What the Machines Can See

Abstract

What this paper found

App-growth engines are built to learn from what they can see early and claim. In 2025 the money went where value per user was higher, even where the engines see less. Durable growth depends on what the reports do not show: what would have happened anyway, what the store keeps, and what a customer is worth after a year.

This paper asks one question: what produces extra durable app value, for which buyers, under which limits, and at what cost? It answers from the US market first, with global evidence where US data runs out. It keeps apart things the industry often blends: installs and customers, credit and cause, forecast and realized value, and a product's existence and its effect.

The research ran as ten evidence streams, three gap-fill passes and a review of the author's own work. Five fact-check passes then re-opened the sources behind every recorded finding, two separate passes scored the vendor panel, a hostile reviewer attacked the argument, and an auditor rechecked the numbers. ChatGPT (OpenAI) then reviewed three builds, and each of its factual points was checked against the sources. It consulted 621 distinct source addresses and recorded 272 findings. The 33 headline claims each carry a record that links prose, evidence and calculation. Chapter 12 describes the process as it actually ran, including what it could not reach.

Six findings drive the rest.

1. The engines learn from what they see; the money does not simply follow.Value bidding needs dense, early signal: Google's app campaigns need at least 10 conversions a day to bid for a return target. Yet in 2025 acquisition spend grew 35% on iOS, where signal is thinnest, and fell 1% on Android. It grew 18% in non-game apps and 3% in games. Value per user, category mix and a surge of China-based shopping budgets explain where money went at least as well as signal does CL-016.
2. Remarketing grew faster than acquisition, and we found no independent test of it in apps.It rose 37% to $31 billion in 2025, against 13% for acquisition, and made up 29% of app marketing spend in AppsFlyer's panel estimate. Randomized studies of web retargeting find real but modest lift. We did not locate a public independent randomized app study that validates its attributed returns CL-005.
3. The specialist with the highest adjusted EBITDA margin in our table owns an auction its model learns from, but ownership alone does not explain the lead.AppLovin reported $5.5 billion of net revenue in 2025 at an 82% adjusted EBITDA margin, and its model uses outcomes from its own mediation auction CL-007. Liftoff, with no such auction, reports a 55% margin on the same net basis, and Unity's rebound followed a new model more than a new asset. Google and Apple own more of the loop than any specialist and disclose less.
4. Credit is not cause, and the tests are gated.Across 663 randomized test-and-control comparisons on Meta, statistical methods run without control groups overstated median lift three to thirteen times CL-012. The lift tests we reviewed at the big platforms run through account teams CL-014. Our searches found no independent causal study of streaming TV's effect on app installs CL-026.
5. The store's cut is now a lever.At Stripe's published card rate, web checkout keeps about 34% more of a first-year subscription payment than Apple's 30% tier. Against the 15% tier it keeps about 11% more. Both figures come before the cost of running your own billing CL-022. How much Apple may charge on US link-outs was still being set in court at the cutoff CL-021.
6. "Apps DSP" is a checklist, not a proven category, and agents move the control point.On our own screen, one of eleven products documents the full set of capabilities, and none shows the bundle wins CL-029. Meta's and TikTok's agent servers can create and change campaigns. Meta's creates new campaigns paused. Neither documents an approval step for edits to live campaigns, so buyers have to set limits, logs and data rights themselves CL-030.

Chapter 1

Define growth before you count it

An install is an event. A customer is a person who stays and pays. Much of the muddle in app growth starts when the two are counted as one.

Six stages, five owners

Start with a plain map. A person hears about an app. They tap an ad or a search result, land on a store page and install. They open the app, find some value, and come back or leave. Some pay. Some return later. Six stages cover that path: discovery, acquisition, activation, retention, reactivation and monetization.

Five groups hold the levers. Ad platforms set bids, audiences, placements and delivery. App stores run the listing, search, ranking, fees and the privacy rules on the phone. The product team sets onboarding, first value, price and ad load. Lifecycle teams send push, email and in-app messages. Measurement and finance set the rules for credit, the tests and the meaning of profit.

The map frames the rest of the paper. Paid media acts on activation and retention mostly at one remove: through whom it reaches, what the ad promises and where a deep link lands the user CL-001. Reactivation is the exception, since remarketing buys it directly. A buying platform can choose who sees an ad. It cannot make the first session useful. It can only learn which people tend to stay, and that learning rests on the signal the app sends back.

What counts as growth

Growth here means more durable value than you would have had without the spend. That takes four numbers, and the industry often blurs them.

• Installs. A device event. The count includes reinstalls and redownloads, which are not new customers.
• Activated users. People who reach a first-value event the app defines, such as a finished level, a first order or a started trial.
• Retained value. Revenue or use that is still there at day 30, day 90 or a year, on a stated definition.
• Contribution. Revenue after store fees, refunds, payment costs, taxes where they apply, cost of goods and promotions. Contribution here comes before acquisition cost. Growth is contribution minus the full cost of winning the customer, counted once.

A lower cost per install does not prove growth. Nor does a higher return on ad spend in a platform report. Cost per install can fall and reported return can rise while contribution falls. That happens when cheap installs churn faster, when credit goes to users who would have come anyway, or when a report counts gross sales instead of net revenue CL-002.

The units matter

Cost per install divides spend by installs. Cost per payer divides it by payers. A household that saw a TV ad is not a person. An iOS privacy postback is not a user at all. It is a report about one install with no user ID, sent a day or more later, with its detail capped by privacy thresholds [1]. The metric dictionary in the appendix defines each unit and says what it can be added to.

Six money pools that must never be added up

Market sizes in this field are noisy because different pools of money get quoted as one. This paper keeps six apart.

1. Q1: ad spend that promotes apps. What advertisers pay to win installs and bring users back.
2. Q2: ads sold inside apps. What any advertiser pays to reach people while they use apps. Much of it promotes things other than apps.
3. Q3: app-store consumer spending. What people spend through Apple and Google billing.
4. Q4: subscription revenue. It overlaps Q3 when a store bills it. It sits outside Q3 when billed on the web.
5. Q5: commerce value. Orders placed in shopping, delivery and travel apps. This is gross merchandise value, not the app's revenue.
6. Q6: ad-platform revenue. What the platforms report. It is often net of what they pay publishers, so it is not ad spend.

These overlap in places and describe different markets in others. Adding them into one total overstates the market. Chapter 2 puts the best public number for each pool side by side.

What the paper asks

The brief for this research set twelve questions. They come down to one: what produces extra durable app value, for which buyers, under which limits, and at what cost? Each chapter takes part of that question. Each ends with a test: the case for a thesis, the best case against it, other explanations, and the result that would prove it wrong.

Chapter 2

Where the budgets and the power sit

The money is large and still growing. Profit sits with a few firms, and the firm that earns most on its revenue also owns an auction its model learns from. Whether the ownership explains the profit is still an open question.

The pools, side by side

The most detailed public estimate of ad spend that promotes apps comes from AppsFlyer, an attribution company. Its report, first published in December 2025, says app marketers spent $109 billion worldwide in 2025. User acquisition took $78 billion, up 13%. Remarketing took $31.3 billion, up 37%. That lifted its share of the total from 25% to 29% [6] CL-003. The panel is large: 32 billion paid installs and 45,000 apps. But it is AppsFlyer's own clients. The report does not state its measurement period, which may include estimated months, or how it scales the panel to a world total. Treat it as a well-grounded estimate. It is not a census.

The same report says the US holds 42% of global spend, in the section on acquisition. That puts US acquisition spend near $33 billion in 2025, before remarketing [6]. The report does not print that dollar figure. It is our arithmetic, and it assumes the share refers to acquisition spend.

Store spending is a different pool. Sensor Tower estimates $167 billion of in-app purchase and paid-app spending on iOS and Google Play in 2025, up 10.6% [7]. Appfigures estimates $155.8 billion, up 21.6% [8]. The two vendors describe the same year and the same two stores. They differ by about $11 billion on the level and 11 points on the growth rate CL-004. Part of the gap is scope, and neither publishes a method a buyer could check. Both agree on one thing: non-game apps now earn more in the stores than games do.

Ads sold inside apps have no public market total at the cutoff that we could read without a paywall. We leave that bar empty rather than fill it with a guess. Liftoff's prospectus cites a commissioned estimate of a $79 billion market in 2025 for independent in-app ad technology [15]. That is a different quantity again, prepared for a share sale.

Where growth came from in 2025

Three shifts stand out in AppsFlyer's data, all of them global. First, acquisition growth came entirely from iOS, up 35%, while Android slipped 1% [6]. Second, non-gaming apps drove it. Their acquisition spend rose 18% to $53 billion, while games rose 3% to $25 billion. Shopping apps grew 70%, largely on budgets from China-based e-commerce apps. Third, money moved toward existing users. Remarketing grew almost three times as fast as acquisition.

The first two shifts matter for this paper's argument, and they cut against the simple version of it. Chapters 3 and 5 show that the bidding machines learn best where signal is dense and fast. Yet in 2025 money grew fastest on iOS, where signal is thinnest, and in non-game apps, whose value often arrives late. So the machines' view does not decide where budgets go. Value per user, category mix and a wave of China-based e-commerce spending explain the shift at least as well. AppsFlyer does not publish a US-only category split, so we cannot say how much of the shopping surge reached the US.

The third shift is the one to watch. Remarketing reaches people who already have the app, and some would have come back anyway. Randomized studies of web retargeting find real but modest lift (chapter 5). We found no independent randomized study of app remarketing. So the faster-growing of the two budget lines is also the one we found no independent app test for CL-005.

Who earns the money

Company filings give harder numbers. They measure a different thing: the revenue of ad platforms, not ad spend.

Three cautions apply before anyone ranks these. First, firms book revenue differently. AppLovin and Liftoff act as agents and report revenue net of what they pay publishers [21,22]. Mobvista books gross, as principal, with a gross margin of 21.2%; its own non-IFRS ad-tech net revenue for 2025 adds up to about $519 million [17,23]. Digital Turbine books its exchange net and its brand and performance business gross [14]. Verve moved some revenue from net to gross in the third quarter of 2025 [19]. A margin on net revenue looks far higher than the same business on gross revenue CL-006. Second, adjusted EBITDA is each firm's own measure. Third, Unity's margin covers its game-engine business as well as ads, so it is not an ad-business margin.

So the table supports a narrow claim. In this table, AppLovin's net revenue exceeded the next four specialists combined, even with Mobvista counted gross. That is a comparison of selected firms, not a measure of market concentration. Its margin is the highest in the table. Liftoff, the one peer that also reports net, is the fairest comparison.

The latest quarter at the cutoff kept the pattern. AppLovin reported $1,924 million of revenue for the second quarter of 2026, up 53%, at an adjusted EBITDA margin of 83.9% [24]. Unity's Grow revenue rose 35% to $389 million. Unity credits its Vector-driven ad network, partly offset by the older ironSource network [25]. Liftoff listed on 4 June 2026. In its first quarterly report as a public company, for April to June, revenue rose 35% to $220 million. One customer made up about 10% [22].

The mix differs too. Game advertisers supplied three quarters of Mintegral's 2025 revenue [10]. At Liftoff, slightly more than half of advertiser revenue came from outside gaming before its listing [12]. At Unity, the Unity Ad Network, now running on the Vector model, made up 56% of Grow revenue in the fourth quarter of 2025. The older ironSource network fell to 11% [11].

Stacks, and who owns the loop

Common ownership is the key structural fact. AppLovin owns four pieces. Its ad network and bidding engine was sold as Axon Ads Manager and renamed AppLovin Ads by mid-2026. MAX is the mediation auction many game publishers use to sell their inventory. Adjust, bought in 2021, is an attribution company. Wurl, bought in 2022, is a streaming TV business [26,21]. Unity owns the Vector and ironSource ad networks and the LevelPlay mediation auction [11]. Digital Turbine combines phone preloads with its own exchange [13]. Mintegral buys on its own software kit inside publisher apps [10].

The biggest owners of the loop are not specialists. Google owns Android, the Play store, the Install Referrer, the AdMob mediation platform and the Firebase analytics kit. Its app campaigns expect Firebase-sourced events for target-return bidding [27,28]. Apple owns iOS, the App Store, the privacy thresholds and Apple Ads, which has its own direct attribution interface (chapter 3). Neither discloses app-ad revenue, so neither appears in the table, though their app-ad businesses are likely larger than any specialist's.

Why does ownership matter? A mediation auction sees who bid what for every impression, and who won. AppLovin's disclosure on its Axon model says the model uses win and loss notices from the MAX auction, along with device and engagement signals and data advertisers share [29] CL-007. A buyer who uses AppLovin media, measures it with Adjust and monetizes through MAX deals with one company at three points. AppLovin says Adjust data is not shared with it unless the customer directs [26]. That is the company's own assurance, and it has not been independently checked. The overlap is a potential conflict of interest. It is not evidence of misconduct.

AppLovin has also faced public allegations. In February and March 2025, four research outfits, three of them short sellers who profit if the stock falls, published reports on the company. They claimed silent app installs pushed through the MAX software kit and use of persistent identifiers against partner platforms' terms. They also claimed e-commerce results came more from retargeting than from new customers. One report, by Muddy Waters, said log files from a demand-side platform covering five advertisers showed about 52% of AppLovin's e-commerce conversions came from retargeting. It put incrementality at only about 25% to 35%. Its data and method are not public [30,31,32]. The stock fell 12% on 26 February and 20% on 27 March 2025. AppLovin's chief executive and technology chief denied the claims in blog posts [32,33,34]. A securities class action followed. In January 2026 the plaintiffs asked to add reported SEC and state investigations to their complaint. In April the court took that request and AppLovin's motion to dismiss under submission. No ruling appeared on the public docket as of mid-August, and related shareholder suits were on hold [35,36,37]. In October 2025 Bloomberg reported, and Reuters relayed, that the SEC was probing AppLovin's data collection. AppLovin said it does not comment on potential regulatory matters [38]. Its filings name no specific investigation, though each says in general terms that the company is involved in regulatory investigations [39,40,41,35]. In September 2026 a separate securities suit was filed over statements about AI products [42]. The short-seller reports are claims by parties with a financial stake. The complaints are allegations: the public docket showed no ruling on the Brownback motion to dismiss as of mid-August 2026, and the September suit had just been filed. That suit does not itself confirm the reported SEC inquiry. We record all of this because it bears on data use, not because this research could test it.

The market keeps reshaping

Ownership has moved fast. Unity merged with ironSource in November 2022, after rejecting an all-stock approach from AppLovin that valued Unity at $20 billion [43,44]. AppLovin sold its game studios to Tripledot in June 2025 for $430.6 million in cash and about a fifth of Tripledot's equity, valued at $285 million [45,16]. Liftoff listed on Nasdaq in June 2026 at $23 a share. A first attempt, filed in January, was withdrawn on 17 February 2026 [46,47]. LoopMe bought Chartboost from Zynga in December 2024 [48]. Aarki had rebranded as RZR by March 2026 [49,50]. Affle runs at least four app-marketing brands: Jampp, YouAppi, RevX and mediasmart. In June 2026 it agreed to buy the AdColony technology and brand from Digital Turbine [51,52,53,54,55]. The tools around the market move too. OpenAI bought the testing firm Statsig in 2025, and in May 2026 Amplitude bought Statsig's customer contracts, brand and a licence to its technology [56,57].

The pattern is consolidation around a few stacks, with specialists and new listings in between. It is consistent with the playbook's view that a US buyer compares any challenger with AppLovin, Moloco and Liftoff first, but it does not test that view. This research did not study firms that failed or closed, so the sample leans toward survivors.

Chapter 3

What the signal can tell you

On iOS the operating system decides what an advertiser may learn, when, and in how much detail. On Android the old identifiers still work, and Google's privacy replacements are being wound down.

iOS: consent first, then thresholded postbacks

Since April 2021, an iOS app must ask before it tracks a user across other firms' apps [58,59]. Most users who see the prompt say no. Adjust, an attribution vendor owned by AppLovin, reports on its own client base. There, opt-in among users shown the prompt rose from 35% to 38% between early 2025 and early 2026 [60,61,62,63]. That is a panel figure, not a rate for all users. A survey asked 11,000 US and UK iPhone users which prompts they would accept. About 25% said yes to Apple's own prompt for personalized ads, against 13% for the tracking prompt other firms must show [64]. Two of that study's five authors work at Meta, which has a stake in the answer, and a third has consulted for it.

Apple's frameworks report ad-driven installs without a device ID, whether or not the user opted in [65]. For users who decline, an app may not link its data with other companies' data to measure ads [66]. For ads outside the App Store, the postbacks are then the only attribution Apple itself provides. Under SKAdNetwork 4, an install can produce up to three postbacks. They cover days 0 to 2, 3 to 7 and 8 to 35 after the user first opens the app. Each is sent after a random delay once its window closes, or sooner if the app locks its value early. The delay is 24 to 48 hours for the first and 24 to 144 hours for the others. So the last can arrive about 41 days after first launch [1]. Apple gives each download one of four privacy tiers. The tier reflects crowd size across the app or site showing the ad, the advertised app, the install country and the campaign code. Apple does not publish the thresholds. In the lowest tier the advertiser gets one postback, a two-digit campaign code and no conversion value at all [1].

That design has a commercial side effect. Detail rises with crowd size. Installs that cluster in a few publishers, countries and campaign codes are more likely to reach the top tiers. Even there, the fine-grained value comes only in the first postback; later ones carry a coarse value [1]. A small advertiser, or one that splits spend thinly, is more likely to get coarse values or none CL-008. Apple itself says smaller developers may get limited data back because of these thresholds [67]. Rules written to protect users also make signal a scale advantage.

What else fills the iOS gap

Postbacks are not the only tool in use. Attribution companies document probabilistic matching, which links an ad click to an install by device and network traits inside a short window. Platforms also report modeled conversions, which estimate what they cannot observe [68,69]. That sits close to a line Apple draws. Its rules bar apps from deriving data from a device to identify it uniquely. Apps or kits caught doing so may be rejected from the App Store [70]. Adjust says such modelling applies only where Apple's tracking policy allows it [71]. AppsFlyer ranks it below exact matching and says it produces campaign-level reports rather than identifying devices [72,73]. Buyers should know which part of a reported number is observed, which is matched by probability, and which is modeled.

AdAttributionKit has not replaced SKAdNetwork

AdAttributionKit arrived with iOS 17.4 in March 2024. It first added attribution for alternative app stores in the EU. Re-engagement followed in the iOS 18 cycle, then a country code, adjustable windows and cooldown periods in the iOS 26 cycle [65,74]. Apple's SKAdNetwork page tells developers to use AdAttributionKit for app ad campaigns [75]. Its guide says only one impression can win an install across the two frameworks. It bridges them one way: a value update sent through SKAdNetwork is mirrored into AdAttributionKit. The same guide still tells apps that work with both to call both [76]. The release notes list no SKAdNetwork 5, and no document we opened sets a date to retire SKAdNetwork [77] CL-009. The changelog has no entry after June 2025. One later addition, a way to register view-through impressions in iOS 26.2, appears in Apple's reference pages but not in the changelog. The iOS 27 release notes list no attribution changes [74,78].

Two rules shape re-engagement. For installs, the winning network gets postbacks and up to five others get one losing postback each. For re-engagement, only the winner hears anything [65]. A network that helped bring a user back but lost the last touch learns nothing.

The big attribution companies document live support for both frameworks, including copies of postbacks sent to them [79,80,81]. The plumbing exists. The limit is what the postbacks say.

Apple measures its own ads differently

Apple Ads, Apple's own App Store ad business, has its own attribution interface. It covers only Apple Ads download campaigns, in search results, the search tab, the Today tab and product pages. The app gets a token that must be traded with Apple's server within 24 hours [82,83]. Apple credits a tap up to 30 days before the install and, since March 2025, a view up to 24 hours before [84]. In September 2026, the month of the cutoff, Apple said campaigns that target by age or gender will get no attribution through that interface [84]. Apple Ads also registered with AdAttributionKit in April 2025, for now through SKAdNetwork versions 1 to 3 and for click-throughs only [85,67].

So Apple provides two kinds of attribution. Its own ads get a direct interface as well as postbacks. For other networks, Apple provides only postbacks. Those networks may add attribution from data they own, but matching users across companies needs the user's consent [67,66]. Buyers should read Apple Ads results with that in mind. It is a difference in what can be seen, and it says nothing about which channel works better.

Europe is pushing on the consent screen

Competition authorities in three EU countries have acted against the way Apple runs its tracking prompt. France fined Apple €150 million in March 2025. It found the idea of the prompt acceptable but the way Apple ran it abusive [86]. Italy fined Apple €98.6 million in December 2025 over the double consent the prompt adds on top of privacy-law consent [87]. In August 2026 Germany's competition authority made Apple's commitments binding. Apple must align the wording of its own and other firms' prompts, drop discouraging design, and let apps combine the prompt with their privacy-law consent. It has four months to comply [88].

Apple's developer documents now describe a fuller, text-rich consent sheet for the EU. It is part of iOS 27.2, which was in beta at the cutoff. It will be required for users in France, Germany, Italy, Poland and Romania. The same release notes add a yearly re-prompt in the EU [89,90]. Apple does not link these changes to the rulings, and they had not shipped at the cutoff. If they ship and lift opt-in, European iOS measurement will improve. US rules do not change.

Android: the old tools still carry the load

On Android, attribution still rests on two long-standing tools. The advertising ID can be reset or deleted. Apps that target Android 13 or later must declare a permission to read it, and a user who deletes it hands apps a string of zeros [91,92]. The Play Install Referrer tells an app which referral link led to its install, with click and install times [93].

In October 2025 Google said it would phase out the Privacy Sandbox ad tools on Chrome and Android. They include Attribution Reporting, Topics, Protected Audience, the SDK Runtime and several others [94]. At the cutoff, Google's own status page listed the Android pieces as "scheduled for phaseout", with no removal date [95] CL-010. The author's playbook called these tools "retired" on Android in October 2025 [96]. The exact position is that retirement was announced, and the identifiers they were meant to replace are still in service. Chapter 12 lists this as a correction.

What this means for the buyer

The two platforms now differ less in whether you can measure and more in what you can see. On Android, exact install attribution is still normal. On iOS, most ad-driven installs are reported late, without a user ID, and with detail that depends on crowd size. Measured growth can move for reasons unrelated to real growth. AppsFlyer reports that US iOS paid installs rose 31% in 2025 while Android rose 8% [6]. Part of that gap may be real demand and part may be better attribution coverage. The report does not separate them.

Chapter 4

From attribution to causality

Every system that counts app installs counts them differently, on purpose. None of them counts what would have happened without the ad.

Why the numbers never match

Put a campaign's results from Meta, TikTok, an attribution company, Apple's postbacks and the finance ledger side by side. They will differ. That is not a bug in any of them. Each answers a different question with different rules.

• Different clocks. Meta's Ads Manager files a conversion under the time of the ad view or click, not the install. Meta warns this causes gaps against attribution-company reports [103].
• Different windows. AppsFlyer's defaults credit a click up to 7 days before the install and a view up to 1 day before [68]. Meta's windows depend on where you look. App-install ad sets optimize on a 1-day click, with a 1-day view optional, and iOS app-event campaigns use a 1-day or 7-day click. Ads Manager can show 28-day click counts, but only as a comparison. Meta's older App Events API, no longer recommended for new work, counts clicks within 30 days [104,105,106,103]. TikTok offers 1, 7, 14 or 28 days for clicks, up to 7 days for views, and a separate window for "engaged views" of 6 seconds or more [107].
• Different ideas of a click. In Singular's aggregate reports on Meta campaigns, engaged-view conversions are filed as click-throughs [108].
• Separate claims. Meta, Google and TikTok are "self-attributing": each decides for itself which installs it claims, under its own rules. Since March 2025 TikTok requires this mode for all apps, and its help page says it works "without affecting your MMP's final attribution logic" [109]. Two platforms can claim the same install. The attribution company then picks one winner.
• Reinstalls. If someone reinstalls inside the reattribution window, AppsFlyer records no new install unless the user engaged with a retargeting campaign. After the window, the same person counts as new [110].
• Thresholds and delay. Apple's postbacks arrive days later, with no user ID and detail capped by privacy thresholds. Only one network wins each install (chapter 3).
• Finance. The ledger books revenue net of store fees, refunds and taxes, when earned. Ad reports usually book gross value on the day of the event.

The practical rule follows. Never add platform-reported conversions and privacy postbacks into one total. Summing claims from several self-attributing platforms counts some installs twice, so the total is not a count of installs CL-011. Reconcile each system on its own terms. Then ask a separate question about cause.

The error does not always run one way. On iOS, installs in the lowest privacy tier carry no conversion value [1]. An install that no method can match to an ad is counted as organic [68]. Paid volume may also lift an app's store ranking and so its organic installs, which no report credits to the ads. All of that makes paid media look weaker than it is. The net direction varies by channel and platform, which is one more reason to test instead of trusting any single report.

Credit is not cause

Attribution tells you which touch came last, or which system claims the install. It does not tell you whether the install would have happened anyway. Only a valid comparison group can do that. The cleanest is a group randomly kept from the ads, analyzed as assigned. Comparing people who happened to see an ad with people who did not keeps the selection bias.

The strongest public evidence on the size of the gap comes from Meta's own test platform, studied by academics with Meta ties. Gordon, Moakler and Zettelmeyer studied 563 US ad experiments on Facebook, run from November 2019 to March 2020. Some tested several ads, so there were 663 test-and-control pairs, which the authors count as experiments. Together they served about 38 billion impressions. The median lift the experiments measured was 29% for upper-funnel outcomes, 18% for mid-funnel outcomes and 5% for purchases. They then ran two statistical methods on the same campaigns without the control groups. A double machine-learning method estimated median lifts of 83%, 58% and 24%. Propensity-score matching estimated 173%, 176% and 64% [111] CL-012. Both overstated lift at every stage. As a multiple, the error was largest at the bottom of the funnel: about five times the measured 5% for machine learning and thirteen times for matching. One author works at Meta, and two were part-time Facebook employees to reach the data. An earlier study of 15 experiments reached the same conclusion [112].

This study tests statistical corrections, not attribution rules. Two older studies speak more directly to attribution-style reports. At eBay, a standard regression put the return on paid search above 4,000%. Adding controls for region and day still left it above 1,600%. A 60-day test then switched off non-brand search ads in about 30% of US regions and found a return of minus 63% [113]. Ads on eBay's own brand name showed no measurable short-term benefit [114] CL-013. Across 25 retail and finance experiments at Yahoo, the median 95% confidence interval on return on investment was more than 100 percentage points wide. An informative test could need more than 10 million person-weeks [115]. Real effects exist. They are smaller and noisier than dashboards suggest, and hard to measure without large tests.

Privacy changes show how much depends on data access. Aridor and co-authors found that after Apple's tracking prompt arrived, click-through rates on Meta's conversion-optimized ads fell 37%. Stores more exposed to the change saw revenue fall 8% to 40% relative to less exposed stores, mostly among smaller ones. Exposure was measured by reliance on Meta ads or on iPhone shoppers. The revenue data come from Grips Intelligence, a firm one co-author works with [117]. A randomized test on Meta in fall 2021 covered more than 70,000 advertisers. It estimated that losing off-Meta data would raise the median cost per incremental customer from $38.16 to $49.93, a 31% rise [118,124]. Two of the four authors worked at Meta at the time. Meta could screen the paper for confidential data but had no right to block it over its results. It was peer reviewed, posted online in September 2024 and printed in the March 2025 issue of Marketing Science. So it is platform-affiliated evidence, though built on a large randomized test.

Tests exist, but someone has to switch them on

Each large platform offers a lift test with test and control groups. Meta's Conversion Lift, Google's Conversion Lift and TikTok's Conversion Lift Study each document a test-and-control design that can cover app outcomes. In the pages we reviewed, all three run through an account team or eligibility rules, not open self-service [125,126,127] CL-014. In August 2026 Google's Ads API added read-only access to Conversion Lift results, so software can now pull them. The release notes do not describe creating studies through the API [128]. Among specialists, Moloco documents built-in ghost-bid tests for streaming TV and says it offers incrementality testing for re-engagement, without naming the method [129,130]. Jampp advertises always-on lift measurement for acquisition and retargeting at no extra cost, without documenting the method [69]. Remerge describes ghost bids for retargeting and an econometric method for installs and re-engagement [131]. AppLovin describes running geographic holdouts for clients as a managed service [132]. These are vendor descriptions. We found no independent audit of their results.

The "ghost ads" idea needs a plain explanation. Users are first split at random into test and control groups. The system then logs each moment a control-group user would have seen your ad, and records what they did next. That gives a clean comparison without paying for filler ads in the control group [133]. The random split does the work; the log only finds the right people to compare. The logging must work the same way in both groups, or the comparison is biased [133,134]. It needs the ad platform to run it, which leaves the vendor marking its own homework unless it shares the method and raw results.

Where models fit

Marketing mix models estimate each channel's share of outcomes from spend and results over time. Google's open-source Meridian and Meta's Robyn both model diminishing returns and both accept test results to calibrate the model [135,136]. Neither claims independent accuracy. Robyn's guide says its outputs are not guaranteed and should be checked before use [136]. PyMC-Marketing cites its own benchmark claiming faster fitting and 40% lower error on channel shares than Meridian [137]; that is a vendor's self-test. For apps, a mix model works best at weekly or monthly grain across a few large channels, calibrated with experiments. Google's Meridian guide says the model works at channel level and does not recommend campaign-level runs [138]. With the data most apps have, estimates for single campaigns are unstable. So a mix model is a poor guide to which of fifty campaigns to cut.

Can a buyer reconcile without inventing one number?

Yes, if the buyer stops asking for one number. A workable setup keeps four ledgers, each with a stated job. The attribution company's ledger sets day-to-day credit and pays partners. Apple's postbacks and the platforms' own reports feed bidding. Experiments and a calibrated mix model set budget between channels. The finance ledger decides whether the business made money. The reconciliation register above sets out each system's clock, window, identity basis and modeled share.

Chapter 5

What the acquisition engines optimize

The bidding machines are built to learn from what arrives fast and often. Value that shows up late, or rarely, gets replaced by a stand-in.

The machine needs dense signal

Platforms state how much signal their bidding needs. Google's app campaigns need at least 10 conversions a day, or 300 in 30 days, before a buyer can bid for a return target. The events it bids on should come from Google's Firebase kit [27]. Google also warns that editing a campaign before its first 100 conversions may disrupt learning. It suggests daily budgets of 10 to 50 times the bid, by goal [139] CL-015. For its data-driven attribution model, Google recommends 200 conversions and 2,000 ad interactions in 30 days, though the model runs at any volume [140].

Other platforms set softer rules. TikTok lists three goals for its Smart+ app campaigns: installs, in-app events and value. In Smart+, value bidding is Android-only [141,142]. TikTok's standard app campaigns offer it on Android and iOS, and TikTok treats 50 conversions as the main sign that value-bidding learning is done [143,144]. Meta says an ad set leaves its learning phase once delivery is stable, which usually takes about 50 results in the week after the last big edit. It also advises combining similar ad sets, because many small ones each teach the system less [145]. AppLovin recommends a daily budget that buys at least 15 to 20 conversions a day. Its ad-revenue and blended return goals also require the app to use its MAX mediation [146].

Put these together and a pattern appears. The engines learn best from events that are common, early and valued. Installs and first opens pass that test. So do early ad views and early purchases in games. A yearly renewal does not CL-016.

Three clocks for value

Value reaches an app on three clocks. Ad revenue is fast but shallow. AppsFlyer's panel finds in-app ad revenue reaches 89% of its day-60 total by day 7, partly because most players leave early [147]. That describes a 60-day horizon in one panel; it does not show that early revenue predicts lifetime profit. First payment can be fast too, since an annual plan is often paid up front. Renewal is slow. In RevenueCat's 2026 report, the median app kept only 28% of annual subscribers past their first year [148]. The first year is paid up front; most renewals never come. More than half of three-day-trial cancellations happened on the first day [5]. The report does not state the cohort window.

So an ad-funded game can send a reliable 7-day value to its bidding partners. A subscription app can send its first payment, but must guess the renewal or send a stand-in such as "started trial". Mintegral takes three quarters of its revenue from game advertisers [10], which fits the signal story.

The 2025 spending data do not fit it neatly. Acquisition spend grew 35% on iOS, where signal is thinnest, and slipped 1% on Android. It grew 18% in non-game apps and 3% in games. The fastest growth, 70%, came in shopping apps, largely on budgets from China-based e-commerce apps [6]. Higher value per iOS user, the category mix and those shopping budgets explain the shift at least as well as signal speed does. The machines' view shapes how campaigns are run. It does not decide where the money goes.

Stand-ins are where optimization goes wrong

When the real outcome is slow, teams optimize a stand-in: a trial start, a finished tutorial, a day-3 purchase. The machine then finds people who do the stand-in. That works only while the stand-in predicts value, and it can fail quietly. A cheaper trial start can come from people who cancel on day one. Chapter 7 shows the public evidence on predicted lifetime value is weak, so few buyers can prove their stand-in still works.

Average return is not marginal return

Dashboards report average return: total revenue divided by total spend. Budget choices need marginal return: what the next dollar brings. On a curve that flattens, the two diverge. The first dollars reach the most responsive people. Later dollars reach the rest. The mix-model tools from Google and Meta both build diminishing returns into their models [135,136].

The model below lets you see the gap. It is a teaching model with made-up numbers, not an estimate for any channel.

A channel can show a healthy average return while its last dollars lose money CL-017. That is why "scale what works" is risky advice when "works" is measured on averages.

Diversification is a claim to test

Two sound arguments pull in opposite directions. Spreading a budget across channels spreads risk and can reach people one platform misses. But each extra channel shares the budget, and each needs enough signal to learn. A RevenueCat post argues that adding channels early can dilute learning, slow optimization and add work [149]. Meta's advice to combine small ad sets makes the same point inside one platform [145]. The case against piling into one channel rests on overlap: people reached on two channels at once cost twice and add little. The example we found comes from a vendor selling a de-duplication tool and is stylised [150]. Neither side has a public, controlled test for apps. Diversification is a hypothesis to test with holdouts. It is not a rule.

Remarketing and search: paying for intent you already had?

Remarketing is now 29% of app marketing spend [6]. It targets people who already installed the app, and some would return without an ad. Randomized studies of web retargeting find real but modest lift. For one apparel retailer, a two-week ghost-ads experiment on Google's display network found retargeting raised site visits by 17.2% and purchases by 10.5%. The test system was built at Google [151,152]. At another, switching retargeting on brought 14.6% more users back within four weeks, and the effect faded fast [153]. Those are web shops, not apps.

Search ads on an app's own name raise a related question. At eBay, ads on its own brand name showed no measurable short-term benefit, because people searching for eBay found it anyway [114]. A study of Bing searches in January 2014, by researchers then at Microsoft, found brand ads added only 1% to 4% of clicks when no rival bid on the name. For brands that faced rivals and chose not to advertise, rivals took 18% to 42% of their clicks, though the authors warn those brands may differ [154,155]. So brand bidding can be defensive, and its value depends on who else is bidding. We found no public study, academic or vendor, of how often paid App Store ads on an app's own name take installs that would have come anyway.

None of this makes remarketing or brand search worthless. It means their attributed returns are especially likely to include demand that already existed CL-018. Holdout tests, not attribution reports, should set these budgets.

Promotions raise the same issue from another side. First-order discounts, referral credits and promo codes drive installs in delivery, ride-hailing, marketplace and fintech apps. A report can credit those installs to the ad that ran alongside the offer, and the discount cuts contribution. This research did not find public causal evidence on app promotions, so we flag it as an open question.

Chapter 6

Creative, discovery and conversion

Many creative "tests" in app marketing are spend decisions made by an algorithm. The store tests are closer to real experiments, and the store's own rules are now in play.

Store tests are the cleanest experiments most teams run

Apple's Product Page Optimization shows a random share of App Store visitors up to three variants of the original page [156]. It uses Bayesian statistics and shows results once there are at least five first-time downloads. That is a display rule, not a sample-size rule. A variant may be labelled better or worse once it reaches 90% confidence against the original [157]. Google Play's store listing experiments let the developer set the smallest effect worth detecting and the confidence level. They stop on their own after six months [158].

Custom product pages are a different tool. Apple allows up to 70 extra versions of a product page, each with its own link for use in ads. Its documents describe no random split and no significance test against a baseline [157,159] CL-019. Apple also says developers see a lift of 2.5 percentage points in conversion, on average, when they send people to a custom page. The average default page converts 1.6%, so Apple calls this a 156% increase [159]. That comparison shows the problem. People sent to a custom page came through an ad or link aimed at them. People on the default page include everyone browsing the store. The gap mixes the page's effect with the traffic's intent. A custom page routes traffic. On its own it creates no random split, though a team can use one inside a designed test.

Store conversion benchmarks depend on the definition. Apple's own figure is the 1.6% average above, with no period or definition given [159]. Vendors that sell store optimization publish much higher page-view-to-install rates from their own panels. The 25% to 33% range often quoted in the industry could not be traced to the source we opened.

Ad creative: test or allocation?

On the ad side, two very different tools share the word "test". Meta's A/B test shows each version to a separate part of the audience, so nobody sees both [160]. Its Dynamic Creative mixes uploaded assets into many ads and reports results for all versions together. Meta says it should not replace a split test, and since June 2024 it may not be offered for new app-promotion ad sets [161].

Even a real split test has a catch. It randomizes who is eligible to see each version, not who actually sees it. The delivery system then shows each version to the people it predicts will respond. Braun and Schwartz, writing in the Journal of Marketing in 2025, call this divergent delivery. Each version reaches a different mix of people. So a platform split test mixes the effect of the ad with the effect of the targeting. Their evidence is one Meta test with a web lead form, plus a formal argument [162,163]. The winner is the winner for the audience it was given. It may not win with everyone CL-020.

A team that wants to know which version will perform best on that platform can use the split test as it is. The authors say that is what the tool is built for. A team that wants to learn what message works cannot get that from a platform split test. Each version is measured on a different mix of people, even with a holdout [162,163]. Isolating the message needs a design that holds delivery fixed. A team that only wants spend to flow to what performs can use adaptive allocation, but should not call its output a finding.

Creative fatigue is real in practice, thin in evidence

Every performance team manages creative decay. Yet we found no rigorous public estimate of its size for app ads. A September 2026 preprint by a data scientist at the agency group WPP proposes a way to screen for fatigue. It was tested only on 264 synthetic cases, and the author disclaims validation on real campaigns. It reports no real-world effect size [164,165]. Widely repeated figures on how fast click rates fall after repeated exposure could not be traced to any source we could open. We do not use them.

Formats and the rules on rewards

Rewarded video, playable ads and interstitials dominate game supply. Store rules draw a line between rewarding a user for something inside an app and paying them to install or rate other apps. Apple bars apps from making users install other apps, rate or review to unlock features, but lets apps reward in-app actions such as watching an ad [166]. Google Play's current policy bars attempts to manipulate an app's placement, including paid or incentivized ratings and reviews. It also bars apps whose main purpose is paying users to install other apps [167]. In 2017 Google also called incentivized installs a legitimate channel for some developers, if not used to game rankings [168]. The two stores draw the line in different places.

Deep links and the path back into the app

A deep link sends a user straight to the right screen. A deferred deep link does the same for someone who does not have the app yet. It carries the context through the store install and restores it on first open [169]. For commerce and content apps, this is often the difference between an install and a first order. It can also carry campaign context from a web page or an ad to an in-app event, within consent and platform limits. Routing a user is not the same as attributing the install.

Web-to-app: the store rules are moving

In April 2025 a US court barred Apple from charging commission on purchases that apps link out to on the web. It also barred Apple from steering users with discouraging screens [97]. In December 2025 the Ninth Circuit upheld the contempt finding and most of the rules against steering. It held that a total ban on any commission went too far and sent the fee question back to the trial court [97]. On 30 June 2026 the Supreme Court agreed to hear one question from Apple's appeal: whether a company can be held in contempt for breaking the spirit of an injunction [170,99]. The fee itself is being set by the trial court. In August 2026 that court refused Apple's request to pause the work [171]. Justice Kagan paused it for a day on 12 August, then denied Apple's application on 13 August [172,99] CL-021. At the cutoff no US link-out fee had been approved.

Google's US changes followed its own case. From October 2025 developers could tell US users about outside prices, link out and offer other billing. From July 2026 third-party stores gained access to Play's catalog unless a developer opts out. From October 2026 developers using outside billing or links must report those sales and pay service fees [98]. Epic and Google had asked the court to soften the original order as part of a settlement. They withdrew that request on 14 July 2026, so the original order still applies [173].

Web-to-app journeys matter for two reasons at once. They can change unit economics, because a web payment can cost far less than a store commission (chapter 7). They can also change measurement, because a web checkout sees the user, the campaign and the purchase in one place. Claims that web-to-app flows convert several times better than store installs circulate widely; we could not find a source to verify them.

New discovery surfaces

AI assistants are starting to surface apps. At its May 2026 developer conference, Google said app discovery in its Gemini assistant would roll out "in the coming weeks", alongside "Ask Play", a chat layer on Play search [174]. We could not confirm the rollout was complete by the cutoff. OpenAI opened app submissions and an in-ChatGPT app directory in December 2025, with apps called up by name or from a tools menu [175]. These are early surfaces to watch, not yet channels with measurable demand.

Chapter 7

Retention, monetization and payback

Payback is decided by who stays, how they pay and what the store keeps. The first two are hard to predict. The third changed in 2026.

Retention: a steep cliff and a long tail

GameAnalytics' 2026 benchmarks cover more than 16,000 mobile games with at least 1,000 monthly users across 2025. The median game kept about 22% of new users on day 1 early in the year, a figure that fell through 2025. It kept just under 4% on day 7 and 0.7% to 0.8% on day 30. The top 1% kept 64% to 68% on day 1 and 13% to 15% on day 30 [4].

Three limits apply. The report does not say whether "day 30" means users active on exactly that day or on any day since. It reports medians across games, not across players, so it describes the typical title, not the typical user, and many of those titles buy no ads. And the games in it are those that chose GameAnalytics. Compare your own day-30 figure to these only on the same definition and the same cohort age.

Subscriptions: few convert, many leave

RevenueCat's 2026 report draws on more than 115,000 apps and about $16 billion of tracked revenue, mostly from 2025 [148]. In its panel, apps with a hard paywall turn a median 10.7% of downloads into payers within 35 days, against 2.1% for freemium apps. Trials of 17 to 32 days convert a median 42.5% of trial starts, against 25.5% for trials under four days. The median app kept 28% of annual subscribers after one year, for subscriptions started in 2024, down from 31% a year earlier [148]. RevenueCat's blog restates this as about 72% cancelling in year one. Its comparison with 56% the year before mixes two reports' methods, so it is not a trend [5]. The first year is paid up front, so the loss falls on renewal revenue. More than half of three-day-trial cancellations happened on the first day [5]. Adapty's panel of about 16,000 apps, with no period stated, puts average install-to-trial conversion at 10.9% and trial-to-paid at 25.6% [176].

Two findings matter for acquisition. First, failed payments. In RevenueCat's report, billing errors caused 32.2% of Google Play subscription cancellations, against 15.2% on the App Store; its summary gives 31% and 14% [148,5]. That is a billing problem, not a media problem, and fixing it can raise lifetime value without buying a single install. Second, early value and retention can pull apart. Across RevenueCat's categories, "AI apps" realized a median $30.16 per paying user in the first year, against $21.37 for other apps. But after 12 months they kept 6.1% of monthly subscribers, against 9.5% [148,5]. That is a comparison between categories, not evidence about how a bidding model ranks users. It is still a warning: a model that learns from early value alone can miss faster decay.

These panels describe each vendor's own customers. They are not market averages. Paywall design, price and category explain much of the spread, and the panels say nothing on their own about media quality.

Ad-funded apps get paid fast

AppsFlyer's monetization panel finds that in-app ad revenue reaches 89% of its day-60 total by day 7 [147]. Part of that speed is simply churn: most players are gone by then. It is still why ad-funded games suit today's bidding machines (chapter 5). The same report drew on $7.2 billion of in-app ad revenue across its measured apps from January 2025 to March 2026. It also counted $0.9 billion of store-verified one-off purchases and $0.8 billion of store-verified subscriptions [147]. Those are panel totals, not market sizes.

Ad load links acquisition and monetization. More ads raise revenue per user today and can push users away tomorrow. Unity's study of eight apps found that users who watched rewarded ads were 4.5 times more likely to buy in-app [177]. That is a correlation among users who chose to engage. It cannot show the ads caused the purchases.

The best randomized evidence on ad load comes from outside games. Pandora randomized about 34 million listeners into nine ad-load levels for 21 months. After 21 months, listeners were about three times as sensitive to ad load as a one- or two-month test would have shown. Estimates from observational data were biased and sometimes pointed the wrong way. Heavier ad load also pushed more listeners to buy the ad-free plan, though more stopped listening altogether [120,178] CL-032. One author works at Sirius XM Pandora, which allowed publication on condition that the authors not discuss its policy implications. The paper is a working paper. The lesson for app teams is about method: short ad-load tests can understate the long-run cost, and correlations mislead.

Cancellation rules shape renewal too. The FTC's 2024 click-to-cancel rule would have made online cancellation as easy as sign-up. A federal appeals court struck it down in July 2025 on procedural grounds [179]. In February 2026 the FTC restored its narrower pre-2024 rule, and in March it asked for comment on changes. No proposal had followed by the cutoff [180,181,182]. So no federal click-to-cancel rule was in force.

The store's cut is now a lever

Store fees used to be fixed background. They are now a choice with real money attached.

Take a $9.99 monthly subscription. At Apple's standard first-year rate, the developer keeps $6.99. At 15%, it keeps $8.49. On a web checkout at Stripe's published US card rate of 2.9% plus 30 cents, it keeps about $9.40 [187]. That is about 34% more than the 30% tier and about 11% more than the 15% tier CL-022. Put the other way, the web route can lose about a quarter of the store route's paying customers and still match its receipts against the 30% tier, at the same price. Against the 15% tier it needs to keep about 90%. Those figures count card fees only. Running your own billing adds subscription software, tax handling, chargebacks, fraud and support, which the store fee covers. And a web checkout adds steps, so fewer people may finish it. The net effect is something each app has to test.

Adoption is early and skewed to the largest apps. In RevenueCat's panel, web purchases were 3.2% of subscription revenue worldwide and 4.9% in North America. Some 41% of its top-tier apps earned web revenue, against 1.3% of the smallest [188].

Forecast value is a forecast

Because real value arrives late, many app teams bid on predicted lifetime value. The public evidence behind those predictions is weak. Google's published zero-inflated lognormal method was tested by its authors on a retail shopper dataset and a charity donor dataset, not on app install cohorts [189,190] CL-023. A 2021 blog post from one attribution vendor, written before SKAdNetwork 4, quoted its technology chief. The post relayed customers' claims of reaching "the same level of scale" as under the old device ID, with no accuracy figures, sample or method [191]. Practitioners have long warned that backtests on old cohorts miss changes in competition and cohort size [192].

The published game evidence shows where models break. A game-data firm tested models on one freemium role-playing game, using about 2,500 paying players who had stopped playing. Its neural network's error averaged 5.7% of the largest single player's spend, against about 9% for a classic statistical model. That scaling flatters both. On a standard per-player measure, the errors were 74% and 96%. For the top fifth of spenders, the first measure gave 15.6% against 33.4% [121,193]. The classic models badly underestimated the biggest spenders, who in this game can bring in up to half of all revenue. Two recent preprints, neither peer reviewed, claim better game models. One, by Tencent staff, used the first week of play of about 3 million new players of one very large game to predict the next month's spend. Adding uncertainty estimates cut error on the top 5% of spenders from 48% to 19% for one model. Google's published method did worst on that measure, at 75% [194,195]. The second preprint was removed by arXiv's administrators because the submitter did not have the right to agree to its license. No full text is available, so we do not use it [196].

The minimum standard is simple. Backtest any model on mature holdout cohorts it never saw, with no future data leaking in. Report error by channel, platform, country, price point and value band, with ranges, not just an average. Track drift every month. When the product, price or channel mix changes, expect the model to break and re-check it.

Contribution, not ROAS

Return on ad spend hides several choices. It can use gross sales or net revenue. It can count ad revenue or not. The cost side can be media only, or fully loaded with fees, creative, measurement and staff. The same campaign can return more than 100% of media cost in gross revenue and still lose money on contribution after fees, refunds and overheads. The model above shows both views side by side. The metric dictionary in the appendix defines each term.

Chapter 8

Quality, leakage and the expansion bets

Fraud takes credit it did not earn. Streaming TV can earn credit it cannot prove. Both are measurement problems before they are media problems.

Fraud that steals credit

Many of the fraud types the attribution companies describe take credit rather than fake impressions. Click spamming fires masses of clicks so that some land just before real installs. Click injection fires a fake click in the seconds before an install completes, to win last-click credit. SDK spoofing sends fake install or event messages with no real phone behind them. Device farms produce installs at scale. Faked in-app events claim cost-per-action payouts [197,198]. All of them exploit the credit rules of chapter 4.

Attribution companies describe detection by the timing between click and install, and by signed messages from their software kits [197,198]. Some block traffic before credit is given; some flag it afterwards. What happens to the money is less clear. AppsFlyer's product page speaks of helping advertisers "reclaim wasted spend". But it and the other pages we checked describe no standard process, such as fixed dispute windows or automatic refunds, between advertisers and ad networks [197].

Accreditation tells a similar story. The Media Rating Council lists several firms accredited to detect sophisticated invalid traffic in mobile apps. They include DoubleVerify, HUMAN, Integral Ad Science, Pixalate, Protected Media and some of Google's and Meta's own services. AppsFlyer, Adjust, Singular and Kochava, the attribution companies app marketers rely on for install fraud, do not appear on it, checked on 27 September 2026 [200] CL-024. That does not mean their tools fail, or that no audit has ever taken place. It means the list we checked did not show them as accredited for this.

The one large public legal test ended without a court ruling on fraud. In 2017 Uber sued its agency Fetch Media. Uber said it had paid more than $82.5 million for mobile ads. It alleged that some were not viewable or took credit for installs they did not cause. That federal case was dismissed later that year [201,202]. In a separate state case, Uber, the ad network Phunware and four individuals settled in October 2020 for $6 million, all denying wrongdoing. The court had earlier struck Phunware's pleadings as a sanction [203] CL-025.

Incentives sit on a line. Paying users to install and open an app can inflate user counts and session numbers. An academic study found paid-install services on Google Play doing just that, with weak enforcement [199]. Rewarded ads inside an app the user already chose are a different thing, and both stores allow them (chapter 6).

Supply accountability is still partial

The industry's supply-chain files let buyers check who may sell an app's inventory. In a May 2023 post, the security firm HUMAN reported on bid requests its own product screened. For app and streaming TV requests, 25% came from apps with no known app-ads.txt file, against 3% on the web. About 9% came from sellers missing from the seller registry, against 8% on the web. One check favoured apps: unauthorized sellers were 5% of app requests, against 8% on the web [204,205]. Those are one vendor's figures, three years before the cutoff. On most of these checks, supply controls covered apps less well than the web.

Streaming TV: household credit is not lift

Streaming TV ads for phone apps are the expansion most vendors now pitch. The question is how an ad on a living-room screen gets tied to an install on a phone. We found four kinds of method in vendor documents.

• IP matching. AppsFlyer's cross-platform attribution links a TV ad view to later installs by probabilistic modelling on IP address alone. It can credit several installs by several people to one TV impression [206,207].
• Viewing data plus an identity graph. Kochava links Samba TV's automatic content recognition (ACR) data to a household and device graph. Samba TV says the data come from about 50 million smart TVs whose owners opted in. It measures lift with synthetic control groups built after the campaign, which are modelled rather than randomized [208]. ACR data carry privacy risk. In 2017 a TV maker paid $2.2 million to settle US charges that it collected viewing data from 11 million TVs without consent [209]. The author works at Samba TV; see the disclosures.
• A household graph. MNTN credits a later website visit, not an app install, to a household that watched a full TV ad. It uses a graph it says covers 99% of available US households and does not disclose the matching method [210].
• Platform conversion feeds. Roku's ads manager records outcomes, including app installs, through a pixel and a server-to-server feed. It steers delivery toward households likely to convert, without saying how it matches them [211]. Moloco's streaming TV page describes household and IP matching, with credit running through the advertiser's attribution company [129].

Each method makes a modelled link between a TV or household exposure and a later event. It does not show who in the household watched. Matching alone cannot say how many installs the TV ad caused. That needs a control group: randomized, or a geographic or synthetic comparison with its assumptions stated. Some vendors now build one in: Moloco describes a ghost-bid holdout for its streaming TV product [129]. But our searches found no independent, published randomized study of streaming TV ads on app installs at the cutoff. Every lift claim we located was designed and reported by the vendor CL-026. Moloco's launch release, for example, reports up to 1.5 times higher return on TV than mobile in early campaigns, with two-thirds of installs within six hours of exposure. It does not describe the test behind those numbers [212]. We did not examine every CTV vendor; Wurl, tvScientific and iSpot are among those not profiled here.

Two things share the "CTV and apps" label. One is TV advertising aimed at a phone app outcome. The other is winning users for apps that run on the TV itself. The bridge above applies only to the first. The second is a closed loop on one device, which is easier to measure and smaller.

The best general causal study of TV advertising, covering 288 consumer brands, measured effects on store sales, not apps [123]. It shows such studies can be done. We found none for app installs.

Commerce: the biggest bet is still self-reported

AppLovin opened its self-serve Axon Ads Manager to e-commerce advertisers by referral on 1 October 2025, with a few hundred advertisers live. An earlier invite-only phase was limited to brands with at least $10 million of gross merchandise value [213]. Management promised a public opening for June 2026. On 22 June the chief executive said any business could now sign up without a referral code, under the new name AppLovin Ads [214]. On its first-quarter call the chief executive offered a hypothetical: if 100,000 new customers joined in the first year, that would imply about $7 billion of ad spend [215]. That is arithmetic on an assumption, not a target or a result. AppLovin's filings through its second-quarter 2026 report mention e-commerce as an area of growth but do not break out e-commerce revenue [21,24] CL-033.

Moloco sells a separate commerce-media product that powers onsite ads for retailers, and lists Costco among its customers [216]. That is retail media, not app acquisition, and a different buyer.

For commerce apps, the value to count is contribution from repeat orders, not gross merchandise value. A marketplace's GMV is not its revenue, and its revenue is not its profit. A campaign that lifts first orders but fills them with discounted, one-time buyers can grow GMV and lose money.

Chapter 9

The market instruments

A matrix can show what vendors document. It cannot show who performs best. This one is built to keep those two things apart.

How the sample was built

The research started from the playbook's list of app platforms, used as search seeds, not as a verified peer list. It added companies found in filings, partner pages and product documents. Every row in the universe carries its parent company, roles, ownership and status as found, with sources. Parent companies and products are counted separately, so a company with four brands counts once as a company. The universe is a discoverable sample, not a census. Firms that publish little are under-represented by design, because the method only scores what can be seen, and firms that failed or closed were not studied.

Deep profiles were chosen to cover roles, not size. Five are larger platforms, most with owned supply or measurement: AppLovin, Moloco, Liftoff, Unity and Mintegral. Digital Turbine combines device distribution with an exchange. Kayzen and Jampp are self-serve DSPs, Smadex is a managed-service DSP and Remerge is a retargeting specialist. Verve Dataseat is the mobile DSP of an omnichannel group. The author was an executive at Verve Group from 2022 to 2024. Verve Dataseat was scored under exactly the same rules as every other product, by both passes. Its n/e cells mark documents neither pass could find, such as fee terms behind a "contact us" form.

How scores work

Each product was scored on eleven dimensions, each with observable anchors written before scoring. A 3 needs documented, live capability of the strongest kind: for example, a campaign-management API rather than a reporting API, or log-level export rather than dashboards. A 0 means documented absence. "n/e" means the public evidence was not enough to score, and it is never treated as zero. "n/a" means the dimension does not apply. Each cell also records availability: live, beta, limited, managed-only or announced. It also records an evidence grade. A means technical documents, API references or filings; B means vendor marketing or press releases; C means third-party reporting. The grade records the type of source, not the strength of a performance claim: an API reference is strong proof that an endpoint exists and says nothing about results. The matrix marks cells that are beta, limited or managed-only with an asterisk. That matters most for lift tests, where a well-designed product may still sit behind an account team.

Four rules kept the scoring even. A parent company's product does not count for a sibling product. A partner-directory listing does not prove a feature. A reporting API is not campaign control. And the same standard applies to incumbents, challengers and any firm connected to the author.

Two model passes scored the panel. The first built the profiles. The second scored the same products blind, from sources it opened itself, without seeing the first scores. Across 176 product-dimension cells, the two passes gave the same value in 94 (53%). Where both gave a number, they were within one point in 93 of 97 cells. 50 disagreements were between a score and n/e, which usually means one pass found a document the other did not. Disagreements were settled by the published rules in the reconciliation script, and every disagreement is listed in the package. Fact-check corrections changed four cells directly: Meta's and Google's publisher visibility, Jampp's lift-test score and Amazon's buyer control. Meta's and TikTok's campaign-API scores gained primary sources. This is two passes by AI agents under the author's direction. It is not independent human review, and the paper does not claim inter-rater reliability.

What the matrix shows

With the sources from both passes combined, 17 of 121 product-dimension cells (14.0%) still lack enough public evidence to score and 104 are scored. Of the 104 scored cells, 62 (59.6%) rest on grade-A evidence: developer documents, API references or filings. The five benchmark channels are scored separately and sit outside these counts.

Optimization is the best-documented capability. 9 of 11 products document bidding toward value or return on ad spend.

Fees are the least documented. Only Kayzen publishes a fee schedule; 7 products state a pricing model and little more.

No product documents both SKAdNetwork 4 and AdAttributionKit at the level of technical documents. The best iOS scores are 2: Digital Turbine, Moloco, Remerge, Verve Dataseat.

No specialist documents a standard lift test with its method at the top anchor. 4 document one at the middle anchor, on request, as a managed service or without a published method: AppLovin, Jampp, Moloco, Remerge. Meta, Google and TikTok document lift tests with test and control groups, though they run through account teams.

Buyer control and data export are uneven. Campaign-management APIs: AppLovin, Kayzen, Liftoff, Mintegral, Moloco, Unity. Log-level export: Jampp, Moloco. Documented publisher and placement visibility with block lists: Digital Turbine, Kayzen, Mintegral, Moloco.

The App Quotient

The matrix also rolls up into one summary number, the App Quotient (AQ). It is built the same way as the Contextual Quotient in the author's contextual research [217]. AQ is a quotient, not a sum. It has three groups, chosen by the author. Depth is what the engine can do for growth: optimization objectives, re-engagement and creative. Reach is channel and category coverage: iOS privacy measurement, streaming TV to app, and non-gaming evidence. Standing is whether a buyer can check and control it: placement visibility, fees, lift tests, reporting export and buyer control.

Each group is the mean of whatever is scored inside it, so an unscored dimension is not counted as a zero. That also means group scores can rest on different amounts of evidence, so each score shows how many fields back each group. The groups combine at 45/25/30. The result is then pulled toward the field mean, as if each product had four extra cells at that mean. The weights and the four extra cells are the author's assumptions, not a calibrated reliability adjustment. The pull reduces the effect of a thin record; it does not remove the bias from fields that are missing. AQ is scaled so that 100 would mean every cell at the strongest anchor with no pull; with the pull toward the current field mean, a product scoring 3 on all eleven fields would get about 91.6. The three bars under each score are Depth, Reach and Standing, in that order.

Read the band, not the rank. Bands sit at anchor averages on the 0–3 scale: high documented capability from 77.8 (an average of 2.33), documented from 66.7 (2.0), partly documented from 55.6 (1.67), and thin below. The bands on these inputs are high documented capability: Moloco, Mintegral; documented: Remerge, Unity, AppLovin, Jampp, Liftoff, Verve Dataseat ◆; partly documented: Kayzen, Digital Turbine, Smadex. Mintegral clears the top band's cut-off by only 0.03 points, and its Reach score rests on 1 of 3 fields. The ◆ marks a product the author has a declared interest in. Under four reasonable reweightings (equal weights, then each group raised in turn), Moloco stays in the highest band under all four, though not always first; Mintegral drops a band under the Depth-led and Standing-led weights. Mid-table positions move more: by up to 5 places, which is nearly half this eleven-product table, and by 1.2 places on average. Across the four, 9 of 44 product results change band. The order is not a league table and is not presented as one. AQ sums up public documentation under the author's chosen groups and weights; it does not measure campaign performance. It inherits every limit of the matrix, and because its inputs are documentation scores, it still favours the vendors that publish the most. Every input is in the CSVs in the appendix, so the index can be recomputed on different weights.

A buyer should use the matrix, not the index, to decide. It shows which claims a vendor documents, links the source, and marks what to ask for on the rest.

The benchmark channels

Meta, Google, TikTok, Apple Ads and Amazon answer the same buyer questions in different ways. All five document campaign-management APIs, not only reporting [218,219,104,220,221]. Meta, Google and TikTok document lift tests with test and control groups that run through account teams [125,126,127]. Their automated app campaigns choose placements for the buyer. Google's placement report names the apps, publishers, websites and videos that showed ads, but gives impressions only and folds low-volume placements into one line [222]. TikTok's Smart+ does not allow manual placement choice [142]. Meta lists placement among its reporting breakdowns but describes no breakdown by publisher app [223]. TikTok documents full SKAdNetwork 4 support [224]. Its Smart+ app campaigns offer value bidding on Android only; its standard app campaigns offer it on iOS too [142,143]. Apple Ads uses its own direct attribution interface alongside AdAttributionKit [85]. Amazon's February 2024 app-event tooling covered Android and Fire devices. By September 2026 AppsFlyer described a closed Amazon test for iOS, and we found no Amazon page stating current iOS availability [225,226].

The systems around the media

Attribution, testing, analytics, subscription, lifecycle, store-intelligence and mediation tools shape app growth without buying media. Ownership matters here, because independence is part of what a buyer pays for. Adjust is owned by AppLovin [227]. Google owns the AdMob mediation platform and the Firebase testing and analytics tools alongside its app campaigns [228,28]. Statsig was bought by OpenAI, and its customer business then passed to Amplitude within about eight months [56,57]. Data.ai joined Sensor Tower in 2024 [229]. AppsFlyer, Kochava, Adjust and Singular all document incrementality products, and their methods differ [230,231,232,233]. Adjust's InSight compares an app with a synthetic control built from other apps, so its baseline is modelled. Singular's Audience Incrementality holds back a control group from an audience; its FAQ does not say the split is random.

Chapter 10

The buyer's operating model

Control is only worth what the buyer can do with it. A log file nobody reads is a cost.

What each model gives and takes

Walled gardens. Google, Meta, Apple and TikTok document campaign-management APIs, so a buyer can create and change campaigns in code, and Amazon documents one for its DSP [218,104,219,220,221]. Their automated app campaigns choose placements for the buyer. Google's placement report names the apps, sites and videos that showed ads, but gives impressions only, not results by placement [222]. TikTok's Smart+ app campaigns do not allow manual placement choice [142]. Meta's Advantage+ app campaigns limit targeting to operating system, country and language. They list placement among their reporting breakdowns, but the page describes no breakdown by publisher app [223] CL-027. The trade is simple: reach and automation in exchange for less visibility.

Self-serve specialists. Kayzen documents a campaign-management API that edits bids and daily and total budgets [234]. Jampp documents a reporting API and log-level data for data-science teams, and advertises always-on lift measurement without documenting the method [69]. These are the tools transparency advocates ask for. They are also work: someone has to take in the logs, keep the event pipeline clean and read the tests.

Managed service. Smadex, owned by Entravision, describes its teams as acting "as an extension of our client's marketing team" and setting bids and fraud controls for clients [235]. Remerge offers managed service alongside programmatic buying [236]. Managed service moves the work to the vendor, and moves some visibility with it.

In-house and agencies. In a 2023 survey of 162 members of the Association of National Advertisers, 82% had an in-house agency, up from 58% in 2013 [237]. In the association's 2026 survey, only 9% named cost savings as the main benefit, down from 30% in 2023 [238]. The two surveys asked different groups, and the 2026 question was worded slightly differently, so the drop is a pointer, not a measured trend. In-housing is common, and it is not mainly about saving money.

When control pays for itself

Transparency does two separate jobs. The first is cutting waste: blocking apps with no supply-chain file, sources with telltale click-spam timing, or placements that never convert. Some of that is policy, such as refusing unauthorized sellers, and needs no experiment. Whether a given cut raises profit is still a question a test can answer. Chapter 8 shows how much unverified supply and fraud there is to cut.

The second job is choosing between partners or strategies. That is where control has real costs: people, tools and the time a new setup takes to learn. On performance, it pays back only if the buyer uses it to beat what the platform would do alone, which needs three things:

1. Volume. Enough spend that a few points of efficiency cover the team. At small budgets, one analyst can cost more than any likely gain.
2. Clean data. A server-side event pipeline, a defined contribution metric, and someone who can read log-level data.
3. A test. The ability to run holdouts. Without them, the buyer is choosing between two attribution reports, not two platforms.

Control also has uses no performance test captures: brand safety, children's privacy, procurement and audit. Where the three conditions hold, self-serve and API control can beat a managed or fully automated setup. Where they do not, a managed or automated platform may produce a better total result. We found no public study that measures the net value of transparency to buyers after operating costs CL-028. The tool below shows why the answer usually turns on the performance assumption, which only a test can supply. Its defaults are illustrative, not survey data.

US commercialization: localization is rarely the only constraint

The author's playbook argues that app-growth vendors fail in the US less for lack of demand than for localizing the wrong things: buyer sequence, positioning, measurement story and proof [96]. The evidence supports the first half. The US holds about 42% of global spend in the acquisition section of AppsFlyer's report, and US iOS acquisition spend grew 25% in 2025 [6]. Demand exists.

It qualifies the second half. For a challenger, the binding constraint is often one of these instead:

• Proof. The big platforms run their own lift tests through account teams. A challenger that cannot show causal results through a third party competes on attribution reports that favour incumbents with more signal.
• Signal. Privacy thresholds give richer postbacks to bigger campaigns (chapter 3). A new entrant with little spend per campaign learns more slowly.
• Supply and data. Owned auctions feed some leaders' models (chapter 2). A challenger buying on open exchanges starts with less.
• Economics. Managed service carries staff cost. Self-serve moves that cost to the buyer.
• Rules. Children's privacy rules and state app-store laws add compliance work, with dates still moving (chapter 11).

The playbook's "representative outcomes" are anonymized patterns with no metrics [96]. They are illustrations, not measured client results, and this paper does not use them as evidence.

Proof gates

A practical sequence for a buyer, or for a vendor selling to one, follows from the evidence. Each gate has a pass condition.

1. Event readiness. Server-side events for the value metric, deduplicated, with refunds.
2. Attribution parity. The new partner's results sit in the same attribution company and the same windows as incumbents.
3. Holdout. A randomized or geographic holdout on at least one campaign, with the design written down before launch and enough volume to detect the expected effect.
4. Contribution. Payback on net revenue after fees, with observed and forecast value shown apart.
5. Scale test. The second budget step, judged on marginal return, not average return, at the higher spend.

Chapter 11

The next app-growth system

Bidding is already automated. The next contest is over who sets the objective, who approves the changes and what the buyer can take away.

Testing the "Apps DSP" idea

The author's playbook proposes that challengers sell an "Apps DSP": a decision layer across acquisition, re-engagement, lifetime value, streaming TV and commerce, in place of a mobile DSP [96]. Treated as a hypothesis, it makes three claims. There is a set of capabilities that belong together. Buyers see the set as a category. And platforms that have it produce better outcomes.

The capability matrix in chapter 9 can test the first claim. Define the core as documented capability of at least 2 on value optimization, re-engagement, iOS privacy measurement, lift tests, reporting export, buyer control and streaming TV. This is our own screen, not an industry definition. Commerce is in the playbook's list, but the matrix has no commerce field, so the screen leaves it out. On that definition, 1 of the 11 execution products documents the full set: Moloco. AppLovin, Jampp, Kayzen, Remerge, Verve Dataseat document at least five of the seven. The most common gaps are iOS privacy measurement, lift tests and streaming TV. The threshold matters: at a score of 1 on every field, 3 products pass; at 3, 0 do. For the second claim, we found no buyer survey that uses the term in the sources searched by the cutoff. For the third, we found no public test. The verdict: the label describes a real checklist that one product documents in full. No one has shown that buying the bundle beats buying the best parts CL-029.

What would prove the category? Independent lift results, across at least two non-game categories, showing an integrated platform delivers more contribution per dollar than a mix of specialists measured the same way. What would disprove it? The same tests showing the bundle does no better once the buyer's own measurement is held constant.

What AI does now, and what agents add

Automated bidding is old news. Every major platform prices impressions with machine-learning models. AppLovin's disclosure describes its model scoring impressions from device, auction and advertiser data [29]. Mintegral says smart-bidding products drove more than 90% of its revenue in the first half of 2026 [240]. Google keeps widening automatic features in search campaigns [241]. Generative creative is spreading too, though some of it is only announced. A June 2026 Unity Ads newsletter, hosted outside Unity's own site, lists generative creative tools as coming with "agentic Vector" later in the year [242].

Agents are different. They plan, create and change campaigns through the platforms' interfaces, not just set bids inside them. Three of the largest platforms have published official servers for the Model Context Protocol, the common standard AI assistants use to call outside tools:

• Google announced an open-source Google Ads API server in October 2025. It is read-only by design: its documents say it cannot change bids, pause campaigns or create assets [243,244].
• Meta runs a hosted ads server. Users sign in and approve the permissions it requests [245]. Its tools create and edit campaigns, ad sets, ads and catalogs, and set up tests [246]. New campaigns, ad sets and ads start paused, and Meta says the AI client asks for confirmation before switching them on. The page describes no such step for edits to live campaigns, such as budget changes [247]. It also offers reporting and activity-log tools, and its overview page gives no launch date [246].
• TikTok exposes about 400 advertising functions, including campaign creation and budget changes. Its help page says agents can run whole workflows "without human intervention at every step" and describes no approval step [248] CL-030.

These servers wrap campaign APIs that have long let software make changes without a person approving each one. The new part is that a general-purpose AI assistant can now use them. Account permissions and budgets still apply. But a per-change approval limit usually sits in the agent the buyer runs, or in the contract, not on the platform's server. So buyers should ask three plain questions: is this read or write access, who approves changes above a set limit, and where is the log?

Standards for agents

Two families of standards aim to set how buying agents work. The Ad Context Protocol, governed by AgenticAdvertising.org, reports its own first agent-to-agent media buy with real money in October 2025. Its latest stable release at the cutoff was 3.1.24, published on 23 September 2026 [249,250,251]. Its governance specification lets a buyer set approval thresholds, such as a budget cap above which a person must approve. It also requires an audit log entry for each governance check [252,253]. It also splits duties: the agent that runs buys cannot set its own spending limits or approve its own plans [254]. But this part of the protocol is experimental and opt-in. Its rules bind only when a plan has a governance agent, and approval-flow conformance tests apply only to sellers that declare governance support. A governance agent can also run in an audit mode that approves everything and only records findings [253,255]. IAB Tech Lab's Agentic Advertising Management Protocols (version 3.0; page last updated 22 September 2026) is an umbrella. It covers direct-deal workflows, a component for automated campaign planning, and the Agentic RTB Framework, which works inside real-time bidding systems [256,257,258]. Its 2.0 release in April 2026 added buyer and seller agent kits with configurable human approval gates [259]. In the pages we read, neither family refers to the other, and none of the app platforms we profiled documents support for either. The author co-leads a working group within the Ad Context Protocol; see the disclosures.

The rules tightening around app data

Whatever the agents do, the data they work with is getting harder to use. Four sets of rules moved in the year to the cutoff.

Children. The FTC's amended children's privacy rule took effect in June 2025, with a general compliance date of 22 April 2026 [260]. Apple's guidelines restrict third-party analytics and ads in apps aimed at children. Google Play requires child-directed apps to use only certified ad kits and bans interest-based ads and remarketing to children [59,261].

Age checks in the stores. Texas's app-store age law took effect after the Fifth Circuit paused the lower court's injunctions. It did so briefly on 28 May 2026 and for the whole appeal on 4 June. The appeal was argued on 4 August, and the docket showed no ruling on the merits by the cutoff [102,262]. Utah delayed its duties to 6 May 2027 and dropped state enforcement; only harmed minors or their parents can sue [263]. Louisiana stopped its 2025 law from taking effect, and its replacement duties start on 1 July 2027 [264]. California's Digital Age Assurance Act, signed in October 2025, takes effect on 1 January 2027 [265]. Apple's Declared Age Range and Google's Play Age Signals pass age bands to apps [266,267]. Google's API is still in beta. At the cutoff it returned signals only in Brazil and for eligible Texas accounts, and its terms bar use for advertising, marketing, profiling or analytics [267]. So some users now arrive with an age band, in a few places, under tight limits.

Location data. The FTC has finalized orders against two location-data brokers, X-Mode and InMarket [268,269]. It also settled with Kochava, an attribution and data company. The court entered that order on 25 June 2026, after the FTC filed it in May [270,271,272]. It bars Kochava from selling or sharing sensitive location data, such as visits to medical or religious sites. The one exception is narrow: the consumer must deal with Kochava directly, give express consent and ask for the service. Kochava neither admitted nor denied the charges [271].

Consent on iOS in Europe. Chapter 3 covered the competition rulings and Apple's beta consent sheet.

None of these rules stops app advertising. Together they make the data behind targeting, attribution and model training more conditional. That raises the value of first-party events an app collects with clear consent.

What a buyer can take away

An app marketer's spend trains the platform's model, and the model then serves every advertiser. A pooled model cannot hand its weights back to one client. The real questions are about data use and access: what the platform may do with the buyer's data, and what the buyer can export. AppLovin's legal disclosure on its model lists the data it uses and what it excludes, such as other bidders' data. It says nothing about what rights advertisers have over the use of their campaign data [29] CL-031. We did not review the full advertising terms of Meta, Google or TikTok, so we make no claim about them. In the EU, the Digital Markets Act gives some rights by law. Designated gatekeepers must give advertisers free access to their performance-measuring tools and the data needed to check ads independently. They must also give business users access to the data their use generates [273]. Those rights apply in the EU, not the US. A buyer who switches partners keeps its own event history, creative and test results. The pages we reviewed did not show any right to take the platform's learned state. That is a switching cost no invoice shows.

Three questions follow for any buyer adopting agents or automated buying:

1. Who writes the objective? The agent should optimize the buyer's contribution metric, not a platform default such as installs or attributed return.
2. Who approves? Changes above set limits should need a person, and each one should be logged where the buyer can see it.
3. What leaves with you? Event data, test results and the audit log should be exportable. The buyer's own test history is the learning that can move.

Chapter 12

Method, limits and corrections

This chapter says what was done, what it caught and what to distrust. It reports only checks that actually ran.

How it was built

The work ran on 27 September 2026 against a cutoff of the same day. The author set the questions, scope, definitions and scoring rules in a written brief before any research ran. Research agents then worked in separate streams. They covered market and platform economics, Apple and Android measurement, and attribution and causal evidence. Others took acquisition, creative and discovery; retention and unit economics; fraud and streaming TV; and buyer operations, AI and regulation. Three more covered vendor groups. A separate pass mapped the author's own writing. Three gap-fill passes followed up on questions the first round could not answer or the reviewers raised; the last of them answered the hostile reviewer's evidence requests.

Every stream worked from the same source rules. Filings and official documents came first; vendor material counted only as evidence of what the vendor says. Agents were required to open a source to cite it. Where only a summary, an abstract or a search result could be read, the source register says so, and confidence was lowered. The research consulted 621 distinct source addresses. That counts web addresses, not works: a study's abstract page and its PDF count twice. The research agents recorded 501 of these addresses as read in full. Records whose own notes say only an abstract, a navigation or index page, or headline figures were read are not counted as full. A full page is not always the full underlying report or docket. Part-way through, the session's web-search allowance ran out. Agents then worked from known official addresses, filing systems and academic indexes, and some gaps in the open-questions lists come from that limit. Some agents used a public read-only page renderer to read pages that blocked direct fetches, and the lead editor opened a few pages in a browser.

Verification ran as separate passes with a brief to refute. Five passes re-opened the sources behind the recorded findings and gave each one outcome: supported, qualified, contradicted, unresolved or withdrawn. At the time of this build the outcomes were 120 supported, 136 qualified, 10 contradicted, 2 unresolved and 4 withdrawn. Findings left unchecked: 0. Where a check found the numbers right but a label wrong, the editor re-graded the finding as qualified and logged why. The paper uses corrected wording wherever a finding was qualified. It never uses the original claim of a contradicted or withdrawn finding; where a check supplied a corrected statement, the paper uses that instead.

A second scorer rated the eleven execution products and five benchmark channels without seeing the first scores. A hostile reviewer read the whole draft looking for other explanations, selection effects and places where matching was presented as cause. It returned 30 issues, five of them blocking. An auditor checked the draft's numbers, formulas and citations and returned 48 issues, four blocking. All blocking issues were addressed; the thesis itself was narrowed as a result. Changes from all passes are in the corrections ledger.

ChatGPT (OpenAI) assisted with technical and editorial review and source verification. The author retains responsibility for the paper. This assistance does not constitute independent assurance or endorsement by OpenAI. The author ran three review rounds with it. The first review returned about 100 numbered points, plus notes on each headline claim and figure. Five further passes checked its 74 factual points, plus two extra checks, against primary sources. They found 36 right and 17 partly right. Another 19 had already been dealt with, by earlier passes or by edits in the same round; the audited file was not kept, so those two cases cannot be told apart for every item. One point could not be resolved, and one had flagged a source it could not reach, which the docket then confirmed. The checks also found errors the review had missed, such as a study whose peer-reviewed version changed its figures. The second review returned 25 findings; the change log records what was done about each. The third round was a close-out: it confirmed the corrections and asked for four final fixes, which were made. Each check is kept with the evidence files.

These are passes by AI agents working under one person's direction. They reduce error; they do not make the paper independent. The paper has not been peer reviewed or externally audited, and it reports no inter-rater reliability statistic.

Sampling and scoring

The vendor universe started from the playbook's list and grew through filings, partner pages and documents. It is a sample of what was discoverable, tilted toward firms that publish and firms that survived. Scores measure documented capability against fixed anchors; they say nothing about performance, and "n/e" marks missing evidence, not absence. The one composite, the App Quotient, is reported in bands, with the number of scored fields shown for each group. It does not count unscored cells as zeros, pulls thin records toward the field mean by an author-chosen amount, and is shown under four reweightings. Its order is not a ranking, and it still rewards disclosure.

Readability

Main prose was scored with the Flesch Reading Ease formula: 206.835 minus 1.015 times words per sentence, minus 84.6 times syllables per word, using the script in the package. The score covers chapter paragraphs, lists, summaries, callouts and thesis tests. It excludes tables, figure captions, instruments, references and URLs. Syllables are counted with a documented vowel-group rule, with acronyms counted as spoken. The result is 57.6 over 19,551 words, at 13.35 words per sentence and 1.604 syllables per word. That is the score for the measured prose, not for every word in the PDF: tables, profiles, captions and references are left out. The target was 85. Sentences were shortened and plain words used wherever meaning allowed. Terms such as attribution, incrementality and subscription carry many syllables and could not be removed without changing meaning, so the target was not met. The author accepts the measured score as a disclosed exception for this technical paper; 85 remains the target for the public summary. Chapter scores are in the package.

What to distrust

• Transfer from web to apps. The strongest causal studies measure web, search, retail and audio outcomes. Their lessons about attribution and ad load probably hold for apps, but that is an inference.
• Vendor panels. Spend, retention and subscription figures come from vendors' own client bases. They describe those clients, not the market.
• Global figures read as US figures. The spending shifts come from a global panel, and the fastest of them was driven by China-based e-commerce budgets. US-only category data were not available.
• Absence claims. Several findings say no public evidence was found. Those depend on what the research could reach after the search allowance ran out, and private studies may exist. Read each as "we did not find", not "none exists".
• Documentation scores. A vendor that documents less gets more n/e cells, and can look weaker than it is.
• Fast-moving rules. Court cases, store fees and consent screens were moving at the cutoff. Check dates before acting.
• The author's position. The author sells advisory services to firms in this market and works for a TV measurement company. The evidence rules were written to limit that bias; readers should still weigh it.

Corrections

Appendices

Evidence and reproduction

Every headline in this paper can be traced from the prose to a claim record, from the claim to findings and sources, and from any number to its formula or data file.

A. Claim ledger

B. Source register