On 12 August, researcher Zach Edwards launched DecryptAds, a free platform holding roughly 284 million ad supply-chain records. It exists to answer a question that has been structurally unanswerable for consumers: when an app or website shows you an ad, which specific companies receive data about you, and which of those companies sell that data onward to brokers who sell it to governments.
The clever part is that the raw material is not leaked. It is published, by the ad industry, on purpose.
ads.txt and sellers.json
The industry created two public files to fight ad fraud.
ads.txt (and its app equivalent, app-ads.txt) sits at the root of a publisher’s domain and lists every ad exchange authorised to sell that publisher’s inventory. It exists so buyers can tell whether someone claiming to sell ads on a given site is actually allowed to.
sellers.json sits on the exchange’s domain and lists the sellers and intermediaries the exchange works with.
Together those two files describe the topology of the programmatic advertising network. Every publisher declares who it sells through; every exchange declares who it buys from. Nobody had systematically crawled all of them and joined the graph.
DecryptAds crawls all of them and joins the graph. From that you get: for a given app, the list of exchanges entitled to auction your attention; for a given exchange, the list of downstream partners; and — the part that matters — the presence of known location-data brokers and companies domiciled in higher-risk jurisdictions sitting in the supply chains of ordinary consumer apps.
Why this connects to ICE and CBP
The mechanism is real-time bidding. When an ad slot loads, a bid request is broadcast to potentially hundreds of bidders. That request is not a request for a picture. It contains, depending on configuration, your mobile advertising ID, IP address, device model, OS version, app identity, and frequently precise or coarse geolocation.
Every recipient of a bid request receives that data whether or not it bids. Losing an auction costs nothing and yields the data anyway. This is the original sin of RTB: the bid stream is a broadcast, and a broadcast to hundreds of parties is a publication.
Several companies have built businesses on participating in auctions in order to harvest the bid stream, then packaging the resulting location traces and selling them. Purchasers have included CBP, which tapped the advertising ecosystem to track movements, and ICE, alongside a steady procession of other agencies. None of it requires a warrant, because the government’s position is that it bought a commercial product rather than compelled a disclosure — the same theory underpinning ICE’s data-broker contracts and the FBI’s location purchases.
The consumer-facing consequence: a weather app, a coupon app, or a game with a poorly configured advertising SDK can be a warrantless government location feed, and until now there was no way for an outsider to see it.
What changes
Three things.
Evidence replaces inference. Privacy advocacy about RTB has been forced to argue from mechanism — this is how the protocol works, therefore this must be happening. Industry has answered with contractual assurances. Now there is a queryable record of who declared a relationship with whom, published by the parties themselves. Contradictions between a company’s privacy policy and its own sellers.json are now trivially discoverable.
Developers can audit their own stack. Most app developers genuinely do not know their full downstream partner list. They integrated a monetisation SDK, accepted defaults, and inherited a hundred-partner supply chain. An EFF investigation this month identified ad SDKs that collect and share location by default unless the developer changes a setting. A developer can now look up their own app and see what they signed up for.
Regulators get a target list. DPAs have been circling RTB since 2018 with limited traction, partly because the scale of the discovery problem is enormous. A public graph is a starting point for enforcement, and for the class action bar.
The limits, stated honestly
DecryptAds maps declared relationships, not observed data flows. A sellers.json entry proves a commercial relationship existed; it does not prove your particular location left a particular app on a particular day. Companies can and do underdeclare. The dataset is a map of the plumbing, not a wiretap.
It also cannot tell you which broker sold to which agency. That link still requires procurement records, FOIA, and journalism.
What it does is collapse the cost of the first ninety per cent of an investigation from months to minutes. That is not the whole answer. It is the thing that has been missing.
What it means in practice
The industry’s own compliance apparatus became its transparency apparatus. ads.txt was built to protect ad buyers from fraud. It turns out to also document who is standing in the room when your device announces where it is.
“We don’t sell your data” is now checkable. Many companies making that claim are not, technically, selling it. They are broadcasting it to bidders and letting someone else do the selling. The distinction has survived this long because nobody could see the room.
Location purchasing is a procurement problem, not just a privacy one. The reason agencies buy rather than subpoena is that buying has no judge in it. That is a legislative fix, and the bills to do it keep dying.
What you can do
-
Reset and then disable your advertising ID. On Android: Settings → Privacy → Ads → Delete advertising ID. On iOS: Settings → Privacy & Security → Tracking, and turn off “Allow Apps to Request to Track.” This is the single highest-leverage setting on your phone.
-
Audit location permissions app by app. Anything that does not need your location while running should be set to “Never.” Anything that does should be “While Using,” never “Always,” and where offered, approximate rather than precise.
-
Look up the apps you use most. DecryptAds is free. A weather app with sixty declared partners is telling you something about itself.
-
If you build apps, read your SDK’s location defaults today. Not the docs — the actual config. The default is frequently “share.”
-
Prefer paid apps over ad-supported ones for anything sensitive. Health, fertility, dating, religion, immigration status. The ad-supported version is not free; the price is the bid stream.
