So, the word on the street (Techcrunch even covered it), seems to suggest that UDID usage is now officially a rejection reason in the App Store, but Apple have never provided another alternative to uniquely identify a device that is less tightly coupled to the hardware.
There have been a number of new systems put forward, using the MAC address, randomness shared between apps etc.. some proprietary and some open source.
From what I’ve found, the best alternative at the moment is AppsFire’s open source OpenUDID. It provides a persistent, shared-between-applications ID for the device which can be used for tracking users through purchases, ad-clicks and upgrades. It does however support the concept of ‘opting out’ (if you implement an opt-out UI), so theoretically, another Application can allow them to Opt out and providing you choose to respect this you won’t get a UDID. You do however have the source though 😉
[codebox 1] OpenUDID is available on GitHub and seems like a pretty robust way to go. If you’re thinking about submitting an Application update, it would definitely seem prudent to make the change for this release, or you may not make it to the Store!