App install fingerprinting is the set of techniques social media platforms use to identify a device across installations, linking new accounts to previously banned users by collecting persistent hardware identifiers, OS-level tokens, and behavioral signals during the install and account creation process. When a banned user reinstalls an app and creates a new account, the platform compares the new install against known banned-device records and flags the evasion attempt.
What Identifiers Persist Across Reinstalls?
Social media apps collect identifiers that survive app uninstallation and reinstallation. The most powerful of these are hardware-based identifiers: the device serial number, IMEI on Android devices, and Apple's identifierForVendor (IDFV) on iOS. The IDFV persists unless all apps from the same vendor are removed, making it a reliable tracking mechanism for spotting reinstalls.
On Android, Google's SafetyNet and the newer Play Integrity API provide hardware-backed device attestation. Apps can request a cryptographic proof that a device is genuine hardware and not an emulator, and this attestation carries a unique device identity that survives uninstalls and reinstalls. Google disclosed in 2023 that Play Integrity API responses include device-level verdicts that apps can use to identify risky devices.
Apple's equivalent is the DeviceCheck framework, which allows apps to store two bits of data per device on Apple's servers, independent of the app installation. A platform can mark a device as banned using DeviceCheck, and any subsequent install of the same app on the same device will read that ban flag, regardless of reinstalls or factory resets.
How Do Server-Side Flags Work?
The most reliable install tracking does not happen on the device at all. When a platform bans a user, it records the device fingerprint on its servers. The fingerprint includes the device model, hardware identifiers, OS version, carrier, and dozens of other signals. When a new install from the same device attempts account creation, the server compares the new request against the banned-device database.
A 2025 Imperva report found that account takeover attacks increased by 40% in 2024, driving platforms to aggressively expand their server-side device tracking. The report noted that financial services alone accounted for 22% of ATO attacks. Social platforms facing similar pressures have built detection pipelines that run at scale, matching new installations against millions of banned-device records in real time.
What About Advertising Identifiers?
Both iOS (IDFA) and Android (AAID/GAID) provide advertising identifiers that users can reset. These are intentionally resettable for privacy reasons, which makes them less useful for enforcement. However, platforms use advertising identifier stability as one signal among many. A freshly reset advertising identifier on a device with a known hardware fingerprint is treated with higher suspicion than a new advertising identifier on a device with no history.
The key insight is that platforms do not rely on any single identifier. They combine hardware, software, network, and behavioral signals. One resettable identifier does not clear the device's reputation.
How Behavioral Signals Contribute to Reinstall Detection
Even with a fully clean device, behavioral signals during account creation can trigger detection. The speed of account creation, the pattern of information entered, the timing of the first actions after creation, and the similarity of the new account's behavior to the previously banned account all feed into the detection model. A banned TikTok user who reinstalls and immediately follows the same accounts, posts similar content, and engages at the same times is identified by pattern, not just by hardware.
How Conbersa Eliminates Install Tracking Risk
We built Conbersa so every account runs on its own dedicated physical smartphone that has never been associated with any prior banned account on any platform. There is no install tracking history because the device has no installation history to track. Each device is brand new or factory-clean, with hardware identifiers that have never appeared on any platform's banned-device database.
This is the fundamental difference between real-device infrastructure and software-based alternatives. Emulators, cloud phones, and anti-detect browsers share underlying hardware or virtualization layers that accumulate detection history. A clean physical phone starts with a genuinely blank reputation. Combined with independent carrier IPs and human-consistent behavior, the accounts operate without the install tracking burden that undermines recycled devices and virtual environments.