The Vendors Your Sellers Hire Are Quietly Reshaping Your Platform

Based on the research ofCutolo, Hargadon and Kenney, "Hidden in Plain Sight: Conceptualizing Platform Auxiliaries and Their Conflicting Impacts on Platforms' Value Architecture," Journal of Management Studies, 2026

A new theory paper by Donato Cutolo, Andrew Hargadon, and Martin Kenney, forthcoming in the *Journal of Management Studies*, gives this layer a name: platform auxiliaries. These are third parties that build resources explicitly for complementors, not for the platform owner: software development kits for app developers, analytics dashboards for creators, channel-management and pricing tools for short-term rental hosts, and, at the layer's ugliest edge, fake-review services for online sellers. The paper's claim is not that these vendors are a footnote to platform strategy. It is that they sit directly inside the platform's value architecture, doing real architectural work the owner did not design and frequently does not see, and that this work cuts in two directions at once: it can expand what complementors can build and reach, and it can quietly corrode the trust and data boundaries the platform depends on.

The Tool Nobody at Headquarters Approved

Cutolo, Hargadon, and Kenney describe three concrete mechanisms by which auxiliaries reshape a platform's value architecture. They augment a complementor's development and commercialization capabilities by handing them functionality the complementor could not efficiently build alone. They increase a complementor's access to platform-specific information, often information the platform owner itself would rather keep proprietary. And they expand complementor activity beyond the focal platform entirely, stitching a seller's or creator's business across several marketplaces at once. None of this requires the platform's permission, because the auxiliary's contract runs to the complementor, not to the platform owner. The platform experiences the auxiliary's presence only indirectly, through the complementor's behavior, which is exactly why the layer stays invisible until something breaks.

Something broke in December 2020, when Apple and Google gave developers a matter of days to strip a location-tracking SDK called X-Mode Social out of their apps or be pulled from the stores. X-Mode had marketed itself to app developers as a straightforward monetization auxiliary: embed the kit, and it converts a user base's location data into ad revenue the developer would otherwise leave on the table. What developers of ordinary utility and prayer apps did not know, according to reporting by Vice's Motherboard, was that X-Mode was reselling that same location data to U.S. government and defense contractors, and that popular Muslim prayer and dating apps such as Muslim Pro had been feeding a pipeline that reportedly reached military buyers. Apple and Google, the platform owners with the actual power to police the ecosystem, discovered the arrangement from journalists, not from their own developer-review process, and responded by banning the SDK outright rather than the individual apps that had adopted it in good faith.

The platform owner sees the complementor's app. It almost never sees the vendor the complementor quietly plugged into it.

When the Auxiliary Is Also a Leak

The same blind spot showed up again, in a different vertical, with a tool nearly every consumer-facing website runs: the Meta Pixel. Tax-preparation companies including H&R Block, TaxAct, and TaxSlayer had installed the pixel as a standard marketing-analytics auxiliary, the kind of thing every e-commerce site uses to measure ad performance. Investigative reporting by The Markup in November 2022 found that the pixel was also transmitting extraordinarily sensitive information back to Facebook: filing status, approximate refund amounts, names of dependents, and even dependents' college scholarship information, alongside names, emails, and phone numbers. The tax-prep companies were not platforms in the Cutolo-Hargadon-Kenney sense, but the dynamic is identical to what platform owners face with their own complementors' tool choices: nobody at the company had audited what the auxiliary was actually doing with the data flowing through it. By September 2023 the FTC had sent warning letters to five tax-prep firms, telling them that using tracking tools to gather and transfer sensitive personal data without express consumer consent could constitute a deceptive or unfair practice. The mechanism is the paper's second pathway made concrete: an auxiliary marketed as boosting a complementor's information access instead became the channel through which the complementor's most sensitive information access leaked out.

The Fake-Review Economy Living Inside the Marketplace

Cutolo, Hargadon, and Kenney single out fake-review services as the auxiliary layer's most openly illegitimate branch, and Amazon's marketplace has spent years fighting exactly that branch in public court filings. In 2022, Amazon sued the administrators of more than 10,000 Facebook groups that it said functioned as fake-review brokerages, recruiting buyers willing to leave five-star reviews in exchange for refunds, free products, or cash, with one group alone, "Amazon Product Review," carrying more than 43,000 members. These groups were not part of Amazon's marketplace infrastructure in any formal sense; they were an entirely separate service, sold to sellers who wanted a shortcut past the platform's own trust signals, operating on a different platform (Facebook) altogether and expanding complementor activity beyond the focal platform in precisely the third mechanism the paper describes. The Federal Trade Commission escalated the fight to a systemic level in 2024, finalizing a rule, effective October 21, 2024, that bans buying or selling fake reviews outright and authorizes civil penalties of nearly $51,744 per violation. That a federal rulemaking was required at all is the tell: the auxiliary market for fake trust signals had grown large enough, and independent enough of any single platform's terms of service, that platform-level enforcement alone could not contain it.

The Auxiliary Layer That Actually Helps

The paper is explicit that auxiliaries are not a uniform threat, and the short-term rental sector shows the constructive half of the same mechanism. Airbnb ships its own Smart Pricing tool, but a large share of serious hosts instead run independent dynamic-pricing services such as PriceLabs and Beyond, formerly branded Beyond Pricing, which markets itself as operating across thousands of cities worldwide and cites customer results including a 40 percent increase in booking revenue from switching to its automated pricing. These tools were built by vendors with no formal role in Airbnb's architecture, aimed entirely at helping complementors extract more revenue than the platform's native tool would have delivered on its own, and layered on top through channel-manager integrations rather than through anything Airbnb engineered. This is the paper's first mechanism, augmented development and commercialization capability, functioning exactly as intended: real value created, real complementor income lifted, with zero required buy-in from the platform owner and zero platform-owner visibility into which specific algorithm is setting the price a guest ultimately pays.

That is the uncomfortable symmetry at the center of the paper. The same structural feature that lets a pricing tool quietly make Airbnb hosts more money is the feature that let X-Mode quietly route location data to defense contractors and let Facebook groups quietly manufacture five-star trust. Auxiliaries sit outside the platform's architectural control by definition, so the platform cannot select for the helpful ones and screen out the corrosive ones through the same governance lever. It has to build separate levers entirely.

What This Means Before the Next Scandal

Cutolo, Hargadon, and Kenney's contribution is to stop treating this shadow layer as noise around the platform and start treating it as part of the platform's actual value architecture, one the owner does not draw, does not staff, and largely does not see until an app-store ban, an FTC letter, or a federal rulemaking forces the issue. Every platform with complementors, an app store, a creator program, a seller marketplace, a host network, already has this layer whether or not anyone at headquarters has mapped it. The operating question is not whether auxiliaries exist inside your ecosystem. It is whether you find out from your own audit, or from Motherboard, The Markup, or the next regulator with subpoena power.