Develop Reference

CCPA: how to detect the californian users ? (concerned by the CCPA)

The new CCPA guidelines require to have a specific app behaviour for the 'californian users'. By the way, I wonder if the CCPA applies to all californian citiziens (even if they are not physically present in California when the launch the app) or to all the persons present in California (event if they are not californian citizens).
So, I wonder how I can do technically in order to know if a user is concerned by the CCPA law, in order to know if I must implement a CCPA-specific behaviour for him/her.
My question is about both iOS and Android.
Thanks !

from my understanding, CCPA applies to californian residents only (not travelers)... That being said and as we could expect some kind of generalization of the CCPA later for all US citizens, one can use a conjunction of :
MCC code to identify the country (312 to 316)
Any kind of IP to region code service to check for "user is present in California"
MCC CODE
With such a code, we know if the user is has a SIM card associated with an US subscription. On Android we can use getResources().getConfiguration().mcc or put a flag in lacalized config file under values-mccXXX resource directory :
<resources>
<bool name="is_us_subscriber">true</string>
</resources>
With a default to false. Works offline but requires a SIM based device (which excludes some tablets...), for non-SIM based devices there's no seamless way to check for country of residence... Best effort will be to use IP-to-ADDRESS unless you have additionnal information coming from facebook login or whatever...
IP TO ADDRESS
Using one of (or combination of) :
https://developers.google.com/maps/documentation/geolocation/intro
your own server implementation
https://developer.android.com/reference/android/location/Geocoder
other webservice
You can get US State (eg: California) from user IP address. On Android, use webservice to get user latitude and longitude and then call Geocoder to check for Address#getCountry() and Address#getAdminArea() which returns :
the administrative area name of the address, for example, "CA", or
null if it is unknown.
But it will only allow you to know that user is in California... And not user is a Californian resident.
MY OPINION
Use of external webservices is not reliable (no connection, VPN, proxy, ...)
Use of external webservice could be expensive
We lack information regarding user residence with location based services
I would recommend use MCC only since there's a high probability to see some kind of CCPA generalization in the US sooner or later...

How to get unique id for clients without registration? (Jodel app for e.g)

Imagine an application that consists of loads of clients and one server. The clients should be able to use the application without the need to register a username for e.g. (Therefore getting the feeling of anonymously using the app)
What unique data in a smartphone could be use to identify "anonymous" users and seperate them uniquely, so that each user would have its own personal data.
Could one use the IMEI id?
Is this possible?

At I/O 15 Google announced the 'instance ID' which uniquely identifies an app installation, and can be used for a veriety of other purposes as well.
I give more detail in an answer to an existing, similar question here:
https://stackoverflow.com/a/30948111/150016

Yes You can use the IMEI, but then you need a permission...or you could give every User a Unique ID on the server side
I think a long type variable is enough so the first one that connects you give him the ID 1 the app gets the ID and so on and so forth

You can use a built in feature here:
import android.provider.Settings.Secure;
private String uniqueIdentifier = Secure.getString(getContext().getContentResolver(),
Secure.ANDROID_ID);
where Secure.ANDROID_ID is presented as "A 64-bit number (as a hex string) that is randomly generated when the user first sets up the device and should remain constant for the lifetime of the user's device."

This is exactly the use case for the new Instance ID: getting a unique ID that you can use to identify even a not logged in user to your server.
This works on both phones and tablets (something IMEI does not) and avoid issues with ANDROID_ID (such as a few manufacturers always using the same ANDROID_ID on all devices).

You don't want to use the IMEI, as it will only apply to devices that have cell phones in them. There are plenty of wifi only devices out there in the wild.
Also, to get the IMEI, you need to ask for extra permission in your manifest.
<uses-permission android:name="android.permission.READ_PHONE_STATE" />
You'd be better off either generating your own random GUID and storing it in your app's SQLite database, or use the Android ID field.
Android ID will give you extra benefits like providing a different identifier for different user profiles within a device.
Another answer here mentioned using Instance ID, but the big caveat there is it requires Google Play Services, so your app wouldn't work on AOSP / forked devices (i.e. Amazon's tablets). I'd have just inserted this as a comment to that answer, but my rep won't let me comment yet.

how to reach android device unique id?

I'm building an android app about something.
I want that my app cannot be copied.
in WINDOWS I can do like this:
get cpu id from this cmd line:
wmic cpu get processorid
encrypt this code and save it into database
every time software opened it will checks the cpu code and the code in database. so when software copied to another PC it will say:
encrypted code and your cpu code does not match.
I was searching for this command in android and OOPS, there isn't any thing that work 100%.
really I don't need to use only this way(get device ID and save it and..) and if you know another way to do this work(I want that my app cannot be copied) say that.
maybe it is good to say my idea that isn't completed:
create a form for buy this app with unique username in my site.
after a user bought this app it will be download for him.
every time that user want's to open the app it connect to server and see if user is available app will work for him and make his user unavailable for next time that it will be opened in another device (NOPE.I can't do this because it isn't a different between tow android device and I haven't a unique ID);else it can not be worked.
UPD1: can this
works?

You should generate your own uuid.
Google's blog post says IMEI, mac address, serial number, ANDROID_ID, all of them has a problem.
Use java.util.UUID instead.

String android_id = Secure.getString(this.getContentResolver(),Secure.ANDROID_ID);

How to uniquely identify android device to track devices

Hello I am working on an application in which we are tracking our app installation using device unique ID.
We are doing right now like this as https://stackoverflow.com/a/2785493/2455259
private String android_id = Secure.getString(getContext().getContentResolver(),
Secure.ANDROID_ID);
I got to know that from android 4.2 it can have different for different users https://stackoverflow.com/a/27013749/2455259.
Now I can't take mac address of wifi or bluetooth because it requires to make it turn on then fetch. Even I can't take IMEI because some tables don't have call feature so they don't have IMEI.
Now what are the option to uniquely identify android device ?

Now what are the option to uniquely identify android device ?
I am afraid assigning own unique number is most effective approach, because ANDROID_ID is broken (the answer you link to is incorrect - see comments there too), relying on it is quite futile as it can sometimes be the same for many devices or null, so anything but unique, therefore using it is pointless as it adds more troubles than helps. There's post on Android blog about this topic "Identifying App Installations" that you may want to get thru as well.

I know this is old and the OP might have already moved on but with the introduction of Instance ID, we can use it to identify a unique installation.
The associated code is pretty straightforward too.
String iid = InstanceID.getInstance(context).getId();
The benefits include not having to specify permissions for Android Marshmallow and above. This seems to be a plus for developers who would need a unique id at the outset and cannot rely on user provided permission model for the same.

Verify a user identity via Phone Number or other unique ID (iOS/Android)

Following scenario:
I want to create an wifi hotspot on a public place (e.g. train station). Therefore i want to write an mobile application (iOS and/or Android) which works as a portal page. As I would be providing internet access via my wifi hotspot I need to make sure that people who want to log in verify their identity properly (responsibility). First I thought i could do something like a facebook login but I guess that would not be enough as people can create fake accounts.
Then I got the idea that I could maybe access their telephone number via their smartphones.
I googled alot and came to the conclusion that it is pretty tough on both platforms.
The iOS method seems to be deprecated and apps wont make it to the app store with that version. Android can read the phone number from the sim card, but not all providers store the number on the sim card.
Question
Is there any possibility to get the phone number? Or is there any other way to uniquely identify a person in a wifi network?
Of course I dont want to do any of that without asking for users permission etc...
Greetings and thanks in advance
Peter

Choosing the MAC address is a good choice, it is not the safest, but it is the more easy to do.
The IMEI is not always provided, and the SERIAL is not uniq.
But actually, I don't know how to do this with iOS.

What is about the MAC address of the phone? This should be unique enough and you can get is easily from android and from iOS.
Android: http://developer.android.com/reference/android/net/wifi/WifiInfo.html#getMacAddress%28%29
iOS: How can I programmatically get the MAC address of an iphone

Using IMEI number
Android Does provide functions/method to access device IMEI number
First Set <uses-permission android:name="android.permission.READ_PHONE_STATE" />
in android manifest
TelephonyManager tm = (TelephonyManager) getSystemService(Context.TELEPHONY_SERVICE);
// get IMEI
String imei = tm.getDeviceId();
Hope it helps
For NON CDMA or GSM devices like Tablet
Use
import android.provider.Settings.Secure;
private String android_id = Secure.getString(getContext().getContentResolver(),
Secure.ANDROID_ID);
This would generate a unique code for the device..how ever it would change on when user reset the device ie factory reset it .. and it works for device having os > 2.2(froyo)

This really depends on who you are trying to identify. That may seem like an odd response, but usually, we are trying to identify two, not one, sets of credential elements.
First, we want ot identify the device itself -- is this the deivce we expect to see and can we trust that this device has not been tampered with. Second, we usually want to know if the user of this device at the moment is one we expect to be using this, now validated, device. (If I take your phone, without step #2, I just became you.)
This is why we have things like 802.1x. It lets me validate the user of a network, not just the device. For your case, consider something like:
For device validation, the combination of hte MAC address and the IMEI. TUrn those into a unique hash with some data from the user. For example.
ID = SHA1(IMEI+MAC(Wifi)+user password)
Now that we're pretty sure the device and user are correct, if you need to, you can go one step further and use that hash a key to encrypt a user validation step in your app. Even if the user is correct, if they're on the wrong device, their key won't decrypt.