Facebook states in this Terms and services that it respects Google plays advertising id:
Yes, the Audience Network SDK for Android uses the Advertising ID and respects its limit tracking option in accordance with Google Play's terms and conditions.
I checked it by sniffing its traffic, and it is true. But it is striking that it does not obey google plays opt-out mechanism:
I still could see that it used the IDFA Header even after opting out.
https://graph.facebook.com/network_ads_common/ MAKE: LGE IDFA_FLAG: 1 APPVERS: 1.1.10 ATTRIBUTION_ID: NUM_ADS_REQUESTED: 1 CARRIER: SDK: android SCREEN_HEIGHT: 592 VIEWABLE: 1 ADAPTERS: AN REQUEST_TYPE: 0 SDK_CAPABILITY: [3,4,5,7,11] CLIENT_EVENTS: COPPA: false PLACEMENT_ID: ???? SDK_VERSION: 4.7.0 TEMPLATE_ID: 200 OS: Android BUNDLE: ??? DENSITY: 2.0 APPNAME: ??? OSVERS: 4.4 SCREEN_WIDTH: 384 SCHEMA: json PLACEMENT_TYPE: native APPBUILD: 10 LOCALE: en_GB MODEL: Nexus 4 IDFA: a6a1bca3-1f90-408e-8a9b-960ba26aa60a
So is that behavior legal from Facebook and can I do something about that?
Edit It seems that they need to obey the opt out mechanism:
Usage. The Android advertising identifier must only be used for advertising and user analytics. The status of the “Opt-out of Interest-based Advertising” setting must be verified on each access of the ID.