The County of San Diego announced a civil complaint against AppLovin Corporation on October 5, 2026, alleging that the Palo Alto-based mobile advertising company routed sexual and violent advertisements into games rated as safe for young children and collected data from minors despite device-level protections. The 62-page filing, brought by County Counsel Damon M. Brown in the name of the People of the State of California, asks the San Diego Superior Court for an injunction, restitution and civil penalties.

In Short

San Diego County has taken AppLovin, a company that places ads inside mobile apps and games, to court, saying its system put sexual, violent and drug-related ads in front of young children and gathered their personal information. It matters to parents, game developers and advertisers because the complaint says phone safety settings did not stop the ads and that some ad taps that advertisers paid for were not real choices by the people tapping. The practical change is that the allegations are now on a public court record, while AppLovin's published policies say it does not knowingly serve ads to children and no court has made any finding.

What the complaint alleges

The document pleads two causes of action: the False Advertising Law (Business and Professions Code sections 17500 and following) and the Unfair Competition Law (sections 17200 and following). Its factual section runs along four tracks: advertisements in children's games, the removal of a child-protection signal from AppLovin's code, the collection of personal data, and the way ads register clicks and installs.

Advertisements in games rated for young children

AppLovin sits between app developers and advertisers. Developers add its MAX SDK, a software development kit (SDK) offered free of charge, to import advertisements; advertisers pay AppLovin to reach users; and AppLovin passes a portion of those payments to the developers. According to the complaint, the SDK is embedded in thousands of games rated suitable for children as young as four, or rated "E for Everyone", and delivers advertisements depicting graphic sex acts and violent sexual assault "even when parental controls are fully enabled."

The filing leans on three rounds of testing. Investment firm Fuzzy Panda Research, according to the complaint, "tested devices for children (7- & 12-year-old girls and a 10-year-old boy) which were all configured as <13 kids and which had parental controls fully enabled." The advertisements it recorded depicted "Sex Acts" and "Violent Sexual Assault & Suicide", among other scenes.

Counsel's own investigation in January 2025 used a Samsung tablet belonging to a six-year-old with Google Family Link controls switched on. In Street Dude, a game rated suitable for children as young as 10, the tablet received advertisements with animated depictions of sex toys, bondage and intercourse. In Rope Savior 3D, a Lion Studios title rated "E for Everyone" with more than 10 million Android downloads, it received promotions for PolyBuzz, an AI chat platform rated "M for Mature", and for an 18+ real-money game called 8 Ball Strike. A second Lion Studios game, Gas Station, Inc., carried an advertisement for another 18+ title.

A second round ran in July and August 2026. That work, per the complaint, found child-inappropriate content in "hundreds of top-downloaded applications rated as safe for children." An Android device configured for a six-year-old received advertisements for cannabis gummies in Hexasort, a Lion Studios game with more than 10 million downloads. Promotions for alcohol and vaping products appeared in other games carrying the "E for Everyone" rating on Google Play. Further examples, including a dating app and PolyBuzz, ran in Animal Shelter Simulator (more than 1 million downloads), Bubble Shooter: Bubble Pop (more than 10 million) and BMX Boy (more than 100 million).

Every advertisement identified by counsel passed through the MAX SDK and through AppDiscovery, AppLovin's own ad network, the filing states. AppLovin has said that AppDiscovery uses its Axon AI engine so that "[t]he need for manual optimization and campaign filtering is effectively eliminated[.]" From that statement the complaint draws its conclusion: AppLovin's systems, and not an advertiser's instruction, steer the material toward young players.

AppLovin's published Ad Content Policies, the complaint notes, say advertisements "should not include sexual or sexually suggestive content, including suggestive movements, sounds, gestures, poses, or a focus on private areas." The Policies for Demand Partners and for Publishers likewise prohibit "explicit, obscured or implied sexual acts." The filing treats these statements as misrepresentations, because the network "systematically disseminates" the content they forbid.

A child-protection flag removed in September 2024

Until September 2024, AppLovin's SDK carried a mechanism called "COPPA Support", a reference to the Children's Online Privacy Protection Act. A developer's app could ask for a date of birth and, if the user was under 13, trigger a flag that told the SDK to suppress behavioral tracking, limit data collection and disable targeted advertising altogether. The complaint cites the changelog for version 13.0.0, dated September 15, 2024, as the point at which that support disappeared.

AppLovin's terms now state that its software may not be initialized or used "in connection with an end user who qualifies as a 'child[.]'" Its integration guides say the age-restriction call "is no longer supported." The complaint sets that position against the company's marketing, which promotes the SDK in games such as Pixel Flow! and Block Blast, both rated "E for Everyone". With the flag gone, the filing argues, AppLovin's software tools "treat virtually all users as though they are adults."

Data collection

The complaint lists five categories of information it says AppLovin gathers: precise geolocation, even when location services are disabled; behavioral data such as in-app purchases and click choices; data on which other apps and SDKs sit on a device; accelerometer and gyroscope readings; and hardware details including CPU and GPU specifications, battery information and exact boot-up time to the millisecond. Pieced together, the filing says, such signals could reveal a child's home and school addresses and "even whether they are asleep or awake."

Both Apple's iOS and Google's Android blank out the mobile advertising ID on devices set up for children under 13. On iOS the identifier becomes a string of zeros; on Android the Advertising ID is obscured. The complaint, drawing on Fuzzy Panda and Muddy Waters and on verification by Permanent Record Research, says AppLovin replaces the missing identifier with its own "Compass Random Token", a value that persists across apps, including on devices marked Do Not Track. Fuzzy Panda's test on a device designated as belonging to a 10-year-old found a unique number that followed the child between apps, additional data sufficient to assign a fingerprint, and a combination with third-party data broker information. An analysis of an older SDK release, from late 2021, counted at least fifty distinct attributes taken from children's devices.

Muddy Waters described how the collected data feeds an identity graph, which it calls a Persistent Identity Graph. The complaint uses that description to explain the commercial value of the information: such a structure ties identifiers to one person across channels, and AppLovin's chief executive, Adam Foroughi, has said the company's "competitive advantage is its own served-ad history: what it showed, to whom, and what happened." The data also trains Axon AI, whose models, in AppLovin's own words, "train and optimize on a continual basis."

Against that backdrop sit the company's public statements. Foroughi wrote in a March 31, 2025 blog post that the SDK "collects only basic device information from public APIs the OS provides and allows," and that when users "opt out, we don't create alternative accurate and persistent identifiers, typically called device fingerprints." AppLovin's privacy policy states that it "does not knowingly collect personal information from children or serve advertisements to children." The complaint calls these statements false.

Clicks, installs and billing

The fourth strand concerns advertisers rather than children. According to the complaint, AppLovin builds dark patternsinto its advertisements: a "close" button placed off the visible screen, or programmed so that pressing it registers as an ad click and opens the app store; a ">>" skip button that is recorded as an affirmative interaction; fake instructions such as "drag to move" or "swipe to run" that redirect to the store when touched; and inaction treated as an instruction, with the store opening once the in-ad timer expires.

Screenshots captured on August 29 and 30, 2026 in the Gas Station, Inc. app, on a Samsung Galaxy tablet with Family Link enabled and a declared user age of six, compare an AppLovin advertisement with ones from Google Ads and Mintegral. The AppLovin example shows no close button, while the other two display a clearly visible, large one. In the 8 Ball Strike advertisement shown inside Rope Savior 3D, the filing says, a single tap installed the 18+ gambling app with no age verification or parental consent.

Why would such design matter financially? Because, the complaint explains, advertisers may be charged per click or per install, and installs can be credited to AppLovin if a user downloads the app within an attribution window of a few days to a few weeks after clicking an advertisement. Fuzzy Panda interviewed industry insiders, and the complaint reproduces their remarks. A former AppLovin anti-fraud executive, identified only as "B", is quoted as saying that AppLovin "would always have a click thru rate north of 30% and a click to install conversion rate of below 0.1%." An unnamed ad fraud expert put the mobile games average at "3-5%". Ben Edelman, a former Harvard Business School faculty member who also served as chief economist for web experiences, strategy and policy at Microsoft, told Fuzzy Panda that he "encountered a significant number of elements to cause inadvertent ad clicks." Those sources are anonymous or come from reports published by investment firms, and the complaint presents them as allegations to be proved.

Array and the install question

The filing also revisits Array, an initiative launched in late 2022 in which AppLovin partnered with device makers such as Samsung and carriers such as T-Mobile to enable one-click direct installations outside the Google Play Store. AppLovin's Array page said "[u]sers choose whether to install and can uninstall at any time." Culper Research and Fuzzy Panda reported that AppLovin "smuggled a single permission into thousands of their own advertising customers apps via MAX SDK updates," an allegation first covered by PPC Land in March 2025.

Senior employees, the complaint says, called Array a "top revenue driver" that was "valued at $1 billion over 4 years." In October 2025 AppLovin announced it had shut the program down, and a spokesperson told Bloomberg that "[u]sers never get downloads with any of our products without explicitly requesting it." The company now describes Array as "a test product," a label the complaint calls incongruent with its multi-year operation.

The Unfair Competition Law count rests on several predicate laws. The complaint invokes California Penal Code section 313.1(a), which bars distributing "harmful matter" to minors; Business and Professions Code section 22580, which prohibits online services from advertising obscene matter, alcoholic beverages, electronic cigarettes and cannabis products to minors; Section 5 of the Federal Trade Commission Act, read alongside the guidelines of the Better Business Bureau's Children's Advertising Review Unit (CARU); COPPA; the California Consumer Privacy Act; the California Comprehensive Computer Data Access and Fraud Act; and the California Invasion of Privacy Act (CIPA), section 638.51 of which concerns pen registers. A further theory, strict products liability for design defect, treats the MAX SDK, AppDiscovery and Axon AI as defectively designed products.

On CIPA, the filing cites Greenley v. Kochava, Inc., 684 F. Supp. 3d 1024 (S.D. Cal. 2023), for the proposition that SDKs qualify as pen registers, and notes that a Santa Clara County Superior Court overruled a demurrer in Mitchell v. AppLovin Corp. on March 23, 2026, sustaining claims that include CIPA. Separately, California's SB 690, signed on September 30, 2026, removes private rights of action for online tracking claims under section 638.51 from January 1, 2027, leaving the state Attorney General as the enforcer of that provision. This action is brought by a public prosecutor under section 17204, and the complaint does not discuss SB 690.

The People ask for a declaration that AppLovin engaged in unlawful, unfair and deceptive practices, and for an injunction. That order would require AppLovin "to restore effective mechanisms for identifying child users, honor Do Not Track designations on children's devices, implement reasonable age-assurance measures, and cease its deceptive user-interface practices." They also seek restitution to "any person in interest, including advertisers charged for coerced or fabricated interactions," in an amount to be proven at trial, along with attorneys' fees and costs.

On money, the complaint asks for civil penalties of up to $2,500 for each violation of the Unfair Competition Law, in a total to be set by the court. It defines the unit of violation broadly: each advertisement served to a child, each instance of personal information collected from a child without parental consent, and each coerced or fabricated interaction billed to an advertiser counts separately. In weighing the amount, the court would consider the seriousness of the conduct, the number of violations, its persistence, willfulness and AppLovin's "assets, liabilities, and net worth." The complaint states that AppLovin's market capitalization exceeded $100 billion as of September 11, 2026. Penalties are also sought under the False Advertising Law, with no figure stated.

The filing is signed by Assistant County Counsel Alysson Snow and carries the names of County Counsel Brown, Assistant County Counsel Joshua M. Heinlein and outside counsel at Bernstein Litowitz Berger & Grossmann LLP and Bishop Partnoy LLP. According to the county's announcement of October 5, 2026, the case is one of three launched alongside a new Consumer Fairness and Public Protection Division within the Office of County Counsel.

AppLovin's scale and the earlier scrutiny

AppLovin began in 2012 as a Silicon Valley startup building tools for game developers, and its AppDiscovery network let mobile game advertisers place promotions in other mobile games. The company launched the Lion Studios publishing arm in 2018 and acquired the platform now known as AppLovin MAX that same year. In 2021 it bought Adjust, a mobile measurement partner, and MoPub, Twitter's mobile app monetization platform, in a $1.05 billion cash deal; the complaint puts each purchase at roughly $1 billion. AppLovin listed that year under the ticker "APP", introduced Axon 2.0 in 2023, and in 2025 sold its mobile gaming arm to Tripledot Studios for $800 million. By the complaint's count, its SDK was integrated into 73% of the most-downloaded mobile games featuring advertisements as of 2025, and its platform reaches more than one billion daily active users.

The complaint places its children's-data claims inside a longer chain of events. In 2025, reports by Fuzzy Panda, Culper Research and Muddy Waters alleged data collection from children and obscene advertisements in games played by minors. Three short-selling firms published in a month, and the stock fell 12% after the February 26 reports and 20% in a single day after Muddy Waters published on March 27, the steepest drop on record for the company. Muddy Waters also estimated that only 25 to 35% of purchases attributed to AppLovin reflect true incrementality, against a company claim of near-total incrementality.

Foroughi answered in company blog posts, saying that "[e]very download results from an explicit user choice," that its advertisements generate "genuine, high-intent engagement," and that "[w]e do not track children's data." In a February 2026 explanation of the business model, he described the platform as reaching mainly adults who play casual games, and put annual advertiser spending on Axon above $11 billion.

Regulators and courts have also taken an interest. The complaint says the SEC's Cyber and Emerging Technologies Unit opened an investigation into the company's device fingerprinting practices in October 2025, following a whistleblower complaint, and that a class action was filed in the Netherlands in May 2026 on behalf of millions of Dutch citizens, among them roughly 1.5 million minors. Ad Tech Radar reported that AppLovin told investors on August 5, 2026 that the SEC inquiry had closed with no recommended enforcement action. Insurance Journal reported that the company did not immediately comment on the San Diego filing.

Why the case matters to marketers

For buyers on the demand side, the billing allegations carry most weight. If clicks and installs that no user intended are counted, the numbers feeding cost-per-install and return-on-ad-spend reporting are affected, and restitution for advertisers is among the remedies requested. The scale of that exposure depends on a platform that has widened its advertiser base. AppLovin opened self-service access on October 1, 2025 and said in May 2026 that Axon would open to advertisers worldwide in June. None of the allegations has been tested in court, and AppLovin's position is that its systems do not knowingly serve children.

For publishers and developers, the case concentrates on a set of signals that already exist outside any ad network: age ratings in app stores, parental-control software such as Family Link, zeroed advertising identifiers and Do Not Track designations. The complaint treats those signals as binding on the party that selects the ad, and asks a court to order AppLovin to honor them. The same filing notes that AppLovin's terms bar use of its SDK with child end users while its marketing features games rated for everyone. Because the MAX SDK sits in so many popular titles, the allegations touch a large share of the inventory that mobile advertisers buy.

The enforcement backdrop is also moving. The Federal Trade Commission's strategic plan for 2026 to 2030 names children's data and emerging fraud among its priorities, and a September 2025 settlement had Disney paying $10 millionover children's privacy on YouTube. The San Diego complaint adds a county-level plaintiff with penalty exposure counted per advertisement, per data collection event and per billed interaction, a counting method under which the number of violations grows with every advertisement served. Whether a court accepts that unit of violation, and whether the theories survive a response from AppLovin, will determine how far the case reaches. For now, it is a set of allegations in a public filing, resting partly on research published by short-selling firms.

Timeline

  • 2012: AppLovin begins as a Silicon Valley startup building tools for game developers (complaint).
  • 2018: AppLovin launches Lion Studios and acquires the platform now known as AppLovin MAX (complaint).
  • 2021: AppLovin buys Adjust and MoPub, and lists on the stock market under the ticker "APP" (complaint).
  • Late 2022: AppLovin launches Array, a partnership with device makers and carriers for one-click direct installations.
  • 2023: AppLovin introduces Axon 2.0, an AI-powered advertising engine (complaint).
  • September 15, 2024: SDK version 13.0.0 removes COPPA Support (complaint).
  • January 2025: Counsel's first investigation finds sexual advertisements in Street Dude and Rope Savior 3D on a six-year-old's tablet (complaint).
  • February 26, 2025: Fuzzy Panda Research and Culper Research publish reports on AppLovin, with the stock falling 12%.
  • March 27, 2025: Muddy Waters Research publishes its report, and shares drop 20% in a day.
  • March 31, 2025: Adam Foroughi publishes a blog post saying the SDK collects only basic device information (complaint).
  • 2025: AppLovin sells its mobile gaming arm to Tripledot Studios for $800 million (complaint).
  • October 2025: AppLovin announces the shutdown of Array, and the SEC opens an investigation into device fingerprinting practices (complaint).
  • February 2, 2026: Foroughi publishes an explanation of the business model.
  • March 23, 2026: A Santa Clara County Superior Court overrules a demurrer in Mitchell v. AppLovin Corp. (complaint).
  • May 2026: A class action is filed in the Netherlands over data from Dutch citizens, including about 1.5 million minors (complaint).
  • July and August 2026: Counsel's second investigation finds advertisements for cannabis gummies, alcohol and vaping products in games rated for everyone (complaint).
  • August 5, 2026: AppLovin tells investors the SEC inquiry has closed with no recommended enforcement action (Ad Tech Radar).
  • August 29 and 30, 2026: Screenshots of ads without a visible close button are captured in Gas Station, Inc. on a tablet configured for a six-year-old (complaint).
  • September 11, 2026: The complaint records AppLovin's market capitalization above $100 billion (complaint).
  • September 30, 2026: California's SB 690, which removes private lawsuits over online pen register claims, is signed into law.
  • October 5, 2026: The complaint is dated and the county announces the action along with its new Consumer Fairness and Public Protection Division.

Summary

  • Who: The People of the State of California, acting through the County of San Diego and County Counsel Damon M. Brown, against AppLovin Corporation, a publicly traded Delaware company headquartered in Palo Alto, California.
  • What: A civil complaint alleging false advertising and unfair competition. It claims AppLovin's ad systems placed sexual, violent and drug-related advertisements in games rated for children despite parental controls, removed a child-protection flag from its SDK, collected children's personal data, and used deceptive interface elements to generate billable clicks and installs. The People seek an injunction, restitution and civil penalties of up to $2,500 per violation.
  • When: Announced and dated October 5, 2026. The alleged conduct spans several years, including the September 2024 removal of COPPA Support, with testing in January 2025 and in July and August 2026.
  • Where: San Diego Superior Court, with plaintiffs and defendant tied to California. The People also describe harm to advertisers, users and children across the United States.
  • Why: The county says the practices breach California and federal laws meant to protect children and advertisers, and that AppLovin's published statements about children's data and genuine engagement are untrue or misleading. AppLovin's published policies state that it does not knowingly collect personal information from children or serve advertisements to them, and no court has ruled on the claims.