{ "docId": "019dd923-622c-750b-8b97-b391eed1d446", "docSlug": "b67365e28a44", "documentTitle": "AppLovin (APP)", "authorId": "51_Muddy_Waters", "authorName": "Muddy Waters Research", "documentKindSlug": "activist-deck", "documentKindLabel": "Activist deck", "sourceTypeSlug": "short_seller", "sourceTypeLabel": "Short seller", "presentationDate": "2025-03-27 00:00:00", "orientation": "landscape", "aspectRatio": 1.7777778, "pageNumber": 41, "pageCount": 50, "prevPage": 40, "nextPage": 42, "slideType": "appendix_methodology", "function": "present_framework", "density": "dense", "nDataPoints": 0, "notes": "This slide details the mechanism of the alleged fraud/privacy violation.", "elementsJson": [ "headline_text", "bullet_list", "footnote", "logo_grid" ], "metadataConfidence": 1, "imagePath": null, "slideHref": "/slides/019dd923-622c-750b-8b97-b391eed1d446/41", "deckHref": "/decks/019dd923-622c-750b-8b97-b391eed1d446", "deckJsonHref": "/decks/019dd923-622c-750b-8b97-b391eed1d446.json", "deckAnchorHref": "/decks/019dd923-622c-750b-8b97-b391eed1d446#slide-41", "components": [ { "bbox": null, "kind": "callout", "text": "The end result is APP uses the PIG ID to win auctions and win a number of clicks for users that were already poised to purchase.", "attrs": null, "subkind": null, "toolName": "Visual emphasis", "toolSlug": "visual-emphasis", "confidence": null, "componentId": "019dd953-25b7-709e-b8c7-4641f56a8a33", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.65, "w": 0.9, "x": 0.05, "y": 0.18 }, "kind": "list", "text": "Trigger: A user goes to an e-commerce site that has the pixel installed, takes a triggering action such as adding an item to a cart and beginning a purchase process, then pauses leaving items stranded in the cart (which is extremely common).\nData Theft: Pixels often ingest three distinct types of data: a third-party ID such as (Google, Meta, Tiktok, Snap, etc.) or other data such as link UTMs, and other Shopify settings labeling them as a “key”. A Shopify event items such as its “Y Cookie”, purchase token, checkout token, etc. are labeling as “wrt” or “wrt3p” and finally associated with APP’s hidden Compass Tokens (CT). The CT is used in the Ad mediation and Ad auction process.\nObfuscation: Multiple pixels mask tracking; IDs are linked between pixels via an event ID (the “connectEventKey”) before being sent to APP’s servers.\nPersistent Identity Graph (PIG): APP’s algorithm ingests and stitches together user IDs and users’ data to create the PIG ID. By associating multiple 3rd party IDs with behavioral signals from Shopify and its own Compass Token, along with the typical fingerprinting data such as location, telemetry, hardware information, etc. APP has functionally de-anonymized these anonymous IDs and built a profile of a user without technically directly using PII (Personally Identify Information); instead, APP is building a synthetic representation of that user, the PIG.\nAPP’s Max Auction: The in-app ad auction wherein an app calls up for an ad and a competitive auction is held. The APP network installed CT is called on. The algorithm uses the PIG data, estimates a user’s value, and delivers a bid via the CT to the MAX Mediation auction.\nTargeting/Retargeting: After identifying the highest value users, APP bids aggressively, and when victorious aggressively shows ads for the product the user was just looking at, often dozens of times a day.\nTracking: If the user clicks an ad for that product, the exact same value of the CT is relabeled as “alart” and added to the URL. The user is identified and tracked across web e-commerce sites and also across mobile games, which we believe is a violation of privacy TOS.\nComing full circle: The process begins again however with “alart” value taken from the URL and is relabeled for a 3rd time as the “art” value.\nThis PIG tech is unprecedented for ads—but it isn’t utilized for AI models where synthetic data is often utilized to train models.\nThe end result is APP uses the PIG ID to win auctions and win a number of clicks for users that were already poised to purchase.\nA set of diagrams mapping this process are in Appendix.", "attrs": null, "subkind": "bullet", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "e8064262-5b5b-451d-9714-2e518ef71e43", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.03, "w": 0.9, "x": 0.05, "y": 0.13 }, "kind": "paragraph", "text": "Based on our research and understanding of the ad behavior and code, we outline the ad rigging process:", "attrs": null, "subkind": "paragraph", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "7ec8936b-2074-4f11-862b-1d6b2156054a", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.1, "w": 0.9, "x": 0.05, "y": 0.85 }, "kind": "source-note", "text": "1 UTMs (Urchin Tracking Modules) are custom tags that can be added to a URL. They provide additional information to analytics tools like Google Analytics, and provide an understanding of traffic sources. When a URL with UTM parameter is clicked, the tags are sent back to the analytics tool which then logs data about the visitor and their behavior. admetrics.io/en/post/utm-parameters-for-ad-tracking\n2 The CTs were found by our team when searching “the shared plist file” stored locally in the gaming apps and on the device.", "attrs": { "numbered": true }, "subkind": null, "toolName": null, "toolSlug": null, "confidence": null, "componentId": "40162417-c27e-4d72-b813-5b02938d7fd8", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.05, "w": 0.6, "x": 0.05, "y": 0.05 }, "kind": "title", "text": "Technical Explanation of How PIGing Gives APP Black Edge", "attrs": null, "subkind": "headline", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "00388cb6-bf49-4696-ab37-9d603d5e926e", "frameworkName": null, "frameworkSlug": null } ], "metrics": [], "tools": [], "frameworks": [ { "name": "causal-chain", "slug": null, "matchId": "2643ac6b-3c16-4c7c-a9fa-96e8a2a69d1f", "evidence": "The slide outlines a sequential process of ad rigging from trigger to end result.", "confidence": 0.8 } ], "arcBeats": [], "loops": [], "imagePathAlt": null, "thumbSrc": null, "thumbSrcAlt": null, "locked": true }