All the apps on your phone have access to the phone identifier. As well as other information, like your Google account. It's pretty trivial to tie a phone to you.
As long as you keep to FOSS apps that you KNOW are private (you can tell which ones call home), you should be OK. For example, Lemmy with a throwaway email address, Simplex for communications, Mull with a shitload of blocks, Orbot with RethinkDNS, and so on, you're golden. Buy your phone in a different country, on Ebay with a throwaway account and a prepaid credit card.
There's a lot you can do to remain truly anonymous.
Now, my threat model does not require me to go to those extents, but you get the point.
If someone really wanted to find the person, I imagine they'd find where the signal is coming from for that device, and just narrow from there. If it always goes to/from where John works and lives, it might well be John's phone.
Act itself is not illegal... Police wouldn't care un less you are already on Santa's list... But it would not be police either but rather internal spooks who track that list.
Yeah but you already need to be on the list for them to check at all
And even then I doubt they would. They got limited resources. with that being I have no idea about your threat model.
If it involves over zealous glowies, this comment section is prolly a bit too rookie to properly comment. Also this things are very geo specific as each jurisdiction will have their own KYC regs and compliance practices.