So I had this idea that we'd do wardriving to figure out what brands (and perhaps even models) were popular in different regions. We got quite far into this idea before abandoning it.
GSM insecurity was a key enabler. If I remember correctly, at that time it was possible to get at least the IMEI via passive eavesdropping, somehow.
The reason we abandoned this idea: A combination of our inhouse lawyer's opinion plus we realized we could just brute-force it by manually testing thousands of devices with a staff of about 5 manual testers of the proper ability. The most productive person we hired for that role was 60+. She had previously worked as COBOL programmer for a local bank.
I guess this could illustrate a key difference between a bay area company and a nordic company, at the time...