Which they're using to track a couple of events, i.e. when the app fails to register with the API: https://github.com/nhsx/COVID-19-app-Android-BETA/blob/maste...

(Though that analytics platform itself does do device fingerprinting, inasmuch as detecting phone model, OS version etc -- I assume no individually identifying stuff like IMEIs, but who knows what a bad actor can do with sufficient entropy?)

Except you don't need to import Firebase Analytics to use the messaging. And, same as the Facebook SDK situation earlier today, Firebase SDKs will do stuff when the app loads whether you reference them or not.