Facebook has dropped quite the grenade last week. In an obscure blog post on the Audience Network blog, FB has announced some major mandatory updates that will be enforced on all clients using the Audience Network.

What was announced

Effectively, every and all FB SDK versions <= 4.23 are deprecated on November 1st 2017. And it's the "hard" kind of deprectation: FBA will stop delivering ads to app installs where the SDK was not updated.

This means that you - the developer - have until Nov 1st to migrate your entire userbase to the new update. If your app still uses an older SDK version, you'd have to migrate it to the new one, test it and release it ASAP, to allow your users some time to migrate to the new release.

Facebook does not release SDK version distribution statistics, but there is no reason to assume that everyone has already migrated to 4.23, considering it just came out in May 2017.

On top of that, FB will begin enforcing some more implementation rules. I have compiled everything here for a quick reference:

  • FB SDK must be >= 4.23.
  • Only a single iOS App ID and a single Abdroid bundle (package name) per Facebook App ID.
  • Ads should be cached for 60 minutes max.
  • Placement IDs should be bundled into Ad Spaces (Facebook's AdUnit).
  • Stop mixing different format types on the same Placement ID.

Nov 1st? Wow that's close

Facebook is usually very open about its development roadmap. You can plan your Graph API compliance years ahead.

So this whole thing seems rushed. And not only the announcement itself: As of writing this post you can not delete an Ad Space, only create new ones. Not to mention that Ad Spaces are totally useless for now: you can not get any statistics for them and they have no client side implications.

And as to the Nov 1st goal - that's kinda harsh considering the slow adoption rate you usually experience with Android apps.

So what does this mean?

It's hard to tell what goes on behind the curtains at Facebook. Very little information was released on the subject and the server side is of course closed-source.

But we're all veterans here, and we all know that when a mandatory update is rushed out like this it usually means one of two things:

  1. There is a security issue at hand. Instead of disclosing the issue to the developers, Facebook is trying some other methods to make them migrate to the patched version. This is unlikely as we probably would have heard about this from 3rd party sources, such as Google which prompts for security holes in your apps in its Play Console.
    But it's still a viable possibility.
  2. There is a large scale click/impression fraud going on, and Facebook is trying to resolve it quickly. This seems more to the point here, as the call for SDK upgrade is mainly targeted at Audience Network users.

Enforcing sudden mandatory changes to developers' applications should always remain the last resort. Is it in this case?