Every app marketer relies on them. Almost none can name all the ones shipping in their own binary. A new explainer from PPC Land breaks down the tracking SDK — the block of third-party code that quietly makes mobile measurement possible — and the picture it paints should make growth teams sit up.
What a tracking SDK actually is
An SDK is a software development kit: libraries, docs and sample code a vendor supplies so developers don’t build an integration from scratch. The tracking variety exists to push data outward. Once initialised, it watches sessions, screens, purchases and ad exposure, bundles that with device and network identifiers, and ships it over HTTPS to servers the app publisher does not own.
On the web, you’d solve this with a tag — a few lines of JavaScript you can paste in and delete by lunchtime. Apps run in sandboxes, ship as compiled binaries and pass through store review. So there is no editable tag. Vendor code has to live inside the app.
That single architectural fact is why removing an SDK is a release cycle, not a checkbox.
How the data actually moves
Integration starts in a dependency manager: CocoaPods or Swift Package Manager on iOS, Maven via Gradle on Android. The developer pins a version, builds, and the vendor’s framework becomes part of the shipped app. Initialisation happens early in the app lifecycle with an account key.
Collection then splits two ways:
- Automatic events — first launch, session start and end, foreground/background transitions, crashes, and in ad libraries, ad requests and impressions. Google says its Mobile Ads SDK automatically collects IP address, product interactions, diagnostic data and device/account identifiers.
- Manual events — the ones marketing asks for and engineering wires up: registration, tutorial complete, add to cart, subscription, purchase with revenue and currency.
Events queue locally and go out in batches to save battery and survive offline gaps. The payload carries event name and properties, timestamp, session ID, device model, OS version, locale, network type, server-observed IP, and where allowed the IDFA or Google Advertising ID.
Attribution libraries add one more layer: an ad click passes through a tracking link that logs campaign, ad set, creative and device signals before the store redirect, then the SDK registers the install and the vendor matches it back.
Why it matters: liability lands where collection happens
This is the part performance teams underrate. Because collection happens inside the SDK, so does exposure.
On 3 September 2025, a federal jury awarded 425.7 million dollars in Rodriguez v. Google over Firebase collecting data after users had disabled Web and App Activity — trial testimony put Firebase in roughly 1.5 million apps, including 97% of the top thousand Android apps. In August 2025, a San Francisco jury found Meta violated the California Invasion of Privacy Act through the Flo app’s SDK integration, traced back to June 2016.
Regulators are hitting the supply side too. The FTC moved against InMarket Media in January 2024, requiring an SDK supplier assessment programme, and closed the Kochava location case with a stipulated order signed on 4 May 2026.
The four recurring complaints
PPC Land flags weight (binary size, init time, network chatter that marketing requests and engineering pays for), opacity (a privacy manifest describes what a vendor says its code does), version drift, and abuse.
Version drift is the sneaky one. The Facebook Login SDK flipped Fast App Switch from opt-in to default between versions 18.0.2 and 18.0.3 — an authentication funnel changed with no product decision behind it.
What to do this quarter
Run an SDK inventory. List every library in your binary, its owner, its version, and the business case that justified it. Kill anything nobody can defend.
Then check the compliance calendar: Apple has required privacy manifests and valid signatures for listed third-party SDKs since 1 May 2024, and TCF v2.3 became mandatory on 28 February 2026.
Finally, understand that switching vendors is not swapping a dependency — platform integrations specify library versions and initialisation sequences per partner, so a change means re-certifying relationships. Choose accordingly.
Source: PPC Land
