An ad is not a data-flow diagram: advertising, analytics and tracking explained

The same care applies to an app without visible advertising. The absence of an ad does not explain whether or how the app measures use of its service. Rather than trying to infer the entire arrangement from one screen, distinguish three activities: presenting an advertisement, analysing use of a service, and connecting information across services for particular purposes.

This distinction matters when deciding whether an optional feature fits your expectations. Our guide to privacy in Islamic apps covers the wider assessment. Here, the goal is narrower: understanding what evidence would support a claim about advertising, analytics or tracking.

Advertising: how was this message selected?

An advertisement can be selected using different information. Google’s AdMob guidance distinguishes personalised advertising, which uses previously collected information, from non-personalised advertising based on current context, such as the content being viewed or a coarse location. These are descriptions of Google’s advertising arrangements, not proof of how any unexamined app operates. Google: personalised and non-personalised ads

Imagine a hypothetical app showing an advertisement for books beside an article about reading. That match could be explained by the page’s subject. You would need more evidence before saying the advertiser had identified the reader’s interests from other apps. A relevant advertisement is not, by itself, evidence of a particular profiling method.

The reverse mistake is to treat “non-personalised” as “no information is processed.” Google says its non-personalised ads can still use cookies or mobile advertising identifiers for frequency limits and aggregated reporting, even though those mechanisms are not used for ad targeting. Ask what the option changes and what remains. Google’s non-personalised-ad explanation

For a practical comparison, ask: is the advertisement selected from the present screen, from information associated with my account, or from information about activity elsewhere? Then ask a separate question: what information is recorded when the advertisement loads or I interact with it? How an ad is selected and what is measured afterwards need not involve the same information.

Analytics: what is being measured, and at what level?

That measurement question leads to analytics: a term describing a purpose rather than a single technical design. Apple’s disclosure framework uses the term for evaluating behaviour, understanding features and measuring audiences. The term alone does not establish whether the information is account-linked, how much detail is retained or who receives it. Those questions require the app’s own explanation. Apple’s app-privacy purpose definitions

Consider three hypothetical reports about a reading feature:

• A total showing how many times the audio button was pressed during a week.
• A sequence of button presses associated with a persistent installation identifier.
• A reading history attached to a named account so that progress can be displayed on another device.

The kinds of records in these imagined designs raise different questions about how the information is handled. The first report’s appearance does not tell you how its underlying total was produced. The second invites questions about the identifier’s lifetime and whether it is combined with other records. The third invites questions about account access, synchronisation and retention. The word “analytics” alone answers none of them.

Do not confuse a summary report with the complete collection process. If a developer says it sees only aggregate statistics, ask whether that describes what was originally gathered, what an external processor receives, or only what appears in the developer’s dashboard. This is a request for precision, not an allegation that aggregation is ineffective.

Tracking: specify the definition before making the claim

Apple’s App Tracking Transparency framework concerns linking identifying information from an app with information from other companies’ properties for targeted advertising or advertising measurement, or sharing such information with data brokers. That is a defined platform category, not a synonym for every saved preference or every network request. Apple’s tracking explanation

A hypothetical bookmark synchronised within one service is therefore not enough evidence to establish cross-company advertising tracking. Conversely, an innocent-sounding feature name is not enough to rule it out. What matters is the information flow and its use, not whether the menu calls the feature “insights,” “personalisation” or “improvement.”

For each suspected flow, describe four things: the information involved, the recipient, the connection to other information, and the purpose. “Reading event sent to a processor for a usage report” and “reading event linked with another company’s audience profile for advertising” are materially different descriptions. If you cannot establish those elements, keep the conclusion open.

Third-party software can serve more than one purpose

The services involved may rely on a software development kit, or SDK, which a developer incorporates into an app. Its presence should prompt a check of the relevant product documentation and configuration, not an automatic conclusion about every possible use.

For a concrete, limited example, Google’s disclosure page for its Android Mobile Ads SDK (Legacy), version 25.5.0 when checked, lists categories including IP addresses, interactions, diagnostics and identifiers. It associates collection with advertising, analytics and fraud prevention, and identifies configuration-dependent behaviour. That documentation describes a particular SDK version; it does not establish that an Islamic app uses it, or which settings any app enables. Google’s SDK data disclosure

Once you know an app contains an SDK, identify the service involved, what it receives for the feature you use and whether that information can be used for other purposes. A provider’s technical documentation can clarify capabilities, while the app’s own disclosure should explain the implemented arrangement. Neither should be substituted for the other.

What changing a tracking setting can and cannot establish

On supported Apple devices, choosing “Ask App Not to Track” blocks access to the advertising identifier and prohibits the developer from substituting other identifying information to perform the defined tracking. Apple says the app’s full capabilities remain available regardless of that choice. The control does not claim to erase all records or prohibit every other kind of processing. Apple’s App Tracking Transparency guidance

Android also provides ad-privacy controls, with availability and menus depending on the device. Google’s current guidance describes controls for ad topics, app-suggested ads and ad measurement, and notes that advertising can also depend on advertising-ID settings and app policies. Do not treat one switch as an explanation of every advertising arrangement. Use the current instructions for the controls actually present on your device. Google’s Android ad-privacy guide

Whichever platform you use, record which control you changed and what its explanation promises. “I declined this tracking permission” is a defensible statement. “No company can receive any information from this app now” is a much broader claim that the setting does not establish.

Investigate observations without over-interpreting them

Settings describe controls; observed activity provides another kind of evidence. On iOS and iPadOS 15.2 or later, Apple’s App Privacy Report can show resource access and contacted domains after you enable it. Connections can come from the app itself or content displayed inside it, such as embedded media. A domain entry is a useful lead, not a readable account of every item transmitted or its subsequent purpose. Apple’s App Privacy Report guide

If something surprises you, note the feature you were using and ask what that connection supports. Avoid publishing an accusation based solely on an unfamiliar domain. Equally, do not dismiss a clear discrepancy between a documented practice and a developer’s explanation; preserve the relevant evidence and ask for clarification.

The UK ICO’s guidance also cautions against treating first-party versus third-party terminology as the decisive privacy distinction. Its discussion of storage and access technologies reinforces the need to examine actual purposes and handling. This is contextual regulator guidance, not legal advice about a particular app or jurisdiction. ICO: storage and access technologies

A sound decision does not require proving every technical detail yourself. Identify the practice that matters to you, seek an explanation proportionate to it and distinguish what is documented from what remains unknown. An ad, a premium price and a reassuring feature name are all poor substitutes for that explanation.