No tracking identifiers read before ATT consent is received

Displaying an ATT prompt but reading the tracking identifier before the user responds — or transmitting a device-persistent ID to a third party before ATT resolves — defeats the purpose of the consent mechanism entirely. Under GDPR Art.7, consent must precede processing; under CCPA §1798.120, users have the right to opt out before sharing occurs. OWASP 2021 A04 (Insecure Design) applies when consent architecture is structurally bypassed. Apple's App Review detects this pattern with instrumentation: they see SDK network calls before the ATT dialog appears in their testing, and apps fail review for it.

Gate every identifier read and third-party transmission on ATT status resolution:

import { getTrackingStatus } from 'expo-tracking-transparency';
const status = await getTrackingStatus();
if (status === 'authorized') {
  const advertisingId = await getAdvertisingId();
  analytics.identify(advertisingId);
} else {
  // Use ephemeral session ID only
}

Audit every track() and identify() call in src/analytics/ or equivalent for whether it includes a device-persistent or user-persistent identifier. Replace persistent device IDs with ephemeral session IDs (generated fresh each app launch) for pre-consent analytics. Any DeviceInfo.getUniqueId() value passed to a third-party service must be gated the same way.