An app bundle ID is the identifier that tells a buyer which application an advertisement will appear in. On the web a domain does that job: the bid request carries a page address, and anyone can see which site is selling. Apps have no address bar. Programmatic advertising therefore borrowed a label from the app stores, placed it in a field called bundle inside every OpenRTB bid request for app inventory, and built targeting, exclusion lists, seller authorisation and fraud detection on top of it.

The name is a historical accident. Under current industry standards the value is not necessarily the bundle identifier a developer writes into code. It is the store ID, the value an app store uses to list the product. On Google Play the two coincide. On Apple's App Store they do not, and much of the confusion around the term starts there.

How the identifier travels

The App object in a bid request describes inventory that does not run in a browser. The IAB Tech Lab's OpenRTB 2.6 specification defines its bundle attribute as the store ID of the app. For Google Play, according to the specification, that means a package name in the form com.foo.mygame; for Apple, a numeric ID. A second attribute, storeurl, carries the address of the store listing so a bidder can tell which store issued the value. A third, app.id, is an exchange's internal reference and means nothing outside that exchange.

Formats vary by store. Guidelines from the IAB Tech Lab for connected television (CTV) use the streaming service Tubi as a worked example: 886445756 on iOS and tvOS, com.tubitv on Android, 41468 on Roku, the Amazon Standard Identification Number B075NTHVJW on Fire TV, G15115002089 on Samsung and 70503 on LG. Six stores produce six formats for one app. For devices with no store at all, the guidance asks publishers to construct a value in the form appname.deviceplatform.

Several other systems reuse the value. VAST, the Video Ad Serving Template, passes it to tracking pixels through the [STOREID] and [STOREURL] macros. Publishers can list store IDs in the bid request's bapp array to block ads promoting particular apps, and a bid carries its own bundle attribute naming the app an advertisement promotes, so the exchange can compare the two.

The most consequential reuse is app-ads.txt. A crawler takes the store ID, opens the store listing, reads the developer website address and fetches a text file from the root of that domain naming every seller authorised to sell the app's inventory. If the bundle points to the wrong listing, verification fails before it begins.

On the buy side the identifier is a targeting key. Display & Video 360 (DV360), Google's demand-side platform (DSP), lets a line item include or exclude apps by store ID, according to its help centre, up to a combined 10,000 apps and URLs per line item; beyond that, buyers must use channels, which are reusable lists. Its bulk upload files write the values with a platform prefix, as in APP:422689480. Developers create the listing, stores assign or confirm the ID, software development kits (SDKs) or server-side ad insertion vendors populate the request, and supply-side platforms (SSPs) forward it. Nothing in that chain authenticates it.

From package name to store ID

The field predates most of the controls that now depend on it. OpenRTB for mobile 1.0, released in February 2011 after Nexage proposed it, grew into OpenRTB 2.0 in January 2012, which merged display, mobile and video into one specification. That version listed bundle as recommended and described it as the application bundle or package name, meant to stay unique across multiple exchanges.

The example given was Android-shaped. Apple's equivalent, the developer-set reverse-domain string known as CFBundleIdentifier, does not appear on public App Store pages, while the numeric store ID does. Sellers filled the field with whichever they had, and buyers inherited both.

Connected television multiplied the problem. On December 20, 2019 the IAB Tech Lab's OTT Technical Working Group published guidance written by Amit Shetty recommending store IDs wherever a store exists, and stating that IDs not unique within a store, such as the iOS bundle id, should not be used. Brian Garey of the video platform SpotX told MediaPost at the time that platforms, device makers, developers and SSPs had each been generating "their own app ID". The guidance was updated in September 2020 to add Philips and in October 2020 to revise Roku.

Authorisation arrived in parallel. The IAB Tech Lab released app-ads.txt in beta for public comment until February 4, 2019, extending the 2017 ads.txt standard to apps and to over-the-top video. Google began blocking unauthorised app inventory in AdMob and Ad Manager from August 27, 2019. Pixalate reported that implementation grew 5,550% that year, with 73% of the top 1,000 programmatic iOS apps carrying a file. In March 2021 the inventorypartnerdomain directive, added in version 1.0.3, let apps and content owners declare shared selling rights. OpenRTB 2.6, published in April 2022, rewrote the bundle definition around the store ID and added Channel and Network objects, giving sellers somewhere to put a channel name other than the bundle string.

Why buyers depend on it

App lists are the in-app equivalent of domain lists, and every exclusion, suitability rule and supply-path decision for apps resolves to this string. The bidstream exposes it to every bidder, winner or loser, which makes it one of the few pieces of context all parties share.

Measurement now builds on it too. Pixalate's OpenEPG Index, launched June 18, 2026, maps bundle IDs in open-exchange bid requests to 5,108 shows across 224 channels without any publisher opt-in. Platform policy has hardened: AdMob made app-ads.txt a requirement from January 2025, and the IAB Tech Lab added Samsung, Vizio and LG to its app-ads.txt aggregator in December 2023. For television, LG's webOS explainer sets out how store-assigned identifiers and app-ads.txt jointly determine whether a buyer can verify a seller.

Where it breaks

The core weakness is that the value is self-declared. An SDK or a server can write any string into the field, and no cryptographic check ties it to the software actually running. HUMAN's Konfety investigation found more than 250 Google Play decoy apps with evil twins distributed elsewhere, which spoofed the decoys' identifiers and peaked at 10 billion requests a day. Amit Shetty, vice president of product at Pixalate, said fraudsters modify the bid stream and other signals to impersonate CTV devices. The Media Rating Council (MRC) added CTV bundle ID spoofing to its invalid traffic guidance on April 24, 2024.

Inconsistency is a separate failure. Pixalate reported in September 2022 that 40% of Roku apps and 30% of Fire TV apps were targeted under more than one bundle ID, and in May 2024 that between 26% and 67% of CTV bundle IDs were malformed or fraudulent, depending on the platform. Both figures come from a vendor that sells bundle-to-store mapping, and the methodology has not been independently audited.

Stores also change underneath the field. Pixalate counted 869 CTV apps delisted in the fourth quarter of 2023, 147 of them still running ads. And a valid ID still says only what an app claims to be. Deepsee.io found bundle identifiers in AI companion apps pointing to unrelated products, one running under a QR-scanner identifier.

Terminology remains unsettled. Apple documents its bundle ID as case sensitive, and HUMAN's integration documentation warns against changing its case, yet many DSP interfaces still call the Android value a "bundle ID" and the iOS value an "App ID". A buyer's exclusion list can therefore be correct in one platform and silently incomplete in another.

Not the same as

Apple bundle identifier. The CFBundleIdentifier, such as com.company.app, is set by the developer in Xcode for signing and provisioning. It is what Apple calls a bundle ID, and it is precisely what OpenRTB guidance says not to send for iOS.

Exchange app ID. The app.id attribute is an exchange-specific key. The same app carries different app.id values on different SSPs.

Android App Bundle. The .aab file is a publishing format, required for new Google Play apps since August 2021, according to Wikipedia. It packages code, not an advertising identifier.

Advertising identifier. The device.ifa field identifies a device for audience purposes. The bundle identifies the application, and carries no user information.

Recent developments

DoubleVerify reported on May 7, 2026 that fraudulent CTV apps detected in 2025 were ten times the 2024 count. IAB Europe's April 2026 guide described the PARETO operation, in which nearly one million infected Android devices spoofed CTV environments at around 650 million bid requests a day. On July 7, 2026 HUMAN announced it had disrupted NewsJunkie, which spoofed device, app and IP details through server-side ad insertion at close to two billion requests daily per seller.

The response is moving from declaration to attestation. Version 11.0 of the Trustworthy Accountability Group's certification, released in July 2026, requires sellers of owned apps in Apple's App Store and Amazon's Fire TV store to support device attestation through the Privacy Pass protocol and Open Measurement SDK 1.6 or later. Attention vendors have begun treating the identifier as an audit unit: PPC Land reported today that Adelaide's free media quality audit accepts lists of domains or app bundle IDs between 200 and 100,000 rows, without stating how a streaming app's bundle is assigned between CTV and online video.

Timeline

  • February 2011: OpenRTB for mobile 1.0 released after a proposal from Nexage
  • January 2012: OpenRTB 2.0 released, listing bundle as a recommended App object attribute
  • 2017: IAB Tech Lab publishes ads.txt for websites
  • Late 2018: app-ads.txt released in beta, with public comment open until February 4, 2019
  • March 2019: app-ads.txt finalised by the IAB Tech Lab
  • August 27, 2019: Google begins blocking unauthorised app inventory in AdMob and Ad Manager
  • December 20, 2019: IAB Tech Lab OTT Technical Working Group publishes store-assigned app identification guidelines
  • September and October 2020: Guidelines updated to add Philips and revise Roku
  • March 2021: inventorypartnerdomain added to ads.txt and app-ads.txt in version 1.0.3
  • April 2022: OpenRTB 2.6 redefines bundle as the store ID and adds Channel and Network objects
  • September 9, 2022: Pixalate reports 40% of Roku and 30% of Fire TV apps traded under multiple bundle IDs
  • December 2023: Samsung, Vizio and LG added to the IAB Tech Lab app-ads.txt aggregator
  • April 24, 2024: MRC interim invalid traffic update adds CTV bundle ID spoofing
  • May 2024: Pixalate reports 26% to 67% of CTV bundle IDs malformed or fraudulent by platform
  • Mid-2024: HUMAN discloses the Konfety evil twin operation
  • January 2025: AdMob requires app-ads.txt verification
  • May 7, 2026: DoubleVerify reports a tenfold rise in fraudulent CTV apps
  • June 18, 2026: Pixalate launches the OpenEPG Index built on bundle ID signals
  • July 7, 2026: HUMAN announces disruption of NewsJunkie
  • July 2026: TAG certification version 11.0 adds device attestation requirements for app sellers
  • August 3, 2026: Deepsee.io research on AI companion app identifiers reported
  • September 20, 2026: Adelaide media quality audit reported accepting app bundle ID lists

Summary

Who. App developers create store listings; Apple, Google, Roku, Amazon, Samsung, LG and other stores assign or confirm the identifiers; SDKs, server-side insertion vendors and SSPs place them in bid requests; DSPs, verification firms and attention vendors read them. The IAB Tech Lab defines how they are expressed.

What. An app bundle ID is the store-assigned identifier of the application where an impression runs, carried in the OpenRTB app.bundle field and in VAST macros. It is the in-app counterpart of a website domain.

When. The field appeared in OpenRTB 2.0 in January 2012, was pinned to store IDs for CTV in December 2019 and redefined in OpenRTB 2.6 in April 2022, and is now being supplemented by device attestation.

Where. It sits in every programmatic request for mobile and CTV app inventory, in app-ads.txt verification, and in DSP targeting and exclusion lists.

Why. Buyers need to know which app they are paying for. Because the value is declared rather than proven, it is also the field fraud operations most often forge, which is why authorisation files, mapping services and attestation have grown up around it.