Programmatic Retrieval of Device IMEI/ESN in Android and Privacy Considerations

Introduction

In Android application development, there is often a need to obtain unique device identifiers to distinguish between different users or devices. IMEI (International Mobile Equipment Identity) and ESN (Electronic Serial Number) have long been used as hardware identifiers for mobile devices. However, with the evolution of the Android system and growing awareness of user privacy protection, the methods and applicable scenarios for obtaining these identifiers have changed significantly.

Core Retrieval Method

To programmatically obtain the IMEI or ESN of an Android device, the primary approach relies on the getDeviceId() method of the android.telephony.TelephonyManager class. This method returns the appropriate identifier string based on the device type: IMEI for GSM devices and MEID (Mobile Equipment Identifier) for CDMA devices.

The specific implementation code is as follows:

TelephonyManager telephonyManager = (TelephonyManager) getSystemService(Context.TELEPHONY_SERVICE);
String deviceId = telephonyManager.getDeviceId();

Permission Configuration Requirements

Calling the getDeviceId() method requires the READ_PHONE_STATE permission. Developers must explicitly declare this permission in the AndroidManifest.xml file:

<uses-permission android:name="android.permission.READ_PHONE_STATE" />

Starting from Android 6.0 (API level 23), runtime permission requests are also required. The following example demonstrates runtime permission handling in Kotlin:

if (ContextCompat.checkSelfPermission(this, Manifest.permission.READ_PHONE_STATE) != PackageManager.PERMISSION_GRANTED) {
    ActivityCompat.requestPermissions(this, arrayOf(Manifest.permission.READ_PHONE_STATE), REQUEST_CODE)
} else {
    // Permission granted, can call getDeviceId()
    val deviceId = telephonyManager.deviceId
}

Platform Version Compatibility Considerations

As the Android system continues to update, restrictions on obtaining device identifiers have become increasingly strict. Starting from Android 10 (API level 29), regular applications can no longer access IMEI numbers. This functionality requires the READ_PRIVILEGED_PHONE_STATE permission, which is only available to system applications.

For devices running Android 10 and higher, developers need to consider alternative solutions. In emulator environments, the getDeviceId() method typically returns strings like "000000000000000" or returns null when no device ID is available.

Privacy and Security Considerations

Using IMEI or ESN as user authentication mechanisms presents significant security and privacy risks. First, users may have concerns about applications accessing their telephony stack, which can impact user experience and trust. Second, when users change devices, data migration based on device identifiers becomes difficult, potentially leading to user data loss.

More importantly, device identifiers should not be considered secure methods for user authentication. Malicious applications could obtain this sensitive information through permission abuse, creating privacy leakage risks.

Recommended Alternative Solutions

Given the aforementioned limitations and risks, developers are advised to consider the following alternative approaches:

Google Sign-In API: Provides a seamless user login experience while ensuring authentication security. This method does not rely on device-specific identifiers but rather on the user's Google account.

Android Backup API: If the primary need is to maintain user data during device reset or replacement, Android's key-value backup functionality can be used. This allows applications to store small amounts of data in the cloud for restoration on new devices.

Advertising ID: For advertising and analytics purposes, consider using Google Play Services' Advertising ID, which can be reset by users, providing better privacy control.

Practical Application Recommendations

When deciding whether to use device identifiers, developers should carefully evaluate specific requirements:

If device-level identification is truly necessary, consider combining multiple identifiers (such as Android ID, serial number, etc.) with hash processing, while providing clear privacy policy explanations.

For new projects, strongly prioritize account-based identification schemes, as these not only better align with modern privacy standards but also provide superior cross-device user experiences.

Conclusion

While obtaining IMEI/ESN through TelephonyManager.getDeviceId() is technically feasible, the applicability of this method in modern Android development is increasingly limited due to platform restrictions and privacy considerations. Developers should prioritize account-based identification schemes and, when device identifiers must be used, fully inform users and comply with relevant privacy regulations.