I capture all HTTP headers on one site that has a high incidence of extended human interaction, in order to research fraud prevention.
In about 5 months it has captured 6402 unique X-UIDH device IDs.
There are other headers that also seem to present a unique device ID. Some of the values even look like they could be phone numbers.
This is just a regular site. I'm not a part of any ad network.