PTKDMobile App Security
Knowledge base / PTKD-PRIV-TRACKER
low M6 MASVS-PRIVACY-1 static analysis PTKD-PRIV-TRACKER

Embedded third-party tracker

A third-party analytics/advertising/profiling SDK is bundled and typically collects user or device data. Each tracker is a distinct disclosure obligation (privacy policy, App Store/Play data-safety, and consent where required).

How it's exploited

The app bundles a third-party analytics, advertising, or profiling SDK that collects user or device data by default. Each such SDK is a separate data recipient the user is rarely told about, and it often starts collecting the moment the app launches, before any consent screen.

Why it matters

Undisclosed data sharing that breaks privacy-policy and store data-safety promises, and under GDPR/ATT collection without consent is a direct compliance problem.

How to fix it

  1. Confirm the SDK is actually needed; remove ones you do not use.
  2. Disclose it in your privacy policy and the store data-safety form.
  3. Gate the SDK behind consent (GDPR / iOS ATT) and do not initialize it before the user agrees.
Consent-gated initialization
if (consent.analyticsAllowed) Analytics.init(context) // never before consent

References