Why the U.S. Military Is Turning Off Ad Trackers on Troops’ Devices

Commercial location data is now an operational-security concern, not just a consumer-privacy issue. U.S. Central Command said it had received multiple threat reports involving adversaries’ exploitation of commercially available location data to target or surveil U.S. personnel in theater. In response, military organizations reported disabling advertising identifiers on government-managed devices. 35

What the military changed

The public disclosures describe different timelines and device scopes rather than one clearly documented, uniform Pentagon-wide rollout.

• Air Force: It told Sen. Ron Wyden that advertising identifiers had been disabled on both computers and mobile phones about two months before the September 4 disclosures. 5
• U.S. Special Operations Command: SOCOM said it had “recently” disabled the identifiers on its Windows devices. Its disclosed statement was limited to Windows systems, not all issued mobile devices. 5
• Army: The Army said mobile-device advertising identifiers had been disabled earlier in 2026. It also said Windows advertising IDs had been blocked since before 2021, and that the setting was disabled by default on Apple and Android devices from at least February 2026. 22
• Navy and Marine Corps: Reporting on the letters says the Navy and Marine Corps were among the organizations that disabled advertising tracking on government-issued devices. The available public summaries do not provide separate, service-specific timing and device-scope details comparable to those disclosed by the Air Force, SOCOM, and Army. 21

This is a notable change from the spring. In material released by Sen. Martin Heinrich, CENTCOM said the advertising ID was still enabled on DoD-issued smartphones and that the Defense Information Systems Agency was testing a capability to disable it. CENTCOM had also only recently gained the ability to administratively disable location sharing on the smartphones it managed. 12

How ad-tech data becomes a troop-tracking risk

Advertising identifiers are device-level identifiers used by advertising systems to recognize a device for measurement and targeting. App-based advertising profiles can include location-related signals. Those data streams may be collected, aggregated, and sold in commercial markets rather than extracted from a military network. 13

That changes the threat model. An actor seeking to monitor personnel may not need to compromise a government system or conduct continuous physical surveillance. Commercial data can potentially reveal devices repeatedly observed around a sensitive site and help analysts study movement patterns over time. CENTCOM’s threat reports show that military officials considered this possibility sufficiently credible to warrant operational safeguards. 313

Turning off an advertising identifier can reduce one channel through which a managed device participates in ad-tech tracking. It should not be interpreted as making a phone untrackable. CENTCOM’s own guidance warned that disabling geolocation capabilities does not always fully disable them on commercial products, and urged users to review device and app privacy settings and limit public sharing. 13

Why the concern persisted

The vulnerability was not newly discovered in 2026. NSA and CISA had recommended disabling advertising IDs on iOS and Android devices for years, according to the congressional material released by Heinrich. Yet CENTCOM acknowledged in the spring that the setting remained enabled on government-issued smartphones. 12

The gap illustrates a broader problem with commercially collected data: protections that rely on a single setting, a single device-management policy, or a user’s manual choices can leave other signals available. Personal phones, app permissions, browsing behavior, and information shared publicly can each remain relevant to operational security. 113

The protections lawmakers wanted next

Congressional calls to the Pentagon went beyond switching off identifiers on official hardware. The requested safeguards included:

• disabling advertising IDs on DoD devices;
• restricting location sharing;
• addressing risks from service members’ personal devices; and
• moving away from or limiting Chrome on military devices, reflecting concern about web-based collection and profiling. 13

The central limitation is scope. Government device controls can reduce exposure from equipment the military manages, but they cannot by themselves prevent commercially collected data from personal phones or other digital activity from being linked to deployed personnel. The policy challenge is therefore broader than ad IDs: it is how to limit the collection, sale, and correlation of location and behavioral data that can reveal sensitive routines. 313