[GoogleAppMeasurement 12.17.0] IDFV persisted in plaintext in google-app-measurement.sql — flagged as "PII in Internal Storage" by security scanner (NowSecure)

[naresh-banavath]

Description

Title

[GoogleAppMeasurement 12.17.0] IDFV persisted in plaintext in google-app-measurement.sql — flagged as "PII in Internal Storage" by security scanner (NowSecure)

Description

Environment

• firebase-ios-sdk 12.17.0, GoogleAppMeasurement 12.17.0 (SPM)
• Products: FirebaseAnalyticsCore (IDFA/Ad-ID disabled) + FirebaseCrashlytics
• Device/OS: iPad7,5 / iOS 17.7.10

Summary

A NowSecure security scan flagged "PII in Internal Storage." The evidence is the device IDFV stored in plaintext inside Firebase Analytics' internal Measurement SQLite database. This file is created and written by GoogleAppMeasurement (Firebase Analytics), not by our application code — our source does not read or write this file.

Evidence

• Sensitive data type: Identifier for Vendor (IDFV)
• Encoding: plaintext
• File: Library/Application Support/Google/Measurement/google-app-measurement.sql
• Scope: File System

Code path

GoogleAppMeasurement.xcframework (closed-source binary) creates and writes
Library/Application Support/Google/Measurement/google-app-measurement.sql, storing the
IDFV to attribute analytics events. Our application code does not access this file.

Questions / requests

1. Please confirm the purpose of persisting the IDFV in google-app-measurement.sql and that it is required for Analytics event attribution.
2. Please confirm the storage protection applied to this file (e.g., sandboxed, backup-excluded, iOS Data Protection class), and whether the IDFV is stored in plaintext by design.
3. Are there plans or supported options to encrypt, hash, or otherwise avoid persisting the IDFV in plaintext at rest?
4. Is there a supported configuration to reduce or avoid this on-disk PII storage without disabling Firebase Analytics?
5. Any official guidance/attestation we can provide to security auditors regarding this finding.

Reproducing the issue

No response

Firebase SDK Version

12.17.0

Xcode Version

26.6

Installation Method

Swift Package Manager

Firebase Product(s)

Analytics, Crashlytics

Targeted Platforms

iOS

Relevant Log Output

If using Swift Package Manager, the project's Package.resolved

Expand Package.resolved snippet

Replace this line with the contents of your Package.resolved.

If using CocoaPods, the project's Podfile.lock

Expand Podfile.lock snippet

Replace this line with the contents of your Podfile.lock!

[rizafran]

Thanks for raising the issue, @naresh-banavath. I've escalated this to our engineers, and we'll let you know once there's an update.