Facebook states in this Terms and services that it respects Google plays advertising id:
Yes, the Audience Network SDK for Android uses the Advertising ID and respects its limit tracking option in accordance with Google Play's terms and conditions.
I checked it by sniffing its traffic, and it is true. But it is striking that it does not obay google plays opt-out mechanism:
I still could see that it used the IDFA Header even after opting out.
https://graph.facebook.com/network_ads_common/
MAKE: LGE
IDFA_FLAG: 1
APPVERS: 1.1.10
ATTRIBUTION_ID:
NUM_ADS_REQUESTED: 1
CARRIER:
SDK: android
SCREEN_HEIGHT: 592
VIEWABLE: 1
ADAPTERS: AN
REQUEST_TYPE: 0
SDK_CAPABILITY: [3,4,5,7,11]
CLIENT_EVENTS:
COPPA: false
PLACEMENT_ID: ????
SDK_VERSION: 4.7.0
TEMPLATE_ID: 200
OS: Android
BUNDLE: ???
DENSITY: 2.0
APPNAME: ???
OSVERS: 4.4
SCREEN_WIDTH: 384
SCHEMA: json
PLACEMENT_TYPE: native
APPBUILD: 10
LOCALE: en_GB
MODEL: Nexus 4
IDFA: a6a1bca3-1f90-408e-8a9b-960ba26aa60a
So is that behavior legal from facebook and can I do something about that?
Edit It seems that they need to obay the opt out mechanism:
Usage. The Android advertising identifier must only be used for advertising and user analytics. The status of the “Opt-out of Interest-based Advertising” setting must be verified on each access of the ID.
