Google is the exception, not the rule

Across Meta, AppLovin, Unity Ads, Vungle, and TikTok, the packaging requirement is uniform and absolute: every asset — every image, font, audio clip, and script — has to be embedded inside the single HTML file or the ZIP itself, with zero requests leaving the creative at runtime. There's no partial credit and no approved exceptions list for any of them. If it's not inlined or bundled, it doesn't ship.

Google Ads breaks from that pattern. Its spec explicitly allows local relative paths inside the ZIP plus a small, named set of externally hosted libraries and services. That's a meaningful relaxation compared to the other six networks, but it's also easy to over-generalize from — assuming "Google allows external stuff" means any CDN reference is fine is a common and entirely avoidable way to get a creative rejected.

Exactly what's on Google's allowlist

This is the complete list, taken directly from Google's spec as implemented in PlayableKit's network rules — nothing added, nothing paraphrased away:

  • https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi.js — Google's own exit API script, used for the clickTag / ExitApi.exit() click-through.
  • Google Fonts
  • Google-hosted jQuery, CreateJS, or Greensock (GSAP)

That's the entire list. Three items: one specific URL for Google's exit script, and two categories of Google-hosted libraries. Everything else in your creative — every sprite, sound effect, background image, custom font file, and any third-party library not covered above — has to live inside the ZIP as a local relative path. There is no fourth category and no generic "reputable CDN" carve-out.

Worth knowing: the allowlist covers where a resource is hosted, not just what kind of resource it is. A font is only fine if it's served from Google Fonts specifically — the same font file hosted on a different CDN, or self-hosted on your own domain, isn't covered just because "it's a font."

Why referencing anything outside the list gets a build rejected

Google checks a playable ZIP against its spec mechanically at upload — there's no reviewer weighing whether an external reference is "basically fine." The check is closer to a lookup than a judgment call: does this external request match the exit API URL, or resolve to Google Fonts, or resolve to a Google-hosted copy of jQuery/CreateJS/GSAP? If not, it fails the asset-reference rule, full stop.

This is exactly the kind of failure that's confusing to debug, because the creative works perfectly in every environment where you're likely to test it — your browser and any staging preview resolve the external request fine. The failure only shows up when it hits Google's automated upload check, and the rejection reads as a generic packaging failure with no pointer toward "there's a font on a CDN in your CSS" as the actual cause. Common ways this happens by accident:

  • A custom web font referenced via @font-face pointing at a third-party CDN, rather than a Google Fonts URL or a font file bundled into the ZIP.
  • An animation or tweening library pulled from a public CDN (unpkg, cdnjs, jsDelivr) instead of embedded or loaded from Google's own hosted copy.
  • Analytics or tracking snippets left in from a template, pointing at a third-party domain.
  • Any image, audio, or video tag with an absolute URL pointing outside the ZIP, left over from a build pipeline that assumed a CDN would serve those assets in production.

None of these break rendering during development. All of them are outside the allowlist, and all of them put the upload at risk.

Practical guidance: when in doubt, embed

Because the allowlist is narrow and the failure mode is silent until upload, the safer default is to treat Google's rules as close to the "embed everything" standard the other networks enforce, and only reach for an external reference when it's genuinely one of the three allowed items:

  • Bundle fonts into the ZIP as local files, or use an actual Google Fonts URL if you want the external option — not a CDN mirror or a self-hosted copy of a Google Fonts file.
  • Bundle animation/tweening libraries (GSAP, CreateJS, jQuery) as local files inside the ZIP unless you're deliberately using Google's hosted copy and have confirmed the URL matches exactly.
  • Leave the exit API URL as-is — https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi.js is how Google's click-through mechanism works; it's meant to stay a remote reference.
  • Audit for leftover external references before packaging — CDN font imports and analytics snippets are the most common accidental holdovers from a general-purpose HTML5 build not originally built with Google's spec in mind.

If your playable started as a Unity Playworks/Luna export, this is worth checking specifically: Unity's generic HTML5 exporter has no concept of Google's allowlist, so any external reference that ends up in the build is there by accident, not by design.

Worth knowing: PlayableKit's Playable Ad Validator checks a playable's asset references against each network's actual rules — including Google's allowlist — for free, with no signup required.