Islamabad: When an advertisement appears inside a free app, an exchange of data can take place in the background. Advertising networks may receive information about your device, location and interactions with the ad, often without users understanding how widely that information travels.
A review of 49 mobile advertising networks marketed to advertisers in Pakistan found that most were small, recently established or difficult to verify through public information.
Only 16 were rated as established companies or major industry players. The remaining 33 fell into categories covering smaller or insufficiently verified businesses, a network flagged for complaints, and names that could not be confidently identified.
What advertising networks can see
The information available to a network depends on the app, its permissions, the advertising technology involved and the restrictions imposed by the operating system. It can include several layers of data.
Device identifiers
A key identifier is the phone’s advertising ID: Google’s GAID on Android and Apple’s IDFA on iPhones, where access is permitted. Networks may also receive an IP address and a “user agent” string containing information about the app, browser or device.
Older or rogue software development kits, commonly called SDKs, have also collected more persistent identifiers, including IMEI numbers, Android IDs and MAC addresses. Apple and Google restrict access to such information, although collection through noncompliant software remains a concern.
Device and network details
Networks may receive the phone’s make and model, operating system version, language, time zone, screen size, mobile operator and connection type. Some software may collect additional signals, such as battery information.
Individually, these details can appear innocuous. Combined, they may help create a device “fingerprint”, allowing a phone to be recognised without relying solely on its advertising ID.
Location
An IP address can provide an approximate location. Precise coordinates may also enter the advertising supply chain when an app has location permission and shares that information through its advertising systems.
A weather or prayer times app, for example, may expose a user’s location to advertising partners if its software passes those details into an ad auction. The extent of disclosure depends on the app’s implementation and applicable platform restrictions.
App context
Networks may learn which app displayed an advertisement, its category, when it was used and how long a session lasted.
Some SDKs, particularly those integrated into software supplied by phone manufacturers, may also access information about installed apps. Such information is valuable for audience targeting, although Google Play restricts broad access for ordinary apps.
Advertising interactions
Networks track impressions, clicks, video viewing and app installations. Depending on the advertiser’s configuration, they may also receive information about subsequent registrations, purchases, revenue and continued app use.
Advertisers commonly share these events through attribution platforms such as AppsFlyer, Adjust and Branch, which help determine which campaigns generated installations or other activity.
Why combining the data matters
An advertising ID is pseudonymous, while a device model identifies a type of phone rather than its owner. The privacy risk increases when separate pieces of information are linked.
Identity resolution services can connect devices, accounts and other records. Location patterns may reveal where someone lives or works, while activity after an installation may connect a device with an account. Device fingerprinting may also make tracking possible after an advertising ID has been reset.
These capabilities do not establish that every network reviewed misuses personal information. They do, however, make corporate transparency important: users and advertisers need to know who receives data, how long it is retained and whether it is shared further.
The networks marketed in Pakistan
The review, based on publicly available information gathered in October 2026, assessed the networks’ corporate credibility and track records.
Rating | What it means | Number of networks |
|---|---|---|
A: Tier 1 | Publicly listed company or major global player with a substantial track record | 6 |
B: Established | Verifiable company with identifiable clients and offices; typically regional or medium sized | 10 |
C: Small or insufficiently verified | Limited public information, a recently established business, or an affiliate network reselling others’ traffic | 21 |
D: Caution | Reports raising concerns about nonpayment, fraud or scam links | 1 |
Unidentified | No advertising network could be confidently matched to the supplied name | 11 |
Total | 49 |
Sixteen networks met the review’s criteria for established companies or major players. The other 33 did not receive those ratings, although this does not mean that all 33 are illegitimate or fraudulent.
The highest rated group included Kidoz and its division Prado, which serves audiences aged over 13; India’s Affle; China’s Mobvista and YeahMobi; and Foodpanda’s retail advertising service.
The review identified businesses associated with India, China, Israel, the UAE, Singapore, Cyprus and Lithuania, alongside groups with links to Russia.
It also noted that some smaller performance advertising businesses register in Dubai, Singapore, Cyprus or the United States while operating teams elsewhere, including India and China.
Six Pakistan based reseller agencies were named: Jack of Digital, Revolt, Adtechventure, Adventures, Dial Zero and Happy Ads. Yango Ads announced Jack of Digital as its Pakistan reseller in January 2026.
Concerns identified in the review
At the less transparent end of the market, the research identified several recurring issues.
Some networks had basic websites without a clearly identified legal entity, business address or named clients. Others displayed apparently unfinished statistics, including “0K+” users.
Several businesses listed US registered agent addresses rather than operational offices, while their teams worked elsewhere. Such an address does not itself establish misconduct, but it provides limited information about where a company actually operates.
The review also found inconsistencies in claims about experience. One Singapore company incorporated in 2024 advertised more than ten years in the industry, while another listed as founded in 2025 made a similar claim.
Some networks openly promoted cryptocurrency, casino or dating campaigns. The research treated these sectors as factors requiring additional scrutiny rather than evidence of wrongdoing.
Eleven names could not be confidently matched to an identifiable advertising network. Two possible namesakes resembled entities associated in public reporting with cryptocurrency scam lead funnels and a multilevel marketing scheme. The review could not establish that they were the same businesses.
The sole network placed in the Caution category was Agami, an older US performance network. The review cited nonpayment complaints on affiliate review websites, including one dated November 2025.
Larger companies have also faced scrutiny. In 2020, security firm Snyk alleged that an iOS advertising SDK supplied by Mintegral, owned by Mobvista, engaged in click fraud and leaked data. Mintegral disputed the allegations.
What the ratings establish
The assessment measures corporate credibility and visibility, rather than compliance with data protection requirements.
A recognised company may still handle information poorly, while a smaller business may maintain strong safeguards. The ratings also do not establish the quality of advertising traffic, which requires campaign evidence and fraud reports from attribution platforms.
Several names were generic, meaning some company matches were inferred. The research therefore assigned confidence levels to the identifications.
What users can do
Users can reduce unnecessary exposure by reviewing their phone’s privacy settings and app permissions.
Deleting or resetting an advertising ID, where available, can limit one means of recognition. On an iPhone, users can select “Ask App Not to Track” when prompted.
Location access should be limited to what an app needs. Weather and prayer times services may function with approximate location or a manually selected city, depending on the app.
Removing unused apps, reviewing permissions regularly and avoiding installations from outside official stores can further reduce exposure. These measures limit risk but do not prevent every form of tracking.
What advertisers and publishers should ask
Before placing a campaign, advertisers should ask resellers to identify the network’s legal entity, official website and data handling terms.
They should review what their attribution platforms transmit, avoid unnecessary sharing of email addresses, phone numbers or user IDs, and use less detailed event values where possible.
Contracts should address data retention, onward sharing or sale, and the subprocessors permitted to handle information.
For networks that cannot be fully verified, small test budgets and close monitoring can help advertisers assess performance before committing larger sums.
