DecryptAds and adtech tracking graphs
DecryptAds scrapes and correlates public disclosure files across websites and apps, then joins them into one graph of authorised ad partners and related entities. That means ads.txt, app-ads.txt, buyers.json and sellers.json stop acting like separate admin files and start behaving like a map of who can sell inventory, who can buy it, and who sits in the middle.
The point is not that every named partner is suspicious. The useful bit is the structure. A publisher can list one partner in ads.txt, an app can list another in app-ads.txt, and seller records elsewhere can reveal whether those names line up or clash. Once those records are matched up, the shape of the adtech tracking data becomes easier to read.
That is where tracker attribution gets useful. A single file tells you who is authorised. The graph tells you how those permissions connect across domains, apps and exchanges, which is where the oddities show up.
How the disclosure files join up into one tracking graph
The practical trick is simple enough. DecryptAds continuously scrapes public disclosure files, then correlates them against one another so the same entity can be followed across domains, app listings and exchange records. A partner that looks local in one place can turn up under a different name, through a reseller, or in a chain that only makes sense once the files are read together.
That matters because some of the strongest signals are hidden in the joins. A publisher may appear as both a publisher and a reseller across much of its portfolio. Another site may share declaration patterns with unrelated domains. A broken cross-reference between ads.txt, app-ads.txt and sellers.json can point to a supply path that nobody bothered to keep tidy. Boring paperwork, messy consequences.
The service also exposes scale in a way a single file does not. One example listed 143 ad partners and 19 registered data broker domains, with almost half of those brokers collecting geolocation data. Another three disclosed collection of device fingerprints and sensitive personal information. That is not the sort of detail you get from a quick glance at an authorised-seller list.
For mobile app trackers, the pivot matters even more. App-ads.txt can be used to move from an app to the partner domains behind it, which makes third-party advertising platforms easier to map across a wider set of properties.
Where the graph exposes broker links and supply-chain gaps
This is where the data broker relationships become visible. DecryptAds can surface cases where registered data brokers sit inside otherwise ordinary ad supply chains, including links into geo-risk regions and ownership structures that are awkward to spot from one file alone. It also highlights when a publisher and a reseller are the same entity, which is a neat little arrangement until someone asks who is checking whom.
The geo-risk angle is blunt. In one set of Opera.com records, the graph showed 27 registered data brokers collecting information and 15 adtech partners in the United Arab Emirates, six in China, three in Cyprus, two in Russia and one each in Hong Kong and Ukraine. Those companies represented just seven percent of the adtech partners named in the site’s ads.txt and app-ads.txt files. The rest of the chain sits in plain sight only if you join the records up.
There are also supply-chain integrity gaps that do not show up in isolation. A seller removal may only make sense when viewed across exchanges. Cloned declaration sets can repeat across unrelated domains. Bid-log supply paths may never appear in a publisher’s authorised-seller list at all. Supply-chain integrity issues rarely live in a single file, and that is the whole point of the graph.
Reading the signals without overcalling the risk
A long list of partners is not proof of abuse. It is evidence of reach, dependency and disclosure quality. Some publishers run broad ad stacks because that is how the money moves. Some reseller chains are just messy. A graph only tells you where to look, not what a court would make of it.
The useful habit is to treat mismatches as prompts, not verdicts. Broken cross-references, duplicate declaration sets and odd reseller overlaps deserve a closer look. So do country signals, registration records and cases where one entity appears in several roles at once. Those are the places where privacy analysis stops being abstract and starts turning up concrete relationships.
For anyone checking adtech tracking data, the boundary is simple enough. One file tells you very little. Several files joined together can tell you a great deal, but only if the joins are read with some restraint. Otherwise every ordinary reseller chain starts looking like a conspiracy, and that is just lazy.
