>So, essentially a super cookie? That is, generated once (at random or arbitrarily) and then included with proof of work?

You're just describing a regular cookie.

>But not a fingerprint or otherwise linked to identity?

You'll have to reverse-engineer the app to figure out whether it's actually fingerprinting, and whether it's fingerprinting to make sure it's a real device (vs emulator) or it's fingerprinting to uniquely identify someone. I suspect they're complying with app store guidelines and not doing the latter, because it's not worth the PR hit to just to vaguely improve a product responsible for <1% of their revenue.

>But then that would not work against correlating fraud detection as sketched above. A client could simply reset the app every now and then to generate a new UUID.

The attestation result contains a count of attested keys generated in the past 30 days, which detects this case without a "supercookie" that persists across uninstalls.

https://developer.apple.com/documentation/devicecheck/assess...