IMEIs can be queried by a network core (not the tower) and US carriers probably do this every once in a while to check against their stolen phone database. It can be changed on some devices but not others. It's not inherently tied to you as a person but of course it is tied to that device.
For those who don't need mobile data service of any sort, I think that PGPP Relay does what's needed -- decouples your IP from your identity -- and you can use WiFi networks without revealing anything.
It's also linked to the rotating IMSI, so all of the rotating IMSIs that are used at the times the IMEI is interrogated are linked together from a metadata standpoint.
They're also all linked to every other IMSI that was ever used with that IMEI (at the times the IMEI is interrogated).
> US carriers probably do this every once in a while to check against their stolen phone database
Hourly? Daily? Monthly? Only on first-time seeing a new IMSI?
How widespread is this practice? Do the major US carriers know my IMEI?
I tend to believe that they do from what I've seen in their web interfaces, and that IMSI rotation alone is basically pointless from a privacy standpoint.