Key insights
- A technical analysis of Applovin's (APP) MAX SDK suggests potential privacy concerns, echoing previous short reports. While the core data harvesting mechanisms are closed-source and un-auditable, the public SDK reveals sloppy consent handling. Consent flags are passed to third-party networks without verification of compliance, and opting out of tracking only affects ad personalization, not data logging. This raises questions about the company's data practices, potentially impacting investor sentiment and regulatory scrutiny.
A friend asked me to go over two short reports since im slightly more technical and these are my findings:
quick background:
there have been a few short reports on $APP (Muddy Waters being the big one) all basically saying their ad targeting works because theyre harvesting data they shouldnt have. Stock dropped since. i wanted to see how much of the technical claim is real so i went through the public MAX SDK on github.
one thing you need to know before anything else. the public repo is ONLY the mediation adapters (the glue between MAX and other ad networks). the actual AXON core that does the bidding is closed source and not in the repo. so all the juicy stuff (cross app tracking, the kid stuff, stuff from the short reports etc) is in code i literally cannot see. not gonna pretend otherwise.
tldr: the conflict of interest is 100% real and visible. the consent handling is genuinely sloppy. the actual smoking gun is in closed code nobody outside the company can audit, so i cant confirm it and honestly neither can the shorts.
- consent flags get passed off with zero verification the partner actually honors them
17 adapters take your opt out flag, turn it into a string, hand it to the third party network and walk away. no callback, no check. the adapters whole job is “ok i told them.”
```java if ( hasUserConsent != null && !hasUserConsent ) networkExtras.putString( "npa", "1" ); // non personalized ads if ( isDoNotSell != null && isDoNotSell ) networkExtras.putInt( "rdp", 1 ); // restrict data processing ```
also worth noting opting out just means you see a non personalized ad. theres no skipTracking() anywhere. you opting out changes the ad, not whether the event gets logged.
- the consent strings themselves are mangled
Fyber adapter, the entire CCPA privacy string crushed down to three hardcoded values:
```java InneractiveAdManager.setUSPrivacyString( isDoNotSell ? "1YY-" : "1YN-" ); ```
Verve adapter, the IAB consent string (supposed to encode WHICH things you agreed to) just gets stuffed with “0” or “1”:
```java if ( !hasUserConsent ) userDataManager.setIABGDPRConsentString( "0" ); ```
could be sloppy plumbing instead of malice. but its the kind of thing that looks real bad if a regulator ever looks, because the consent signal isnt being passed through properly.
- the conflict of interest is the part thats actually clean cut
this is the strongest thing and its not even hidden, its just the org chart. AppLovin owns all of it:
- MAX runs the auction (the auctioneer) - AXON bids in that auction (a bidder) - Adjust is the attribution layer that decides which ad gets credit for a sale (the ref). they bought it in 2021.
so one company runs the auction, has its own guy bidding in it, AND owns the ref that decides if its own bid earned the credit. you can see the attribution pipe right in the demo app, this block is in every single ad type:
```kotlin val adjustAdRevenue = AdjustAdRevenue(AdjustConfig.AD_REVENUE_APPLOVIN_MAX) adjustAdRevenue.setRevenue(ad.revenue, "USD") adjustAdRevenue.setAdRevenueNetwork(ad.networkName) Adjust.trackAdRevenue(adjustAdRevenue) ```
Adjust (which AppLovin owns) gets the dollars, the network, the placement, every impression. the “independent” attribution and the ad seller are the same company. to be clear a conflict of interest is legal. plenty of companies have them. doesnt prove anything on its own but its worth looking at.
- MAX does see everyone elses bids
every adapter has a collectSignal() that hands the networks bid token to MAX. so the vantage point for the “AppLovin can see what everyone bids” claim is real. what i CANT show is whether AXON then uses that to sharpen its own bids (which would be the actual problem). thats in the closed core.
what i could NOT find in the repo (be skeptical of these):
- no persistent cross app ID. the “they track you everywhere” claim would be in closed core. - no COPPA / child flags anywhere (lines up with the reported sep 2024 removal but thats not a smoking gun). - no direct download / install code. - no auto click ad logic.
all the headline stuff is in code that isnt public.
So in conclusion of my vibe coded forensics:
verifiable: a real conflict of interest (auctioneer + bidder + ref, one owner), consent plumbing that doesnt pass signals through right, and the ability to see competitors bids. NOT verifiable: whether any of that is actually the illegal data harvesting the shorts allege, because that code is closed.
Wondering what y’all think? Im fucking sus of this whole thing.
Shorts: