A tracking SDK is a package of code supplied by an outside company that an app developer compiles into a mobile application so that the outside company can record what happens inside it. SDK stands for software development kit, a bundle of libraries, documentation and sample code that spares a developer from writing an integration from scratch. The tracking variety exists to move data outward: once running, it observes sessions, screens, purchases and advertising exposure, packages those observations with device and network identifiers, and transmits them to servers the app publisher does not operate.

The web solved the same problem with a tag, a few lines of JavaScript that a site owner can paste into a page and delete the same afternoon. Mobile applications run in sandboxes, ship as compiled binaries and reach users only after store review, so no equivalent exists. Counting an install, a rewarded video view or an in-app purchase requires vendor code inside the binary. That constraint made the tracking SDK the standard instrument of mobile measurement, and it makes removing one a release cycle rather than a checkbox.

How the code runs

Integration begins in a dependency manager. On iOS the vendor publishes to CocoaPods or Swift Package Manager; on Android to a Maven repository referenced from a Gradle build file. The developer pins a version, builds, and the vendor's compiled framework becomes part of the shipped application.

Initialisation happens early in the application lifecycle, normally as the process starts. The developer passes an application key or token issued by the vendor, identifying the account the data belongs to. After that the library runs on its own schedule.

Collection divides into automatic and manual. Automatic events require no further code: first launch, session start and end, foreground and background transitions, crashes, and in advertising libraries, ad requests and impressions. Google states that the Google Mobile Ads SDK automatically collects IP address, user product interactions, diagnostic information, and device and account identifiers for advertising, analytics and fraud prevention. Manual events are the ones a marketing team defines and a developer wires up individually: registration, tutorial completion, add to cart, subscription, purchase with a revenue value and currency code attached.

Events are written to a local queue rather than despatched one by one. Batching reduces radio wake-ups and battery drain and gives the library something to replay after a period offline. The payload that eventually leaves carries event name and properties, timestamp, session identifier, device model, operating system version, locale, network type, the IP address observed by the receiving server, and where permitted an advertising identifier: the IDFA on iOS or the Google Advertising ID on Android. Transport is HTTPS to a vendor endpoint.

Attribution libraries add one mechanism on top. A click on an advertisement passes through a tracking link that records campaign, ad set, creative and device signals before redirecting to the store listing. On first launch the SDK registers the install with the vendor's servers, which match it against recorded clicks.

Categories inside one binary

The plural matters more than the singular, because a commercial app carries several. Attribution libraries from AppsFlyer, Adjust, Branch, Kochava or Singular count installs and post-install events. Product analytics libraries log behaviour for the developer's own reporting. Engagement platforms such as Braze place SDKs in iOS, Android and web clients to feed messaging and segmentation. Advertising libraries render inventory and report on it, whether Google Mobile Ads, a mediation partner or the open source Prebid Mobile library, which by October 2025 operated in more than 2,000 apps.

Two further categories are compliance instruments rather than commercial ones. Verification vendors read viewability signals through the IAB Tech Lab's Open Measurement SDK, released for market adoption in April 2018 to replace the previous arrangement in which every measurement firm needed its own library bundled into the app. Google moved Active View onto it for mobile app display inventory. Consent management libraries do the opposite job: Google's User Messaging Platform SDK writes and reads Transparency and Consent Framework strings, and carries the identifiers behind cross-app consent syncing launched on November 10, 2025.

Scale figures come mostly from litigation. Trial testimony in the Rodriguez case put Firebase deployment at roughly 1.5 million applications, including 97% of the top thousand Android apps and 54% of leading iOS apps.

Origin and evolution

The category is as old as the app stores. Once distribution moved to a store rather than a browser, publishers lost the referrer and advertisers lost the ability to see a conversion, and vendor code filled the gap.

Governance arrived late and in three waves. The first was disclosure. Apple began requiring privacy labels on December 14, 2020, and Google Play announced its Data safety section in May 2021, obliging developers to declare collection carried out by third-party libraries as well as their own code. Google's SDK Index was built to support that, publishing per-library adoption, version distribution and Android permissions.

The second wave restricted identifiers. Apple enacted App Tracking Transparency with iOS 14.5 on April 26, 2021, gating IDFA access behind a prompt. A four-year study covering 583,834 Apple apps and 901,182 Google apps found the framework shifted 0.07% of apps towards paid downloads, a small effect on monetisation model against a large one on measurement.

The third wave reached the libraries themselves. Apple introduced privacy manifests and SDK signatures at its 2023 developer conference. From May 1, 2024, App Store Connect stopped accepting new or updated apps that added a commonly used third-party SDK without a privacy manifest declaring required reason API usage, and without a valid signature where the library was added as a binary dependency. Apple publishes the list of libraries covered. The IAB Tech Lab moved along the same axis, opening a device disclosure specification for public comment in late 2025 that would require vendors to declare SDK package identifiers in mobile applications, part of the TCF v2.3 migration mandated for February 28, 2026.

Why it matters

The SDK is where collection happens, so it is where liability lands. A federal jury awarded 425.7 million dollars against Google on September 3, 2025, in Rodriguez v. Google, finding that Firebase kept gathering data from third-party apps after users disabled Web and App Activity. The Ninth Circuit declined in April 2026 to revive a damages class in the related Incognito matter. A month earlier, in August 2025, a San Francisco jury found Meta had violated the California Invasion of Privacy Act by collecting reproductive health data through the Flo app's SDK integration, dated in the case timeline to June 2016.

Regulators have attacked the same point from the supply side. The Federal Trade Commission moved in January 2024 to bar InMarket Media from selling precise location data, requiring among other things an SDK supplier assessment programme to confirm that apps carrying its library obtained informed consent. The Commission closed its four-year Kochava case with a stipulated order signed on May 4, 2026, that pushes consent verification back through the data supply chain.

Limitations and disputes

Four complaints recur. The first is weight. Every library adds binary size, initialisation time and network chatter, and the marketing team requesting one rarely carries the engineering cost.

The second is opacity. A privacy manifest describes what a vendor says its code does, and consent obligations are enforced by contract rather than by the operating system. Mozilla's August 2026 review rated the Stardust app 2 out of 10after finding transmission to third-party services from the moment the app opened, with no in-app setting that stopped it. Research published in April 2026 found workplace apps collecting nearly 20 data types on average, six of ten explicitly for advertising.

The third is version drift. Behaviour can change through a dependency upgrade alone: the Facebook Login SDK shifted Fast App Switch from opt-in to default between versions 18.0.2 and 18.0.3, altering an authentication funnel with no product decision behind it.

The fourth is abuse. HUMAN Security's Satori team documented Konfety in 2024, counterfeit applications built on the CaramelAds software development kit, one of a series of schemes tracked through mobile ad libraries.

Against all four sits a counter-movement. CloudX opened mobile app inventory to omnichannel demand-side platformswithout requiring buyer-side integration, and Universal Ads added five measurement partners in July 2026 with setup that typically needs no additional SDK work.

Not the same as

A tracking pixel or tag is browser-side and remotely editable; an SDK is compiled into a binary and updated only through a store release. A server-side API, such as Meta's Conversions API, sends events from an advertiser's own infrastructure rather than from the client, and is routinely paired with a pixel with deduplication between them. A mobile measurement partner is a company; the SDK is one artefact it ships. An advertising identifier is a value the SDK may read, not the collection mechanism itself.

Recent developments

Ownership of the attribution layer moved in June 2026, when Google, Meta, Moloco and Unity took stakes in AppsFlyerin a deal framed around measurement neutrality. Adjust has been owned by AppLovin since a reported one billion dollar acquisition in 2021, an arrangement that illustrates the conflict the AppsFlyer transaction was meant to contain.

Switching remains expensive. Platform integrations specify library versions and initialisation sequences per partner, so changing vendor means re-establishing certification relationships rather than swapping a dependency. Prebid's 4.0 roadmap targets modular architecture and open APIs for partners including Teads and InMobi, aimed at the same integration friction from the publisher side.

Timeline

  • July 2008: Apple and Google open their mobile app stores, moving distribution off the open web and beyond the reach of browser tags.
  • June 2016: Meta begins collecting data from the Flo app through an SDK integration, according to the case timeline later filed in court.
  • 2017: The IAB Tech Lab announces the Open Measurement SDK to end the practice of bundling a separate library for every verification vendor.
  • April 10, 2018: The Open Measurement SDK is released for market adoption alongside a compliance programme.
  • December 14, 2020: Apple begins requiring new and updated apps to disclose data collection through privacy labels.
  • April 26, 2021: Apple enacts App Tracking Transparency with iOS 14.5, gating IDFA access behind a prompt.
  • May 2021: Google Play announces the Data safety section, covering data handled by third-party libraries as well as first-party code.
  • 2021: AppLovin acquires Adjust in a reported one billion dollar deal.
  • June 2023: Apple introduces privacy manifests and SDK signatures at its annual developer conference.
  • January 2024: The Federal Trade Commission moves to bar InMarket Media from selling precise location data and orders an SDK supplier assessment programme.
  • May 1, 2024: App Store Connect stops accepting new or updated apps that add a listed third-party SDK without a privacy manifest and a valid signature.
  • August 2025: A San Francisco jury finds Meta violated the California Invasion of Privacy Act through the Flo app's SDK integration.
  • September 3, 2025: A federal jury awards 425.7 million dollars in Rodriguez v. Google over Firebase collection after users disabled activity tracking.
  • October 23, 2025: Prebid reports Prebid Mobile running in more than 2,000 apps and sets out the 4.0 roadmap.
  • November 10, 2025: Google AdMob launches cross-app consent syncing through the User Messaging Platform SDK.
  • Late 2025: The IAB Tech Lab opens a device disclosure specification for public comment requiring SDK package identifiers in mobile applications.
  • February 28, 2026: TCF v2.3 becomes mandatory for publishers, consent management platforms and SDK bidders.
  • April 20, 2026: The Ninth Circuit affirms the denial of a late intervention bid in the Google Incognito class action.
  • May 4, 2026: Federal Trade Commission attorneys sign the stipulated order closing the Kochava location data case.
  • June 2026: Google, Meta, Moloco and Unity take stakes in AppsFlyer.
  • July 30, 2026: Universal Ads adds five mobile measurement partners to its programme, with setup that typically requires no extra SDK integration.
  • August 2026: Mozilla rates the Stardust app 2 out of 10 over data sent to third-party services from launch.

Summary

Who: App developers integrate the code; attribution vendors, analytics firms, advertising platforms, verification companies, consent management platforms and location data brokers supply it. Apple and Google set the rules it operates under, and the FTC, state attorneys general and civil juries have tested those rules.

What: A third-party code library compiled into a mobile application that records automatic and manually defined events, batches them locally, and transmits them with device, network and advertising identifiers to servers the app publisher does not control.

When: The category dates from the opening of the mobile app stores in 2008. Disclosure rules arrived from December 2020 and May 2021, identifier restrictions from April 2021, and requirements aimed at the libraries themselves from May 1, 2024.

Where: Inside iOS and Android binaries, pulled in through CocoaPods, Swift Package Manager or Maven, and increasingly inside connected television and other app environments that inherit the same architecture.

Why: App distribution runs through stores rather than browsers, so no editable tag can reach it. Measuring an install, an in-app purchase or an ad impression requires vendor code in the binary, which concentrates both the measurement and the legal exposure at a single point that marketing teams request and engineering teams carry.