Identity · 10 min
IDFA, GAID, and the hybrid bridge
A bridge that passes advertising identifiers into HTML is convenient for attribution vendors. It is also how lookbacks silently widen and how PDPA conversations go badly.
Treat identity as three planes. Plane A is the logged-in user id your product already trusts. Plane B is the device advertising id (IDFA or GAID) when the platform still gives you one. Plane C is whatever the WebView invents: cookies, localStorage, a tag-manager visitor id. Hybrid apps get into trouble when the JS bridge copies B into C, or worse, when C overwrites A.
What the bridge is for
In the flagship we allow three payloads across the bridge: consent state, a signed runtime flag (“this HTML is inside our shell”), and optionally a short-lived session nonce that cannot be replayed after process death. That is enough for the checkout to know it may fire diagnostic events. It is not enough to reconstruct an advertising graph inside a cookie jar.
ATT and the empty string
After ATT, many iOS users return an empty advertising identifier. Teams then “fill the gap” by stuffing the WebView with a first-party id and calling it equivalent. It is not equivalent. Your attribution window just changed definition. Write the failure mode into the contract: campaigns that depend on IDFA will be marked unscoreable rather than silently remapped.
Android WebView surprises
GAID availability inside a WebView is not the same as GAID availability in the native SDK. OS and WebView updates have stripped or ignored advertising ids in HTML even when native still sees them. If your MMP documentation assumes they are the same, test it on the WebView version you actually ship, not the emulator default.
Debugging the JS Bridge, the ten-day desk, is built around a sandbox that leaks a stale GAID into HTML on purpose. Students are asked to remove it without breaking checkout.