Android (10 or later) - What is the probability that an app on two different devices will have the same Android ID?

Question

We have not found documentation on the logic with which the Android ID is generated for an app / device.

Starting from Android 10 the IMEI is no longer usable. We need to uniquely identify the devices on which our app is installed. We don't care that the ID changes over time, we care that the ID is unique and is not repeated on other devices.

What is the probability that the same app installed on two different devices will have the same Android ID? In a context with a few thousand devices, is it reasonably impossible for this to happen?

Thanks in advance

EDIT: with "Android ID" I refer to the ID that Android assigns to each installed app. The ID can be obtained with the following code:

Android.Provider.Settings.Secure.GetString(cnt.ContentResolver, Android.Provider.Settings.Secure.AndroidId);

Answer 1

1: Where does it state that the Settings.Secure.ANDROID_ID is a 64-bit number.

https://developer.android.com/reference/android/provider/Settings.Secure#ANDROID_ID

On Android 8.0 (API level 26) and higher versions of the platform, a 64-bit number (expressed as a hexadecimal string), unique to each combination of app-signing key, user, and device.

2: How is that 64-bit number generated.

From Secure Android ID length? which includes a link to the Android Open Source Project code

String androidId = Long.toHexString(new SecureRandom().nextLong());

For reference Java Long size is 8 bytes or 64 bits. That means 2^64 or approximately 1.84E+19 values available. What is stored for a particular app isn't a created value from the device id, user id and application signing key but a SecureRandom generated Java Long number.

3: So Android stores this SecureRandom value for each app / user / device (factory reset). And if any of those change a new value is generated?

Basically yes. From: Where is the "android_id" stored and when does it change?

As stated in the Android Developer Blog for O it had to behave/remain consistent for device upgrades.

Answer 2

Very high, after Android 11, user can Delete the Advertising ID, this reset the ADvertising ID to 0000-0000-.....

So, when you have more than 1M users and even 1% of them delete their Advertising ID by listening to the Youtube videos to get better privacy, your 1% users will have the default i.e. 0000-0000-... Advertising ID.

So based on your user's education level and their privacy concerns, the possibility of two users having same ID will change. (In my organization we have faced this issue)

Also, if the user is just resetting the device Advertising ID, the chances of UUID collision is very very very low. Please refer https://stackoverflow.com/a/24876263/5309486 for more info for UUID collision.