r/stocks Jun 16, 07:23 PM
Applovin or mclovin (fraud) A friend asked me to go over two short reports since im slightly more technical and these are my findings:
quick background:
there have been a few short reports on $APP (Muddy Waters being the big one) all basically saying their ad targeting works because theyre harvesting data they shouldnt have. Stock dropped since. i wanted to see how much of the technical claim is real so i went through the public MAX SDK on github.
one thing you need to know before anything else. the public repo is ONLY the mediation adapters (the glue between MAX and other ad networks). the actual AXON core that does the bidding is closed source and not in the repo. so all the juicy stuff (cross app tracking, the kid stuff, stuff from the short reports etc) is in code i literally cannot see. not gonna pretend otherwise.
tldr: the conflict of interest is 100% real and visible. the consent handling is genuinely sloppy. the actual smoking gun is in closed code nobody outside the company can audit, so i cant confirm it and honestly neither can the shorts.
consent flags get passed off with zero verification the partner actually honors them
17 adapters take your opt out flag, turn it into a string, hand it to the third party network and walk away. no callback, no check. the adapters whole job is “ok i told them.”
```java
if ( hasUserConsent != null && !hasUserConsent )
networkExtras.putString( "npa", "1" ); // non personalized ads
if ( isDoNotSell != null && isDoNotSell )
networkExtras.putInt( "rdp", 1 ); // restrict data processing
```
also worth noting opting out just means you see a non personalized ad. theres no skipTracking() anywhere. you opting out changes the ad, not whether the event gets logged.
the consent strings themselves are mangled
Fyber adapter, the entire CCPA privacy string crushed down to three hardcoded values:
```java
InneractiveAdManager.setUSPrivacyString( isDoNotSell ? "1YY-" : "1YN-" );
```
Verve adapter, the IAB consent string (supposed to encode WHICH things you agreed to) just gets stuffed with “0” or “1”:
```java
if ( !hasUserConsent )
userDataManager.setIABGDPRConsentString( "0" );
```
could be sloppy plumbing instead of malice. but its the kind of thing that looks real bad if a regulator ever looks, because the consent signal isnt being passed through properly.
the conflict of interest is the part thats actually clean cut
this is the strongest thing and its not even hidden, its just the org chart. AppLovin owns all of it:
- MAX runs the auction (the auctioneer)
- AXON bids in that auction (a bidder)
- Adjust is the attribution layer that decides which ad gets credit for a sale (the ref). they bought it in 2021.
so one company runs the auction, has its own guy bidding in it, AND owns the ref that decides if its own bid earned the credit. you can see the attribution pipe right in the demo app, this block is in every single ad type:
```kotlin
val adjustAdRevenue = AdjustAdRevenue(AdjustConfig.AD_REVENUE_APPL