Invisible but Identifiable: Breaking AppLovin's Cipher Reveals Persistent Device Tracking

A researcher successfully broke AppLovin's cipher protocol and decrypted thousands of real ad requests, proving that ad networks can re-identify users across apps through device fingerprinting—even when users deny Apple's App Tracking Transparency (ATT). The weak encryption, which uses a non-cryptographic PRNG without authentication, cannot prevent attackers from accessing device data embedded in every bid request. With billions of encrypted requests reaching ad networks daily, this vulnerability reveals that privacy controls offer significantly less protection than users assume, exposing a fundamental gap in mobile advertising's privacy architecture.