We keep this table for ourselves — our playables are built against it. Published as is: size, format, the CTA call and what actually gets creatives rejected. Use it even if you build elsewhere.
A star marks the three networks we build for by default: all three take one self-contained HTML, MRAID and a 5 MB ceiling, so a single build covers them all.
| Network | Size | Format | Wrapper and CTA call | What matters |
|---|---|---|---|---|
| Unity Ads★ | ≤ 5 MB | single HTML | MRAID 3.0, injected by the webviewmraid.open(url) |
Wait for viewableChange before starting, both orientations, no XHR, links to both stores required.
Submit the iOS link in the legacy form itunes.apple.com/…/id<ID>?mt=8 — the validator rejects apps.apple.com as invalid even though it simply redirects. |
| AppLovin★ | ≤ 5 MB | single HTML | MRAID 2.0mraid.open(url) |
External requests and analytics only with their approval. Autoplay is banned in so many words: the ad timer starts after the first interaction, so we do not build an autoplay fallback at all. |
| ironSource / LevelPlay★ | ≤ 5 MB | single HTML | MRAID; legacy playables sometimes use DAPI | Review runs through the dashboard and there is no public test tool — which makes the pre-submit checklist matter more. |
| Meta / Facebook | ≤ 2 MB single ≤ 5 MB zip | single HTML in base64 or a zip with index.html at the root | FbPlayableAd.onCTAClick() |
No HTTP requests whatsoever. Run it through their Playable Preview. |
| Google Ads | ≤ 5 MB | zip with HTML | Exit API: ExitApi.exit() |
Uploaded as an App campaigns interactive asset, checked in the HTML5 Validator. |
| Mintegral | ≤ 5 MB | single HTML or zip | MRAID, end-of-game signal window.gameEnd() |
Tested in Mindworks Playable Testing. |
| TikTok / Pangle | ≤ 5 MB | zip | window.openAppStore() |
A config.json at the root is mandatory: orientation and the language list. |
| Vungle / Liftoff | ≤ 5 MB | single HTML or zip | MRAID | The main file must be named ad.html; checked by their Creative Verifier. |
A network limit is a rejection threshold, not a target. The network wrapper, base64 and version drift all sit between your file and the check, so we aim below the ceiling: ≤ 4.5 MB for Unity, AppLovin and ironSource, ≤ 1.8 MB for Meta single-file.
Every build of ours is checked against it, and the same list reaches the client as a report. Points 1, 2, 3, 6, 11 and 12 run automatically — not by eye.
file:// with no internetready and viewableChange; closing the ad is never blockedconfig.json, correct file nameYour own checklist only catches what it was tuned for. So an independent gate runs on top: it takes the finished file apart again and drives it in a browser across three viewports — 390×844, 576×1024 and 844×390 — on the exact bytes that will reach the network. The PASS / FAIL / BLOCKED verdict goes into the report as is, together with the SHA-256 of every file.
<script src="mraid.js"> — an external dependency where everything must be inside the file; and a foreign package plus a test app identifier hidden inside a packed layer that plain text search never reaches.Six points on top of the main checklist. These are what get a gambling creative rejected when everything technical is fine.
Everything below comes from real rejections and findings on our own batches, not from documentation theory.
The validator marks apps.apple.com as invalid and blocks the creative. Only the legacy form works: itunes.apple.com/<geo>/app/…/id<ID>?mt=8 — which redirects to the right place anyway.
Autoplay is banned in so many words: the ad timer begins on the first touch. So the autostart mechanism does not exist in our builds — it is not merely “switched off by a flag”.
FbPlayableAd or another network’s call left in the CTA cascade of the source creative. The branch may be unreachable — to a reviewer it is still a blocker. We reduce the redirect to a single definition.
An inherited <script src="mraid.js"> or any relative src: a self-contained file must have no external dependencies, and in a webview that path simply will not resolve.
A store address or a test app identifier baked into the source creative’s zip or base64 layer. Text search never sees it — the packed content has to be unpacked and inspected.
A reused creative keeps a disclaimer from another jurisdiction. In a new geo that is a direct cause of rejection — it gets removed along with the localisation.