How and why have U.S. military branches disabled advertising identifiers on government issued phones and computers after adversaries used commercially available app derived location data to target or surveil U.S. personnel in the Middle East; what did the Air Force, Special Opera

U.S. military organizations have begun disabling advertising identifiers—unique IDs used by ad-tech systems—on some government phones and computers because commercial location data associated with those IDs can be bought, analyzed, and used by hostile actors to identify and follow deployed personnel. The changes reduce one important source of location leakage, but they are not a complete solution, especially for personal devices and other tracking methods. 7

What changed, by organization

• Air Force: Told Sen. Ron Wyden it had disabled advertising identifiers on both its computers and mobile phones about two months before the September 4 disclosure. 7

• U.S. Special Operations Command (SOCOM): Said it had “recently” disabled the identifiers on its Windows devices; its stated scope was therefore Windows computers, not necessarily all SOCOM-issued mobile devices. 7

• Army: Said mobile-device advertising IDs had been disabled earlier in 2026. It further said Windows advertising IDs had been blocked since before 2021, while Apple and Android mobile devices had the setting disabled by default since at least February 2026. 7

• Navy: Its letter to Wyden said advertising IDs on military devices had been disabled, but did not specify when the restriction began. The Navy did not respond to Reuters’ subsequent request for comment. 7

• Marine Corps: The available evidence does not establish a specific Marine Corps timeline or scope. Insufficient evidence. The public disclosures describe actions by several services and commands, not a confirmed, uniform Pentagon-wide rollout. 7

These developments followed CENTCOM reports of multiple threats involving adversaries’ exploitation of commercial location data to target or surveil U.S. forces in the Middle East. 4 Earlier in 2026, CENTCOM had said advertising IDs were still enabled on DoD-issued smartphones and that a capability to disable them was being tested, while it had newly gained an ability to disable location sharing on phones it managed. 3

How the commercial-data risk works

• A mobile advertising ID, or MAID, is a persistent, device-specific identifier used to associate activity across apps and to support advertising measurement and targeting. It can be linked to location observations. 7

• Apps and embedded software-development kits can collect location and device data, often for advertising or analytics. Data brokers aggregate, package, and resell such information; purchasers can then search for devices repeatedly observed at sensitive places, such as bases, and follow their movements. 7

• Thus, an adversary need not penetrate military networks or physically surveil a base. It may be able to buy commercially available data, identify a cluster of devices at a facility, and correlate movements, network characteristics, or app-derived information to infer personnel identities and routines. 7

• Disabling the advertising ID helps keep a device’s location from entering many bulk ad-data sales, but it does not eliminate tracking through other apps or through combinations of technical device details, network data, and location records. 7

Why this vulnerability has been evident for years

Commercially available location data has long shown that supposedly anonymous mobile records can reveal sensitive patterns:

• Location-data reporting and research have repeatedly demonstrated that records tied to advertising systems can expose visits to sensitive facilities and allow individual devices to be followed over time; the military concern is the operational version of that broader, longstanding privacy problem. The current disclosures specifically acknowledge that adversaries may exploit this commercial market to locate deployed U.S. personnel. 47

• In the Middle East, the concern became acute enough that officials considered tighter phone restrictions, including potentially ordering some deployed personnel to surrender phones after worries that online videos posted from mobile devices could help Iran target U.S. bases. 7

• The chronology itself illustrates the gap: as recently as spring 2026, CENTCOM said ad IDs remained enabled on government smartphones, despite NSA and CISA recommendations that iOS and Android advertising IDs be disabled. 13

Further protections lawmakers sought

Wyden and Rep. Pat Harrigan asked the Pentagon to investigate whether it had adequately mitigated the danger from the location-data trade. 7 The associated congressional push called for:

• Disabling advertising IDs on government devices. 4

• Restricting location sharing. 4

• Protecting service members’ personal phones, not just managed government devices, because personal-device data can still enter commercial data markets. 47

• Moving away from or limiting use of Chrome on military devices, reflecting concern that web browsing and browser-based tracking may create another route for commercial profiling and data collection. 4

The key limitation is that device-management changes address only government-managed equipment. Unless personal-device use, app permissions, commercial data sales, and web-tracking exposure are also addressed, adversaries may still be able to obtain useful signals about U.S. personnel. 7