App Compliance Audit: AdMob Consent, COPPA, ATT, Privacy

An app can request AdMob consent and never offer the "change your choice" link that Google's European message tells users is in the app, or send child-directed ads while still shipping the Android advertising-id permission, and no build or test will tell you. These come back weeks later as an App Review rejection, a Play policy warning, or ads booked to the wrong app.

audit.py compares what the code does with what it declares, in Flutter, React Native and Expo apps (the project type is read from pubspec.yaml or package.json):

• ADS-CONSENT: an ads SDK, but consent is never requested or the form never loaded.
• ADS-REVOKE: nothing opens the privacy options form.
• ADS-REVOKE-GATE: the privacy options row is never gated on the requirement status, so it is a dead row outside the EEA, UK and Switzerland.
• ADS-APPID: no AdMob app id, or Google's sample id, which only serves test ads.
• ADS-SHARED: in workspace mode, two apps with the same AdMob app id (a fork's leftover).
• KIDS-ATT, KIDS-ADID, KIDS-RATING, KIDS-TRACKING: child-directed ads that still allow the tracking prompt, keep the AD_ID permission, have no maximum ad rating, or a privacy manifest that says the app tracks.
• ATT-MISSING, ATT-LAUNCH: a usage string with no request, or a tracking prompt asked at launch.
• PRIV-MANIFEST, PRIV-CRASH: no iOS privacy manifest, or a crash reporter whose Crash Data is not declared.

--label drafts App Store privacy label and Play data safety answers from the dependencies (ads, Firebase Analytics, Crashlytics, auth, Firestore, purchases, photo and location plugins), with the steps to check the draft against the code. --workspace runs every app in a folder, one line each.

The SKILL.md gives the fix for each check and the rules for children and families: child-directed ad settings, the Kids Category as a one-way door, and how Play's target audience brings in the Families rules.

This is a checklist that produces evidence. It is not legal advice.

What you need: Python 3.9+. No packages to install.

Sold on its own; also runs inside the store-preflight skill when both are installed.

I build small apps on my own and have a shelf of them on the App Store and Google Play. The first run of this script found consent and advertising-id faults in apps of mine that had already passed review.