Disclose to EEA users

  • Under the Google EU User Consent Policy, you must disclose certain information and obtain consent from users in the European Economic Area and the UK to use cookies, other local storage, and personal data for ad serving, reflecting EU ePrivacy Directive and GDPR requirements.

  • This guide focuses on supporting the GDPR IAB TCF v2 message using the UMP SDK and should be used in conjunction with the Get started guide for basic setup.

  • GDPR mandates consent revocation, requiring you to provide users with a way to withdraw their consent choices at any time.

  • You can indicate that a user is under the age of consent by setting setTagForUnderAgeOfConsent to true, which prevents the UMP SDK from requesting consent, but this setting must also be explicitly applied to ad requests.

  • To avoid impact on monetization for users in the EEA and UK, you must implement a Google-certified CMP by January 16, 2024.
Select platform: Android iOS Unity Flutter Android (Legacy)

Under the Google EU User Consent Policy, you must make certain disclosures to your users in the European Economic Area (EEA), the United Kingdom (UK), and Switzerland, and obtain their consent to use cookies or other local storage, where legally required, and to use personal data (such as AdID) to serve ads.

This policy reflects the requirements of the EU ePrivacy Directive and the General Data Protection Regulation (GDPR).

This guide outlines the steps required to support the GDPR IAB TCF v2 message as part of the UMP SDK. It is intended to be paired with Get started which gives an overview of how to get your app running with the UMP SDK and the basics of setting up your message. The following guidance is specific to the GDPR IAB TCF v2 message. For more information, see How IAB requirements affect EU consent messages.

Prerequisites

GDPR requires consent revocation to allow users to withdraw their consent choices at any time. See Privacy options to implement a way for users to withdraw their consent choices.

To indicate whether a user is under the age of consent, set setTagForUnderAgeOfConsent (TFUA). When you set TFUA to true, the UMP SDK doesn't request consent from the user. If your app has a mixed audience, set this parameter for child users to ensure consent is not requested.

The following example sets TFUA to true on a UMP consent request:

Java

ConsentRequestParameters params =
    new ConsentRequestParameters.Builder()
        // Indicate the user is under age of consent.
        .setTagForUnderAgeOfConsent(true)
        .build();

Kotlin

val params =
  ConsentRequestParameters.Builder()
    // Indicate the user is under age of consent.
    .setTagForUnderAgeOfConsent(true)
    .build()

Mediation

Follow the steps in Add ad partners to published GDPR messages to add your mediation partners to the ad partners list. Failure to do so can lead to partners failing to serve ads on your app.

Mediation partners might also have additional tools to help with GDPR compliance. See a specific partner's integration guide for more details.

After GDPR consent has been collected, you can read consent choices from local storage following the TCF v2 spec. The IABTCF_PurposeConsents key indicates consent for each of the TCF purposes.

The following code snippet shows how to check consent for Purpose 1:

Java

SharedPreferences sharedPref = PreferenceManager.getDefaultSharedPreferences(context);
// Example value: "1111111111"
String purposeConsents = sharedPref.getString("IABTCF_PurposeConsents", "");
// Purposes are zero-indexed. Index 0 contains information about Purpose 1.
if (!purposeConsents.isEmpty()) {
  String purposeOneString = String.valueOf(purposeConsents.charAt(0));
  boolean hasConsentForPurposeOne = purposeOneString.equals("1");
}

Kotlin