IMSI is not the only identifier available to mobile networks and attackers alike. Does PGPP provide IMEI randomization? What stops the mobile networks from tracking you using the IMEI associated to the ephemeral IMSIs?

Answer found in the linked paper:

"""

For many devices, the IMEI can be changed through soft- ware, often without root access. We envision a PGPP MVNO would allow for subscribers to present their unchanged de- vice IMEI, giving the PGPP operator the opportunity to check against a EIR to verify the phone has not been reported as stolen. At that point, the IMEI could be reprogrammed to a single value, similar to our changes to the SUPI. Additionally, PGPP users can readily switch SIMs to different handsets (IMEIs) at-will. Note that different jurisdictions have differ- ent rules about whether, how, and by whom an IMEI can be changed, so only in some cases IMEI changes require cooper- ation with the MVNO.

...

A PGPP-based carrier is data-only, with voice and messaging provided by third parties.

"""

So, the next question is: if voice is provided by third parties (i.e., relies on the actual IMSI/IMEI), what stops the mobile operator from correlating the presence of the IMSI/IMEI to the ephemeral IMSIs/IMEIs, so as to infer the real network identity behind the randomised IDs?