SDK Trust Index
A free, public index that rates mobile ad and analytics SDKs on whether their code matches their location-data disclosures.
The SDK Trust Index is a free, public reference that rates mobile advertising and analytics software development kits (SDKs) on how well their disclosed data practices match what their code actually does. It focuses on precise location data. Publishers, regulators and platforms otherwise have no efficient way to check this themselves.
You can browse the Index on the SDK Trust Index page on pixalate.com. It’s updated quarterly.
How Pixalate evaluates an SDK
For each SDK, Pixalate:
- Manually reviews the SDK vendor’s privacy policy.
- Parses the SDK’s manifest files: Apple
PrivacyInfo.xcprivacyon iOS and the merged manifest on Android. - Runs source-code analysis on the SDK’s compiled distribution. Where it finds location collection in the code, it runs further code analysis to test for off-device transmission.
The Index covers SDKs distributed on Android and iOS. The same SDK is rated separately on each operating system, because the disclosure surfaces and permission models differ.
The two risk ratings
Every SDK gets two independent ratings. Each one is either Critical Risk Detected (Pixalate found a meaningful gap between disclosure and observed behavior) or Not Detected (Pixalate’s evaluation found no such gap).
The ratings are independent. An SDK can have serious exposure on its consumer-facing surface (the privacy policy) and none on its platform-facing surface (the manifest), or the other way around. Showing both lets the fix reach the right surface.
FTC Section 5 Violation Risk
Exposure under Section 5 of the Federal Trade Commission Act, which prohibits “unfair or deceptive acts or practices in or affecting commerce.” This rating is driven mainly by gaps between the SDK vendor’s privacy policy and the SDK’s behavior in code. Undisclosed collection, or undisclosed off-device transmission, is a deceptive omission to consumers.
App Store ToS Violation Risk
Exposure under the published guidelines of the Apple App Store and Google Play. These include Apple’s Privacy Manifest requirements, App Store Review Guidelines 5.1.1 and 5.1.2, App Tracking Transparency rules, Google’s Developer Program Policies and Android manifest-permission requirements. This rating is driven mainly by gaps between the SDK’s manifest declarations and its actual data behavior.
The underlying signals
Both ratings come from three observable signals. Each comes from a different technical source with its own reliability characteristics.
Declares Location Collection (Privacy Policy)
Whether the SDK vendor’s public privacy policy discloses collection of location data. Pixalate manually reviews the vendor’s website, identifies the operative privacy policy and checks it for location-specific disclosure language.
Declares Precise Location (Manifest)
Whether the SDK’s distributed manifest declares the location capability the platform requires. On iOS, that’s an NSPrivacyCollectedDataTypes entry for precise location in PrivacyInfo.xcprivacy. On Android, it’s the ACCESS_FINE_LOCATION permission in the merged manifest.
Collects Precise Location (Code Analysis)
Whether the SDK’s compiled or source code has a code path that reads precise location from the device. Pixalate detects this with static analysis of API call sites, framework imports and known location-collection patterns. Where it finds collection, it runs further code analysis to check whether the data is actually transmitted off the device.
How the ratings are determined
Pixalate compares the privacy policy declaration, the manifest declaration and the code behavior. Where the code shows collection and transmission but a disclosure surface (the policy or the manifest) is silent, Pixalate records a discrepancy:
- A privacy policy discrepancy drives the FTC Section 5 Violation Risk rating.
- A manifest discrepancy drives the App Store ToS Violation Risk rating.
Coverage and order
The Index covers mobile advertising and analytics SDKs that Pixalate detects across the Apple App Store and Google Play. SDKs are grouped by operating system (Android, iOS) and SDK type (Advertising, Analytics). Within each group, they’re ordered by install base: the number of distinct apps in which Pixalate has detected the SDK. The SDKs in the most apps come first.
The same SDK package can have different ratings on iOS and Android. That isn’t a contradiction: the disclosure surfaces, manifest formats and runtime permission models differ between the two platforms, and so do the SDK’s runtime paths.
For the full methodology, see the SDK Trust Index methodology download on pixalate.com.
Disclaimer
Pixalate’s SDK Trust Index Ratings (“SDK Index”) reflect Pixalate’s opinions that Pixalate believes may be useful to developers, regulators, platforms, advertisers, researchers, and others in the digital media industry. Any data shared is grounded in Pixalate’s proprietary technology and analytics, which Pixalate is continuously evaluating and updating. Any references to outside sources should not be construed as endorsements, affiliations, or associations with any third-parties. Pixalate is sharing this data not to impugn the standing or reputation of any entity, person or SDK, but, instead, to report research findings and trends pertaining to the period studied.
It is important to note however, that classification of a software development kit operator (“SDK operator”) within a particular risk tier does not mean that the SDK operator, its SDK(s), or any associated practices are in violation of any laws or regulations, including the Children’s Online Privacy Protection Act (COPPA) or any other global privacy framework. Further, the SDK(s) of an SDK operator(s) that appear(s) to present elevated risk signals does not mean that such SDK, or its operator, is failing to comply with applicable FTC Rules.
Pixalate’s determinations are based on a proprietary methodology that incorporates a combination of signals and automated processes. Additionally, with respect to SDK operators that appear to have characteristics that, in Pixalate’s opinion, may trigger related privacy law or regulatory compliance obligations and/or risk, such assertions reflect Pixalate’s opinions i.e., they are neither facts nor guarantees. While Pixalate endeavors to apply rigorous standards in compiling this SDK Index, no assurances or guarantees can be, or are, made as to the accuracy or completeness of any classification. This SDK Index, including all content set forth herein–constitutes Pixalate “Materials” under Pixalate’s Terms of Use, and is licensed subject to–and conditioned expressly upon–compliance with each of the applicable terms and conditions of such Pixalate Terms of Use.
Apple and the Apple logo are trademarks of Apple Inc; Google, Google Ad Exchange, the brand “Google Play,” its logos, and other Google logos are trademarks of Google LLC. These companies are not affiliated with, nor do they endorse or sponsor, any products, data, content, reports, materials or services associated with Pixalate. Any other brand logos, names, or trademarks not explicitly mentioned herein – but otherwise mentioned, displayed, or used in any of Pixalate’s materials, including this report – are the property of their respective owners.