A free, public reference database that rates ad SDKs and data brokers on whether their code behavior matches their privacy disclosures — built for app developers managing FTC Section 5 liability and app store delisting risk. Every rating is backed by source code analysis, privacy manifest evaluations, and privacy policy reviews.
Popularity has been mistaken for safety for too long. Every gap between what an SDK does and what it discloses is FTC Section 5 or app store liability that publishers inherit the moment they embed the SDK.
The Index covers 698 mobile advertising and analytics SDKs and data brokers distributed across iOS and Android, evaluated on precise location collection, transmission, and disclosure behavior.
Pixalate triangulates three independent sources for every SDK: static analysis of the compiled SDK source code, extraction of platform-facing privacy manifests (Apple PrivacyInfo.xcprivacy and the Android merged manifest), and automated plus human-verified review of the vendor's published privacy policy. The underlying evidence is published for public inspection alongside every rating.
Each SDK receives two independent risk indicators — an FTC Section 5 Violation Risk flag and an App Store Compliance Risk flag. Each surface is rated as either Critical Risk Detected or Not Detected. The dual-flag model exists because an SDK can carry serious FTC exposure with minimal app-store exposure, or the inverse, and each surface has its own remediation path.
Play Console documentation states that "it is your responsibility to ensure that any SDKs you are using" comply with Play policies. Apple's App Store Review Guidelines impose the same duty for iOS. Yet neither store offers a public, independent SDK rating tool to help developers meet that obligation.
Google's SDK Index displays self-declared checkmarks for SDKs that have committed not to violate Play policies — a signal developers may reasonably read as compliance assurance, but which does not validate code-level behavior. Google's index covers Android only. Apple's Privacy Nutrition Labels rely entirely on developer self-disclosure. Commercial scale databases such as 42matters and AppFigures rank SDKs by adoption footprint.
The FTC has brought Section 5 actions against X-Mode/Outlogic, InMarket, Gravy Analytics/Venntel, Mobilewalla, and earlier Goldenshores and InMobi. The 2020 HyperBeard action and 2024 Tilting Point settlement extended liability to app publishers for the data conduct of the third-party SDKs they ship.
App developers carry the FTC and app store liability for every SDK they ship — but they cannot audit closed-source code themselves. The Index surfaces discrepancies between what an SDK declares and what its code actually does, before integration ships.
Supply-side and demand-side platforms inherit liability from the SDKs embedded in the inventory they transact. The Index functions as a pre-auction and pre-buy due diligence layer for identifying high-risk SDK configurations entering the marketplace.
Regulators and enforcement bodies need independent, systematic evidence of non-compliance patterns across an SDK's full app network. The Index publishes the underlying source code, privacy manifest, and privacy policy evidence for every rating — built to be cited.
| Category | Pixalate Ad SDK Trust Index | Google SDK Index |
|---|---|---|
| Scope | ||
| # of SDKs Rated | 720 | 279 |
| iOS Coverage | ✓ | — |
| Privacy & Security | ||
| SDK Location Permission Access Risk (Privacy Manifest File Analysis) | ✓ | ✓ |
| Days Since Last SDK Update | ✓ | — |
| SDK Location Transmission Off-Device Risk | ✓ | — |
| SDK Privacy Policy Analysis | ✓ | — |
| Popularity & Reach | ||
| SDK App Reach | ✓ | ✓ |
| SDK User Reach | ✓ | — |
| SDK Reach on Child-Directed Apps | ✓ | — |
| Top Apps With SDK Installed | ✓ | — |
| SDK Version SOV | — | ✓ |
| SDK Retention | — | ✓ |
| SDK API Level | — | ✓ |
Static analysis of the SDK's compiled code. Detects whether precise location is processed, and whether network communications transmit those coordinates off-device.
What the SDK formally declares to platforms — Apple's PrivacyInfo.xcprivacy on iOS, the merged AndroidManifest.xml on Google Play. The app-store-facing disclosure surface.
What the SDK vendor tells the public. Whether a policy exists, and whether it discloses location collection. The consumer-facing disclosure surface.
The SDK Index is free and open to the public. Searchable by SDK name. Ranked by estimated user reach. Updated quarterly. Code snippets and privacy manifest evidence published alongside each rating.
