ObservedSeverity: HighConfidence: High
Advertising identifier sent to two advertising recipients
With consent accepted, requests to Adreach Exchange and Lanternfly Ads included the device’s advertising identifier.
Pebble Drop Saga
Mobile app · Pebblestone Games · com.example.pebbledrop
- App identifier
- com.example.pebbledrop
- Publisher
- Pebblestone Games
- Platform
- Android
- Versions
- App 3.8.1 · Android 14
- Scan date and region
- Oct 19, 2026 · EU (Ireland lab)
- Consent state
- Accepted and rejected tested; withdrawal not tested
- Scan method
- Lab device — authorized runtime traffic capture
- Coverage
- Substantial · methodology 0.9
Privacy exposure
72 / 100
High measured exposure
Summary of the tested session
During the tested session, this app contacted 8 recipient companies. Requests to two advertising recipients included an advertising identifier. Behavior after consent withdrawal was not tested.
Evidence coverage: Substantial
Meets the minimum for rating. Some scenarios or contents were not assessable. Readable request contents: 88%.
Principal findings
ObservedSeverity: HighConfidence: High
Coordinates rounded to about 1 km sent in an ad bid request
Bid requests to Lanternfly Ads included latitude and longitude rounded to two decimals, alongside the advertising ID.
ObservedSeverity: ModerateConfidence: High
Requests to an advertising recipient continued after consent rejection
After rejection, the app still contacted Adreach Exchange with contextual ad requests (app name, level number) and no advertising ID.
What information was involved
A permission alone is not treated as evidence of collection or transmission.
| Category | Status | Detail |
|---|---|---|
| Advertising and device identifiers | Observed in a transmission | Advertising ID to 2 advertising recipients; installation ID to an identity service. |
| Network information | Observed in a transmission | IP address visible to every contacted server. |
| Approximate or precise location | Observed in a transmission | Coordinates rounded to ~1 km in one bid request. |
| Browsing and interaction events | Observed in a transmission | Screen and tap events to analytics. |
| App usage and viewing events | Observed in a transmission | Level progress and session length. |
| Account or contact information | Declared by the publisher | Store listing declares optional email for cloud saves. Not tested. |
| Sensitive contextual information | No transmission observed in the tested session | No sensitive context observed in readable requests. |
Behavior under tested privacy choices
| Scenario | Status | Recipients contacted | Companies |
|---|---|---|---|
| Consent accepted | Tested | 8 | Adreach Exchange, Lanternfly Ads, Keystone Identity Graph, Tallymark Analytics, Sentinel Verify, Orbital Cloud, Unresolved recipient, Nimbus Edge |
| Consent rejected | Tested | 5 | Adreach Exchange, Tallymark Analytics, Sentinel Verify, Orbital Cloud, Nimbus Edge |
| Consent withdrawn | Not tested | Unknown | Not established |
Why this rating
Illustrative · methodology 0.9
Sensitivity of observed information13/20
Persistence and linkability of identifiers17/20
Recipient roles and dissemination evidence15/20
Behavior under tested privacy choices14/20
Disclosure–observation discrepancies13/20
Five dimensions, 0 to 20 each, sum to the score. Coverage gaps never lower a score.
What remains unknown
- Behavior after consent withdrawal was not tested.
- Contents of requests to 2 recipients (12% of requests) could not be read.
- iOS version not tested; findings apply to Android 3.8.1 only.
- In-app purchases and account sign-in were not exercised.
What you can do
Delete or disable your Android advertising ID
Apps receive a zeroed ID instead of a stable one.
Limit location permission for this app
The app can’t read device location. Server-side IP-based location may still occur.
Not a legal compliance certification or a safety guarantee. Child-audience assessment: Uncertain (separate from this rating). 8 recipient companies observed in this scan.