Same ANDROID_ID in Oreo

Question

As per Android 8.0 Behavior Changes,

For apps installed on a device running Android 8.0, the value of ANDROID_ID is now scoped per app signing key, as well as per user. The value of ANDROID_ID is unique for each combination of app-signing key, user, and device. As a result, apps with different signing keys running on the same device no longer see the same Android ID (even for the same user).

To test above changes, I made two test APK and found below behavior (tested on Nexus 5X, OS 8.0.0):

• In case when targetSdkVersion 26, compileSdkVersion 26, buildToolsVersion 26.0.0, The two different apk (along with different package name) generated from the same windows machine is displaying same ANDROID_ID. When APK is generated with same package name from the different machine, is displaying the different ANDROID_ID.

Below is my query:

1. Is this correct behaviour ? Why is two different APK showing the same ANDROID_ID?
2. Any change if my application's ANDROID_ID may get changed (without un-install/ re-install)?
3. Getting same behaviour on Nexus 5x, OS 6.0.1, targetSdkVersion 23, compileSdkVersion 23, buildToolsVersion 25.0.0 . I don't see any specific behaviour change in Android O. What I am missing ? Why getting same behaviour ?

Answer 1

As other answers explain why you are getting same id for different apks, they are correct.

Best way to check this behaviour with creating two different certificates and sign your apk using these two certificate.

---

Summarizing to all your confusion, [From Changes to Device Identifiers in Android O]

1. The ANDROID_ID value won't change on package uninstall/reinstall, as long as the package name and signing key are the same. Apps can rely on this value to maintain state across reinstalls.
2. If an app was installed on a device running an earlier version of Android, the Android ID remains the same when the device is updated to Android O, unless the app is uninstalled and reinstalled.
3. The Android ID value only changes if the device is factory reset or if the signing key rotates between uninstall and reinstall events.
4. This change is only required for device manufacturers shipping with Google Play services and Advertising ID. Other device manufacturers may provide an alternative resettable ID or continue to provide ANDROID ID.