and sell it to virtually anyone — turned out to have a grim second market. During Operation Epic Fury, according to Reuters and CENTCOM materials, commercially purchased location data was reportedly used to secretly tracking users or surveil U.S. forces in theater. The military’s response: disable those identifiers on government-issued devices. The gap between that decision and when it should have happened spans years.
The Timeline Is the Scandal
The Army blocked ad identifiers on Windows PCs before 2021 — soldiers’ government-issued iPhones and Androids had to wait until February 2026.
The branch-by-branch timeline tells the story plainly:
- Army disabled ad IDs on Windows before 2021; mobile devices followed only in February 2026
- Air Force disabled identifiers on computers and phones roughly mid-2026
- SOCOM and Navy both confirmed the action — SOCOM recently on Windows only, Navy with no timeline offered
Bipartisan lawmakers set an October 2 deadline for DoD Inspector General Platte B. Moring III to formally respond. None of these changes were proactive policy. They were a reaction.
Sen. Ron Wyden’s assessment cuts through the Pentagon’s careful non-statements: military efforts “have not been effective at neutralizing this threat.” The reason sits in every soldier’s back pocket — their personal phone. Contractors, support staff, and service members carry personal iPhones and Androids onto bases and into operational areas. Those devices still broadcast advertising identifiers. Data brokers are still selling location pings tied to them. Fixing the government phone addresses only part of the exposure.
Turning Off the Tracker Doesn’t Make You Invisible
Even without an advertising ID active, a device can still be located — just through entirely different signals.
Privacy technologist Zach Edwards, co-founder of Decryptads, called disabling ad identifiers “definitely a positive thing” — it keeps troops out of bulk commercial data sets. But the fix has real limits. Think of it like turning off location sharing on an app while the platform still registers your home Wi-Fi network. The advertising ID disappears; the device fingerprint, IP address, and app behavior remain. Adversaries with enough data and processing power can still connect the dots through a surveillance app or similar tool.
Rep. Pat Harrigan framed the policy problem directly: U.S. enemies “should not be able to pull out a credit card and buy location data that helps them track American troops.” Harrigan and Wyden’s bipartisan letter to the Inspector General also pushed for privacy-focused browsers pre-installed on government devices. The Pentagon is staying quiet publicly — it will respond to Congress directly.
Disabling an ad identifier on an official phone is a patch on a structural wound. The data-broker market exists because surveillance capitalism turned your location into a tradeable commodity — and no one drew a line around military bases. Until Congress constrains who can buy and sell that data, the credit card stays on the table. The Inspector General’s October 2 deadline is the next moment of accountability.
