It's very kind of Google to, say, make the recent change re. Build.SERIAL/Build.getSerial() so that it requires a permission now. That's a step in the right direction, but we're still very far from being untrackable.