BT
Privacy ToolboxJournalProjectsResumeBookmarks
Feed
Privacy Toolbox
Journal
Projects
Resume
Bookmarks
Intel
Threat Actors
Privacy Threats
Dashboard
CVEs
Tags
Intel
Threat ActorsPrivacy ThreatsDashboardCVEsTags

Intel

  • Feed
  • Threat Actors
  • Privacy Threats
  • Dashboard
  • Privacy Toolbox
  • CVEs

Personal

  • Journal
  • Projects

Resources

  • Subscribe
  • Bookmarks
  • Developers
  • Tags
Cybersecurity News & Analysis
github
defconxt
โ€ข
ยฉ 2026
โ€ข
blacktemple.net
  1. Privacy Threats
  2. /InMobi
๐Ÿ‡ฎ๐Ÿ‡ณ

InMobi

Also known as: InMobi Technology ยท InMobi Pte

adtech70/100
HQ Country
๐Ÿ‡ฎ๐Ÿ‡ณ India
Category
adtech
Threat Score
70/100
Incidents
6
Known Clients
UnileverSamsungMicrosoftCoca-ColaPepsiNestleHSBCVodafoneAirtelFlipkart
Deployment Countries
๐Ÿ‡ฎ๐Ÿ‡ณ IN๐Ÿ‡บ๐Ÿ‡ธ US๐Ÿ‡ฌ๐Ÿ‡ง GB๐Ÿ‡ฉ๐Ÿ‡ช DE๐Ÿ‡ฎ๐Ÿ‡ฉ ID๐Ÿ‡ต๐Ÿ‡ญ PH๐Ÿ‡ฒ๐Ÿ‡พ MY๐Ÿ‡ธ๐Ÿ‡ฌ SG๐Ÿ‡ฆ๐Ÿ‡บ AU๐Ÿ‡ง๐Ÿ‡ท BR๐Ÿ‡ฟ๐Ÿ‡ฆ ZA๐Ÿ‡ณ๐Ÿ‡ฌ NG๐Ÿ‡ฐ๐Ÿ‡ช KE๐Ÿ‡ฏ๐Ÿ‡ต JP๐Ÿ‡ฐ๐Ÿ‡ท KR
References
FTC InMobi Settlement for COPPA and Geolocation Violations (2016)InMobi Glance Lock Screen PlatformInMobi Advertising Platform Overview

Threat Score Factor Analysis

70/ 100

Overall Threat Score

Overview

InMobi is an Indian mobile advertising technology company founded in 2007 by Naveen Tewari, Abhay Singhal, Amit Gupta, and Mohit Saxena in Bangalore, India. The company is one of the largest independent mobile advertising platforms globally, with particular strength in emerging markets across Asia, Africa, and South America where it competes with Google and Meta on more equal footing than in developed markets.

InMobi operates a mobile advertising network reaching over 1.5 billion monthly active users across more than 40,000 apps worldwide. The company serves advertisers seeking to reach mobile audiences in markets where English-language mobile advertising platforms have limited presence, making InMobi the dominant mobile advertising platform across significant portions of South and Southeast Asia, sub-Saharan Africa, and Latin America.

Beyond standard mobile advertising, InMobi has expanded into Glance, a lock screen content platform deployed on Android smartphones, predominantly lower-cost Android devices sold in India and other emerging markets. Glance delivers news, entertainment, and promotional content directly to the device lock screen, effectively monetizing smartphone idle time and providing content recommendations even before users unlock their devices. This lock screen position gives InMobi data collection access that precedes any app engagement, capturing device usage patterns at their most fundamental level.

InMobi's global reach, particularly in markets with limited regulatory infrastructure, has made it a significant player in mobile behavioral data collection outside the scrutiny typically applied to U.S. and EU-based adtech companies. The company has faced regulatory action in the United States for its tracking practices, including a significant FTC settlement in 2016.

Data Collection Practices

InMobi collects mobile behavioral data through its advertising SDK, Glance lock screen platform, and publisher relationships across its global network:

Mobile advertising SDK tracking collects from integrated apps:

  • Device advertising identifiers (IDFA, GAID, and Android IDs)
  • App usage patterns, session duration, and engagement metrics
  • In-app behavioral events and purchase signals
  • IP-based geolocation (and GPS location where apps request location permissions)
  • Device hardware fingerprinting signals

Glance lock screen platform represents InMobi's most distinctive and privacy-significant data collection surface. Glance is pre-installed on Android devices from manufacturers including Xiaomi, Samsung (in select markets), and others, meaning it is present on devices from the first use without explicit installation consent from users. Glance collects:

  • Lock screen interaction patterns (swipe behavior, content engagement without unlocking)
  • Time and frequency of phone pickup events
  • Content category preferences revealed through lock screen engagement
  • Notification pattern signals
  • Geographic location to serve locally relevant content

This data is collected before users actively engage with any app, representing an unusually early and persistent data collection opportunity.

Location data collection has been particularly controversial for InMobi. The company's FTC settlement arose specifically from tracking the precise geolocation of users, including children, without their consent, using WiFi network signals to infer location even when users had denied apps location access.

Cross-app identity through InMobi's identity resolution enables behavioral profiles to span users' complete app usage history across the InMobi publisher network, connecting gaming, social, utility, and shopping app behavior into unified user identities.

Emerging market behavioral data that InMobi collects from users in India, Indonesia, Nigeria, and similar markets represents behavioral intelligence about populations that are underserved by other behavioral data companies but are of increasing commercial and strategic interest to global advertisers.

Known Clients & Government Contracts

InMobi's client base spans global brands seeking mobile reach in emerging markets and regional companies advertising in South and Southeast Asia:

Global consumer brands including Unilever, Nestle, Coca-Cola, Samsung, and Microsoft use InMobi to reach mobile audiences in India, Indonesia, and other Asian and African markets where InMobi's network reach exceeds competing platforms.

Financial services and telecom clients including HSBC, Vodafone, and major regional carriers like Airtel use InMobi for mobile advertising in markets where digital advertising infrastructure is still developing.

Regional e-commerce and digital services companies including Flipkart (India's largest e-commerce platform) have used InMobi as a primary mobile advertising channel for reaching India's mobile-first consumer market.

Device manufacturers with Glance pre-installation agreements, including Xiaomi (India's leading smartphone brand), represent commercial partners rather than clients, but these relationships give InMobi privileged data access from first device use.

InMobi has no documented government surveillance contracts. However, the company's data assets covering large populations in India and other countries are potentially significant from a national security intelligence perspective.

Privacy Incidents & Litigation

FTC Settlement for Geolocation and COPPA Violations (2016): InMobi reached a $950,000 settlement with the Federal Trade Commission, including a $300,000 civil penalty (suspended due to financial hardship, with $950,000 payable if InMobi misrepresents financial status), for secretly tracking the geolocation of hundreds of millions of mobile users, including minors, without their consent.

The FTC found that InMobi:

  • Tracked precise location of users regardless of their privacy settings or whether they had denied location access to apps
  • Collected geolocation data from apps whose privacy policies stated they did not collect location data
  • Tracked location of children's devices through apps directed to children
  • Used WiFi networks to infer location even when GPS location access was denied

The settlement required InMobi to implement a comprehensive privacy program, obtain user consent for location tracking, and refrain from collecting data from child-directed apps without parental consent.

Children's Privacy Ongoing Concerns: Despite the FTC settlement's requirements, privacy researchers have continued to document concerns about InMobi's data practices in apps with significant child audiences, particularly through its advertising SDK deployed in entertainment and gaming apps popular with children in India and other markets.

India Data Protection Scrutiny: As India's Personal Data Protection framework has developed, InMobi's practices, particularly through Glance, which collects data from lock screens without active user engagement, have attracted attention from Indian digital rights advocates.

European Privacy Concerns: InMobi's advertising network reaches European users through publisher apps, triggering GDPR consent requirements. European data protection authorities have noted that mobile advertising networks from non-EU companies frequently fail to implement adequate consent mechanisms for EU users.

Threat Score Analysis

InMobi receives a composite threat score of 70/100, reflecting the combination of its FTC-documented consent violations, Glance's privileged lock screen data access, and its dominant position in markets with limited regulatory oversight:

  • Data Collection (80/100): InMobi's SDK reaches 1.5 billion monthly active users across global mobile apps. Glance's lock screen position enables data collection before any app engagement. The FTC enforcement documented that InMobi tracked location using techniques that bypassed user consent controls. Emerging market coverage provides behavioral data on populations poorly served by other platforms.

  • Third-Party Sharing (78/100): InMobi's advertising network involves sharing user audience data with advertisers for targeting and attribution. The company participates in mobile RTB auctions and operates a data marketplace for audience segment distribution.

  • Breach History (55/100): The FTC settlement is the primary documented compliance failure. InMobi's geolocation tracking of users who had denied location access and of children represents a significant documented failure to honor stated privacy controls.

  • Government Contracts (25/100): No documented government surveillance contracts. InMobi's data assets covering large populations in India and other countries are of potential interest to national security intelligence operations.

  • Transparency (38/100): InMobi's transparency has historically been poor, as documented by the FTC finding that its tracking practices contradicted publishers' stated privacy policies. Glance's pre-installation on devices without explicit user consent for data collection represents a transparency gap that post-FTC improvements did not fully address.

Weighted calculation: (80 * 0.25) + (78 * 0.25) + (55 * 0.20) + (25 * 0.15) + (38 * 0.15) = 20.0 + 19.5 + 11.0 + 3.75 + 5.7 = 59.95, adjusted to 70 due to the FTC-documented pattern of tracking users despite consent controls and the unique data access position of Glance on hundreds of millions of lock screens.

Transparency & Accountability

InMobi's transparency record was significantly damaged by the 2016 FTC settlement, which documented systematic tracking practices that contradicted both user expectations and publisher privacy policy representations:

Following the FTC settlement, InMobi implemented a comprehensive privacy compliance program as required by the consent order. This included establishing a formal privacy program with a designated privacy official, conducting regular privacy audits, prohibiting collection of data from child-directed apps without parental consent, and implementing consent mechanisms for location tracking.

For Glance, InMobi has published documentation about data collection practices and implemented settings within the Glance app that allow users to manage content preferences. However, the pre-installation of Glance on devices by manufacturers, without requiring explicit user consent during setup, remains a transparency gap. Users who receive devices with Glance pre-installed may not recognize it as a data collection tool or know how to manage or remove it.

InMobi participates in regional advertising self-regulatory bodies in India and Asia-Pacific, including the Digital Advertising Alliance of India. However, the effectiveness of self-regulation in markets with limited data protection enforcement infrastructure is substantially less than in the EU or the United States.

The company's expansion in markets with nascent privacy regulatory frameworks, India (developing its PDPB), Indonesia, Nigeria, reflects a pattern of operating where regulatory scrutiny is lower and user awareness of data rights is more limited. This geographic strategy has been effective from a business perspective but raises questions about whether the company's privacy practices are genuinely improving or merely optimized for regulatory minimum compliance.

All Companies