Type Allocation Codes (TAC)

Popularly referred to as TAC codes these eight digits are the backbone of modern cellular networks.

TACs form the initial digits of a GSM mobile radio’s serial number. These days most telecoms devices use the GSM standard.

IMEI

International Mobile Equipment Identity (IMEI) is the communication industry's lingo for the mobile device radio’s serial number. IMEIs are 15 digit numbers that can be found in the Settings & About menu of most mobile phones and tablets. Here’s an example from one of the 51Degrees test devices.

About device menu from an Oppo X5 — Screen shot from an Oppo X5 showing two IMEIs

Strictly the IMEI number relates to the radio(s) and not the device. In the prior example our test device has two SIMs and therefore two radios. The IMEI numbers are;

867432052920250

867432052920243

Devices with a single SIM will often use the single IMEI number as a substitute for the device serial number, even in the case of Apple etching the IMEI number onto the device.

Registrations

Application form for TAC codes — GSMA operate the single central registration process for TAC codes

The GSM Association (GSMA) operate the central registry for all TAC codes. Any radio device vendor seeking to license radios under the Global System for Mobile communications (GSM) protocols must obtain a TAC code before they manufacture the device. Manufacturers do this by applying to the GSMA and completing a form.

The GSMA make available to paying subscribers the information provided by vendors on a daily basis.

The GSMA do very little in practice to verify the integrity of the data provided when a TAC code is requested. We often observe inconsistencies in the data provided. Smaller vendors may not prioritize the integrity of the data, or might be changing the specifications of the device after the point of obtaining the TAC codes.

In Market

Production line of mobile phones — GSMA data relates to the device before the production line starts. This data often changes during manufacture.

51Degrees only uses device information related to devices as they appear in the retail channel and in people’s pockets and not the information that the vendor thought might relate to the device at the point of TAC application many months or years previously.

This is a key difference between the 51Degrees TAC service and the data provided by the GSMA.

Time Delayed

We can see details related to some new devices appearing soon after the TAC application has been completed and before the related device arrives in the sales channel. However some vendors like Apple restrict the availability of the TAC information until after the device has launched. We assume this is to preserve the "mystery" associated with the next must-have device.

But we do monitor new TAC registrations daily to guide our Data Team on which vendors are likely to be bringing new devices to market so that we can obtain the corrected information directly from those vendors as soon as possible.

10 Million Limit

As the IMEI number is 15 digits and the TAC takes eight only seven are left for the unique part of the model. Therefore each TAC code can only be used for 10 million radios. This limit might not be a problem for a small manufacturer who can only dream of selling 10 million devices, but it is certainly a challenge for the likes of Apple and Samsung.

Therefore each model of radio and therefore device might have many TAC codes associated with them.

Consider the iPhone 17 Pro Max. Each of the following TAC codes relates to the same model!

Duplication

It’s an inconvenient fact that the TAC code does not relate to one device model. Some vendors will reuse the same TAC across multiple models. The GSM database is therefore further disconnected from the real world of TAC deployments.

51Degrees believes this happens because some manufacturers don’t wish to go through the hassle and cost of obtaining new TAC codes for every model of device where they manufacture relatively low volumes of device models.

For example:

A smaller vendor that is producing a limited set of devices for the market in Indonesia might use the same TAC for the next generation of devices.
If they’re producing multiple devices with different specifications they might use the same TAC for both the low and high end devices.

The following is a list of some TACs that appear against two or more device models in practice.

TAC:99001933: OnePlus DE2118 (Nord N200 5G) or OnePlus PGZ110 (Ace Racing Edition).
TAC:35991258: Apple iPhone 17 Pro Max A3257 or Apple iPhone 17 Pro Max A33527 A3257 (US/ Puerto Rico) or A33527 (China only).
TAC:35061153: OUKITEL WP55 or OUKITEL WP55 Ultra.

Device Detection

The TAC can be used with 51Degrees device detection to obtain all the information about the device model including price, release date, screen information, and chipsets. As it’s a structured eight digit value the process is really very simple.

Taking the IMEI numbers from our test device shown earlier the TAC code can be used with device detection to obtain the device information. Click the following link to see the results.

867432052920250

867432052920243

Of course there is no information concerning the operation system, app, or browser as the TAC code simply doesn’t relate to these values. The native application keys can be used to obtain this information, or the User-Agent. More information about these methods is available on the following pages.

Use Cases

All mobile network operators use IMEI numbers in the lowest level protocols of their infrastructure. From toll tickets, used for billing, to real time signaling these numbers are everywhere. As such they’re a really handy way of augmenting network analysis and optimization.