High Risk CTV Apps 2.0 | Pixalate Docs

High Risk CTV Apps 2.0 is a daily list of connected TV (CTV) apps for pre-bid blocking. It covers apps on nine CTV operating systems: Android, FireOS, Linux, Roku, Samsung, Sony, tvOS (Apple TV), LG webOS and Windows. The feed combines historical invalid traffic (IVT) rates, app store compliance, app-ads.txt compliance, privacy risk and inventory quality signals, and tags each app with one or more risk type codes so you can see why it’s listed.

Apps are listed when app-level blocking is the appropriate control, meaning impression-level filtering can’t reliably separate valid traffic from invalid traffic. Inclusion is deterministic: an app either meets the threshold for a risk type or it doesn’t.

High Risk CTV Apps 2.0 Standard and Enterprise are currently labeled beta.

Standard and Enterprise

The two versions differ in how much detail the riskType column carries.

	Standard	Enterprise
`riskType` when an app has one risk type	The risk type code	The risk type code
`riskType` when an app has several risk types	The string `various`	Every code, comma-separated (for example `highSivt,abandonedApp,missingPrivacyPolicy`)
`probability` column	Yes, always `1`	No
High Risk App data points in Analytics scheduled reports and the Analytics Reports API	No	Yes

Standard keeps the column layout that existing integrations expect. Enterprise lets you build blocking rules on specific combinations of risk types.

Access to Standard requires acceptance of Pixalate’s updated subscription terms. Enterprise requires a subscription upgrade. Contact your Pixalate account manager for either.

Risk types

Risk type	Code	What it means
High GIVT	`highGivt`	General invalid traffic (GIVT) rate above Pixalate’s threshold.
High SIVT	`highSivt`	Sophisticated invalid traffic (SIVT) rate above Pixalate’s threshold.
Missing privacy policy	`missingPrivacyPolicy`	The app has no privacy policy.
Abandoned app	`abandonedApp`	The developer hasn’t updated the app, so it may be unmaintained, insecure or out of line with current app store requirements.
Missing app-ads.txt	`noAdsTxt`	The app generates ad impressions without a valid app-ads.txt file, which indicates unauthorized inventory.
VPC bypass risk	`vpcBypass`	A child-directed app transmits personal data without verifiable parental consent (VPC), creating COPPA compliance exposure.
Developer anonymity	`developerAnonymity`	The developer’s contact information is missing or can’t be verified.
Delisted app	`delistedApp`	The app was removed from its app store but still generates ad traffic.
Made for advertising	`mfaApp`	The app is designed mainly to generate ad impressions rather than to serve users, including apps that use ad stacking and other manipulative ad placement.

Which risk types Pixalate can assess differs by CTV operating system, depending on how much transparency and metadata each platform provides. Pixalate plans to expand coverage for more operating systems.

highGivt and highSivt are the only IVT-based risk types. The others flag app store compliance, developer transparency, privacy and inventory quality risk, so an app on this list isn’t necessarily flagged for IVT.

File format and cadence


Format	CSV
File name	`CtvHighRiskApps_YYYYMMDD`
Update frequency	Daily

For access, delivery and polling, see Delivery and integration. The list is also available through AWS RTB Fabric; ask your Pixalate account manager.

Schema

Column	Type	Standard	Enterprise	Description
`osName`	string	Yes	Yes	The operating system the app runs on, for example `webos`.
`platformName`	string	Yes	Yes	The platform where the app is available, for example `lg`.
`appId`	string	Yes	Yes	The app’s identifier, if available.
`bundleId`	string	Yes	Yes	The bundle ID associated with the app.
`riskType`	string	Yes	Yes	Standard: one risk type code, or `various` when several apply. Enterprise: every applicable code, comma-separated.
`probability`	float	Yes	No	Always `1`.

Example rows from a Standard file, with placeholder IDs:

osName,platformName,appId,bundleId,riskType,probability
webos,lg,100001,com.sampleapp.1,abandonedApp,1
webos,lg,100002,com.sampleapp.2,various,1

In an Enterprise file, the second app would list each of its codes instead of various (for example abandonedApp,delistedApp), and there’s no probability column.

Apply it pre-bid

Match on bundle ID and OS

Match on bundleId + osName at minimum, so you don’t block an app on a different operating system that shares the same identifier. When the app also has an appId, match on appId + bundleId + osName.

Filter by risk type

Use riskType to block according to your risk tolerance. For example, you might block apps flagged for highSivt or mfaApp but allow apps flagged only for abandonedApp. If you work directly with a publisher on the list and can see its traffic quality, you can use the codes the same way to decide which risks you accept.

Standard: filter on single-code rows. Rows marked various have more than one risk type, so decide whether to block all of them, or use Enterprise to see the codes.
Enterprise: split riskType on commas and block when any code is in your block set.
Don’t filter on probability. It’s 1 for every row.

Why apps join and leave the list

Apps are evaluated over a rolling look-back window.

IVT-based risk types (highGivt, highSivt): an app ages off when its IVT rates fall below the thresholds over the look-back period.
Compliance-based risk types (for example missingPrivacyPolicy or abandonedApp): an app is removed when it resolves the underlying issue.

An app leaves the list automatically when it no longer meets the criteria for any risk type. It can be added again later, for the same or a different risk type. Pixalate compiles the list from traffic data, third-party data and app store metadata.

How the list relates to IVT reporting

Impressions from apps on this list aren’t automatically classified as IVT in Analytics. This follows the MRC’s Invalid Traffic Detection and Filtration Interim Update Memo, which separates impression-level IVT measurement from app-level risk assessment.

Moving from 1.0

High Risk CTV Apps 1.0 is being retired. If you still have a 1.0 integration, update it for 2.0:

Filter on risk types, not probability. 1.0 scored apps with a probability between 0.5 and 1 and suggested starting at a 0.75 threshold. In 2.0, probability is always 1.
Replace hard-coded 1.0 risk type names with the 2.0 codes in the risk types table.

Contact your Pixalate account manager to set up 2.0 access.

High Risk Mobile Apps 2.0: the same model for iOS and Android apps.
Malformed CTV bundle IDs: CTV bundle IDs that are malformed or can’t be identified.
Delisted apps (DEFASE): CTV apps removed from their app stores.
MFA data feeds: made-for-advertising risk for CTV apps, mobile apps and websites.
CTV device ID feed: block invalid CTV devices rather than whole apps.

Questions? Email support@pixalate.com.