When your right to watch becomes their trade secret: the AppLovin–Unity dispute

The shape of the dispute

AppLovin, which runs an ad network and sells tools for mobile app developers, has accused Unity of using data from AppLovin's software development kit (SDK) to gain an unfair advantage ^[1]. Unity operates a rival ad platform and also provides developer tools. According to the reporting, AppLovin alleges that Unity is observing ad transactions that involve AppLovin's SDK and using that information to improve its own bidding and targeting.

Unity's position, as reported, is that it has the right to observe ad auctions on devices where its own SDK is present ^[1]. From Unity's perspective, it is watching what happens on its own patch, not stealing someone else's data.

The question is where observing stops and copying starts, and what either side can actually show about the data flows inside their systems.

Why this matters beyond two companies

Programmatic advertising runs on a principle that sounds simple: when an ad slot becomes available, systems bid for it in milliseconds, and the highest bidder wins. In practice, dozens of entities touch each transaction, and all of them see parts of the data: the device ID, the context, the bid prices, sometimes information about the user's behaviour.

That observability is baked into the model. An SDK on a device can see what ads load. A bidder in an auction can see rival bids. A supply-side platform can see which demand-side platforms are active. Everyone watches, because watching is how the system works.

The problem is that watching generates data, and data has value. If you can observe enough auctions, you learn what your rivals bid, which inventory they favour and how they price different audiences. At some point—and nobody agrees exactly where—learning from observation becomes using someone else's trade secrets to compete against them.

It is a bit like a card game where everyone sits at the same table and can see the cards being played, but one player claims another is keeping notes in a way the rules don't allow. The hard part is proving who wrote down what, and when.

The evidence question

Disputes like this one turn on records. AppLovin would need to show that Unity had access to its SDK data and used it in a way that went beyond ordinary observation. Unity would need to show what its systems actually did with the data they observed: what was logged, what was processed, what was retained and what was discarded.

In ad tech, those records are kept by the parties themselves. An SDK logs what it sees. A bidding system logs what it does. The servers that run the auctions log the bids. If a dispute reaches court, each side produces its own logs, and the court decides which version to believe.

The trouble is that logs kept by the people who could benefit from changing them are easy to challenge. If Unity says its system didn't retain certain data, AppLovin's response is likely to be: prove it. If AppLovin says Unity had access to something, Unity's response is: show us your logs. Neither side has a record the other has to accept, because each side controls its own evidence.

That is the gap a neutral witness fills.

How a digital witness would work here

The thing to seal is each data observation and processing event as it happens: which SDK saw what, when a bid was logged, when data was anonymised or discarded, which model version processed an auction. The fingerprint goes to WitniumChain at the moment the event is recorded, not days later when someone asks a question.

Anyone the record is shared with—auditors, the other party in a dispute, a court—can check that it is the one written at the time, unchanged since. The content itself never leaves the company's systems; only the fingerprint is sealed.

What it shows is that the record existed at that time and hasn't been edited. What it doesn't show is that the record is complete, that the data handling was lawful, or that no other data existed. A sealed log of discarded data doesn't prove that all the data was discarded, only that the log of discarded data is what it was on the day.

In a dispute where both sides are claiming the other's logs can't be trusted, a record neither party could have quietly rewritten is the starting point for agreeing on what actually happened. It turns the question from "whose word do we believe?" into "what does the checkable record say?".

You would seal SDK observation logs as data arrives, bidding records as bids are placed, and anonymisation or deletion events as they occur. The fingerprint goes out in real time, so nobody can go back and tidy up the story once the dispute starts. To check it, you calculate the fingerprint again from the record and compare it with the sealed one. If it matches, nothing has changed. Change one character in the log and it won't match.

The first 2,000 witnesses a month are free, and you can start with the REST API, the SDK or the MCP server.

How it would work

1. Seal each SDK observation and processing event as it is written to the log: data type, timestamp, SDK version, action taken.
2. Seal bid records when bids are placed, and anonymisation or deletion logs when data is discarded.
3. When a question arises, calculate the fingerprint again from the record and check it against the sealed version anyone can verify.

What this means for you

If you run an ad platform, a bidding system or any infrastructure where rivals can observe what you do, ask:

• Could we show, if questioned, which data our systems saw, processed and retained on a given day?
• Do we have our own records of data handling events, sealed at the time they happened, that we could share with an auditor or a court without relying on the other side to believe us?
• When we say data was anonymised or discarded, what evidence backs that up?

If you license an SDK or supply data to partners, consider:

• Could we demonstrate, if a partner were accused of misusing our data, what our SDK actually sent and when?
• Do we have a record of data flows that neither we nor our partners can quietly rewrite after the fact?

The AppLovin–Unity dispute may settle, or it may go to court and set a precedent. Either way, the question it raises—how do you prove what your ad tech did with the data it observed?—is one the industry will keep facing.

What to watch

The immediate thing to watch is how the AppLovin–Unity case develops and whether it produces any public record of what evidence each side presented. Ad tech disputes tend to settle quietly, but if this one reaches a ruling, the court's view on what counts as admissible evidence of data flows will matter beyond these two companies.

Longer term, watch for regulatory pressure on ad tech observability. The GDPR already requires demonstrable compliance with data minimisation and purpose limitation, and supervisory authorities have been asking tougher questions about what ad tech players log and retain ^[2]. If disputes like this one become common, expect regulators to start asking for better records of who saw what, and when.