The Identifier Era Is Ending on Android

For years, mobile ad targeting and measurement leaned on stable, cross-app identifiers — chiefly the Google Advertising ID (GAID). That model is being dismantled. Google's Privacy Sandbox on Android aims to deliver relevant ads and conversion measurement without sharing user-level identifiers across apps.

For publishers who fund free apps and games with ads, this is not a minor SDK update. It changes how demand partners understand your audience, how attribution flows back to advertisers, and how your inventory is valued. Learning the building blocks now — while the old signals still partly work — is how you protect revenue through the transition.

Topics API: Interest Signals Without Tracking

The Topics API replaces cross-app interest profiling. Instead of advertisers stitching a behavioral profile together from many apps, the device infers a small set of coarse interest topics (for example "Mobile Games" or "Travel") from recent usage. Topics are stored on-device and only a limited number are shared with calling SDKs per period.

In practice:

• Targeting becomes broader and contextual rather than person-specific.
• Topics are coarse, rotate over time, and exclude sensitive categories by design.
• The OS mediates what signal reaches demand — you no longer own the profile.

Expect interest-based CPMs to depend more on contextual relevance and first-party context you can legitimately provide in ad requests.

SDK Runtime: Isolating Ad SDKs

The SDK Runtime moves advertising and analytics SDKs into a separate, sandboxed process with limited permissions. Today an embedded ad SDK runs with the same access as your app — it can read app data, device signals, and more. The SDK Runtime constrains that, reducing what an SDK can silently collect and limiting cross-app correlation.

For publishers this brings two realities. Mediation and ad SDKs must be updated to runtime-enabled versions, a dependency to track with each partner. And signals SDKs historically grabbed implicitly will no longer be available, so passing clean, consented first-party context through supported APIs matters more.

Attribution Reporting: Measurement Without IDs

The Attribution Reporting API rebuilds conversion measurement on-device. Rather than matching an ad click to an install via a shared ID, it records attribution events locally and returns aggregated or noised, delayed event-level reports — proving campaigns work while preventing user-level re-identification.

The trade-offs your demand will adapt to include:

• Reporting delays instead of instant, deterministic attribution.
• Statistical noise that requires larger volumes to read cleanly.
• Aggregated summaries replacing one-to-one click-to-install mapping.

Expect a period where advertisers run Privacy Sandbox attribution alongside legacy methods to calibrate. Inventory that measures well under the new APIs will retain budget; inventory that depends on deprecated signals will see pressure.

What App Publishers Should Do Now

The transition rewards preparation. Concrete steps:

• Audit your SDKs. Confirm your mediation, ad network, and analytics SDKs ship Privacy Sandbox & SDK Runtime-ready versions, and plan upgrades.
• Enroll and test. Use Google's Privacy Sandbox enrollment and test on developer previews so you are not debugging in production.
• Strengthen first-party context. Invest in contextual and consented signals you can pass legitimately, since cross-app IDs will not carry the load.
• Benchmark measurement early. Compare Attribution Reporting outputs against current attribution to set realistic buyer expectations.
• Get consent right. The Sandbox reduces silent data sharing but does not remove your legal duty to collect and respect consent for the processing that remains.

Why Consent and a CMP Still Matter

A common misread is that Privacy Sandbox makes consent obsolete. It does not. The Sandbox limits how data moves, but under the GDPR, ePrivacy rules, and Google's own policies you still must obtain and signal a valid legal basis — and demand partners still require interoperable consent signals to bid. Google Consent Mode v2 and IAB TCF 2.3 remain the connective tissue between your consent UI and the ad stack.

This is where FlexyConsent fits. As a Google-certified Consent Management Platform supporting IAB TCF 2.3 and Consent Mode v2, it centralizes how consent is collected and propagated across all your apps and websites. One configuration emits the standardized signals your mediation and measurement partners expect, so as Privacy Sandbox APIs roll out you send clean, consistent, auditable consent — not brittle per-app logic that breaks with every SDK update.

Key Takeaways

• Privacy Sandbox replaces cross-app IDs with on-device Topics, an isolated SDK Runtime, and noised Attribution Reporting.
• Targeting shifts toward contextual and consented first-party signals; deterministic attribution gives way to aggregated, delayed reports.
• Audit and upgrade your ad SDKs now, enroll in testing, and benchmark new measurement against legacy before deprecation bites.
• Consent is still mandatory — a TCF 2.3 and Consent Mode v2 CMP like FlexyConsent keeps your consent signals valid and interoperable across every property.