Lesson 2 of 6 · 9 min read · intermediate
Mobile app advertising: SDKs, mediation, MMPs and SKAN
How in-app ads work: SDKs, mediation and in-app bidding, rewarded video, MMP attribution, SKAdNetwork and AdAttributionKit, and in-app fraud.
The free game on your phone that shows a 30-second video before you get an extra life is running a small ad-tech company inside itself. In-app advertising has its own plumbing, different from the web: no cookies, no page URLs, and a set of software kits that decide in milliseconds which ad network gets to fill the slot.
A website is a shop on a public street, and anyone can walk past and read its signs. An app is a sealed building: to put an ad inside, you need a key cut by the building's owner. That key is an SDK.
The building blocks
| Piece | What it does | Examples |
|---|---|---|
| SDK | Code the app developer installs so an ad network or tool can run inside the app | Google Mobile Ads SDK, Meta Audience Network SDK |
| Ad mediation | A layer that decides which of several ad networks fills each ad request | AppLovin MAX, Google AdMob mediation, Unity LevelPlay |
| In-app bidding | Networks bid at the same time in a real-time auction instead of being called one by one | The in-app version of header bidding |
| MMP | A neutral referee that attributes installs and in-app events to the ad that drove them | AppsFlyer, Adjust, Branch, Singular, Kochava |
| app-ads.txt | The app developer's public list of authorised sellers | Hosted on the developer's website listed in the app store |
From waterfall to bidding
Early mediation used a waterfall: call network A at a fixed expected price; if it passes, try network B, and so on. It left money on the table because a lower-ranked network might have paid more on this particular impression. In-app bidding lets networks compete at once, and the highest bid wins. Most large apps now run a hybrid: bidding for major networks plus a short waterfall for the rest.
The formats
- Rewarded video: watch an ad, get a reward such as coins or a life. Users opt in, so engagement is high; gaming apps rely on it.
- Interstitial ad: a full-screen ad between levels or screens.
- Playable ad: a mini, playable demo of another game.
- Banners and native: smaller units inside the app layout.
- App-open ads: shown while an app loads.
Most spending in mobile is for app install campaign goals: an app developer pays to acquire users who will install and, ideally, spend money. That makes LTV (lifetime value) the North Star metric, and it is why so many buyers price on CPA or cost per install rather than CPM.
Attribution: who gets credit for the install
- Ad engagementThe user sees or taps an ad from network X. The network reports the click or view to the MMP.
- Store and installThe user goes to the App Store or Google Play and installs the app.
- First openThe app's MMP SDK wakes up and reports the install with available identifiers and signals.
- MatchingThe MMP matches the install to the most recent qualifying click or view, often using last-click attribution rules.
- PostbacksThe winning network is told it won, and later in-app events such as purchases are reported too.
From ad to sale: attribution
A shopper sees a video ad, then a social ad, then clicks a search ad and buys.
- Three ads, one person: A shopper sees a video ad, then a social ad, then clicks a search ad and buys.
- The sale: They place an $80 order. Now every ad platform wants the credit.
- Last-click says: search did it: Last-click attribution gives 100% of the credit to the final click. Simple, but it ignores everything that built the desire to buy.
- Multi-touch spreads the credit: Multi-touch attribution shares credit across the video, social and search ads using rules or models. Fairer, but it needs to track people across sites, which privacy changes have made harder.
- Incrementality asks the real question: Would they have bought anyway? A holdout group that sees no ads shows the baseline. The difference is the incremental effect, the sales the ads actually caused.
- Why fraud loves attribution: If credit goes to whoever touched the sale last, fraudsters can fake that touch. Click injection and cookie stuffing steal credit for sales that would have happened anyway.
iOS: ATT, SKAdNetwork and AdAttributionKit
Since Apple's App Tracking Transparency prompt arrived in iOS 14.5 in April 2021, most iOS users do not share their IDFA, so MMPs cannot match installs to specific users on iOS. Apple's answer is SKAdNetwork / AdAttributionKit (SKAN): the phone itself decides which ad network gets credit and sends a delayed, privacy-thresholded postback with limited data. In 2024 Apple introduced AdAttributionKit, supported from iOS 17.4, which is interoperable with SKAN and also works for alternative app marketplaces in the EU. Android still offers the GAID and the Play Install Referrer, though Google has also explored privacy changes.
AppLovin's rise
The biggest business story in mobile ad tech has been AppLovin. It combined a mediation platform (MAX), an ad network and a machine-learning engine called AXON, and grew into one of the most valuable ad-tech companies in the world. In June 2025 it completed the sale of its own mobile games studios to Tripledot Studios to focus entirely on advertising, and it has been expanding its engine beyond games into e-commerce advertisers. Its success shows how much power sits with whoever controls mediation, because mediation sees every auction.
Where in-app fraud hides
| Scheme | How it works |
|---|---|
| Click injection | A malicious app on the same Android phone detects when another app is being installed and fires a fake click just before it opens, stealing the attribution |
| Click spamming | Floods MMPs with millions of fake clicks, hoping to be the last click before organic installs |
| SDK spoofing | Fake install and event messages sent straight to MMP servers, with no real device at all |
| Install fraud via device farm or emulator farm | Real or virtual phones install apps over and over, resetting their IDs each time |
| App spoofing | A junk app declares a popular app's bundle ID in bid requests to earn higher prices |
| Hidden ads | Apps load ads in the background or off-screen where no one sees them |
Key takeaways
- Apps monetise through SDKs, with mediation deciding which network fills each slot.
- In-app bidding replaced much of the old waterfall by letting networks compete at once.
- MMPs attribute installs; on iOS, SKAdNetwork and AdAttributionKit do it on-device after ATT.
- AppLovin's rise shows the power of controlling mediation and machine-learning bidding.
- Click injection, click spamming, SDK spoofing and device farms are the main in-app fraud schemes.
Questions people ask
What is an MMP in mobile advertising?
A mobile measurement partner is a third-party company whose SDK sits in an app and works out which ad campaign led to each install and in-app action. It collects clicks and views from ad networks, matches them to installs, and reports results to both the app developer and the networks. Well-known MMPs include AppsFlyer, Adjust, Branch, Singular and Kochava.
What is the difference between SKAdNetwork and AdAttributionKit?
Both are Apple's privacy-preserving frameworks for attributing app installs to ads without sharing user-level data. SKAdNetwork arrived first and became essential after App Tracking Transparency. AdAttributionKit, introduced in 2024 and supported from iOS 17.4, builds on SKAN, is interoperable with it, and also supports alternative app marketplaces in the EU. Networks registered with SKAN do not need to re-enrol.
What is click injection?
Click injection is Android attribution fraud. A malicious app already on the phone listens for signals that another app is being installed, then generates a fake ad click just before the new app is first opened. Because many attribution systems credit the last click, the fraudster steals credit for an install it did not cause, often an organic one the advertiser would have got free.