I'm not suggesting adding more permission dialog boxes. The way I see it is more along the lines of what Google does with Android: anything that would return a unique identifier (IMEI, serial number, Android ID, MAC addresses) returns either random data or zeros. And, crucially, it needs to be such that the app can't know whether it's getting real or fake data.