Own UI for user consent instead of Google CMP / UMP

[Martin]

Hello,

I want to use my own User Interface (UI) to ask for consent from European users instead of using Google's own CMP (Consent Management Platform), as Google's own CMP "UMP" ("User Messaging Platform") is known for having bugs (that Google doesn't seem to fix) that result in often not showing any ads at all.

So is it possible to ask users in my own custom build UI for their consent to personalized or non-personalized ads and what exactly do I need to pass to Google if the user only accepts personalized ads? Is it still sufficient to configure GADRequest with npa=1 so that Google knows that the user only accepts non-personalized ads? Or do I have to pass a certain TC string for users who accept personalized or non-personalized ads? How would these TC strings look like?

And if I do all that will it still work after Google's new consent requirements (https://support.google.com/admanager/answer/13554020?hl=en) come into effect which requires a certified CMP?
Will Google in this case consider my own custom build UI as a CMP for which I have to get a certification from Google? Is it even possible for small developers to get this certification? Or is it a difficult bureaucratic process?

Thank you so much.

Kind regards,

Martin

[Mobile Ads SDK Forum Advisor]

Hello Martin,

Thank you for reaching out to us.

You can create your own consent dialog that displays a message on your sites or apps asking your users in the EEA and the UK for consent. Just kindly make sure that you comply with the EU user consent policy (https://support.google.com/admob/answer/7666519?hl=en&sjid=958286124600267954-AP). However, we still recommend using User Messaging Platform (UMP) SDK for this purpose.

For more information regarding TC strings, we refer the following documents:

• Publisher integration with the IAB TCF v2.0 - https://support.google.com/admob/answer/9760862?hl=en&sjid=2418371235660772237-AP
• Troubleshooting TCF v2.0 implementation - https://support.google.com/admob/answer/9999955?hl=en

With regards to your concern about CMP certification, kindly forward this instead to this link: https://support.google.com/admanager/contact/cmp_certification_interest.
 

This message is in relation to case "ref:_00D1U1174p._5004Q2mqCo7:ref"

Thanks,
 

Mobile Ads SDK Team

[Martin]

Hello,

Thanks for your reply.

But do I understand it correctly that once Google's new announcement (https://support.google.com/admob/answer/13554116?hl=en) comes into effect, only certified CMPs will work and that also my own consent dialog wouldn't work anymore and only limited ads will be shown?

Also it's not sufficient to configure GADRequest with npa=1 so that Google knows that the user only accepts non-personalized ads? You have to pass a certain TC string, or does  GADRequest with npa=1 still work?

Unfortunately Google AdMob's own CMP "UMP SDK" is not a great solution, as it is not working correctly and many publishers are complaining, e.g. here:

https://groups.google.com/u/1/g/google-admob-ads-sdk/c/InmLIbFm8Xg

Also this Github page mentions the long time known issues in the UMP SDK that Google is not fixing which is causing no ads to be shown in many cases:

https://github.com/bocops/UMP-workarounds

Could you please finally really fix the issues in UMP SDK, so that it becomes a real alternative and can be used without worries about that no ads will be shown?

It would be extremly important that your own CMP will work flawlessly when your requirements for using a certified CMP come into effect (https://support.google.com/admob/answer/13554116?hl=en). Then publishers don't have to build their own consent dialog which probably also wouldn't be in Google's interest as Google probably does not want to certify plenty of own consent dialogs from thousands of AdMob publishers.

Kind regards,

Martin

[Mobile Ads SDK Forum Advisor]

Hello Martin,

Other IAB TCF v2.0 consent management platforms (CMPs) should not need to take any action to support limited ads. The existing TC string contains all of the relevant signals required to select the correct serving mode. If the following conditions are met for Google as an ad technology provider, we will serve limited ads:

• No consent for Purposes 1, 3, and 4
• Legitimate interest or consent for any other purpose

This means that using a non-certified CMP will not cause limited ad serving, only the conditions above. More information in this document: https://support.google.com/admob/answer/10105530.

It is no longer sufficient to to configure GADRequest with just npa=1 for serving non-personalized ads as the following criteria has to be met when consenting:
The end user grants Google consent to:

• Store and/or access information on a device (Purpose 1)

Legitimate interest (or consent, where a publisher configures their CMP to request it) is established for Google to:

• Select basic ads (Purpose 2)
• Measure ad performance (Purpose 7)
• Apply market research to generate audience insights (Purpose 9)
• Develop and improve products (Purpose 10) 

Mobile Ads SDK will automatically obtain, parse, and respect the TC string from within local storage. Configuring GADRequest will no longer work. 

[Martin]

Hello,

Thank you for your reply.

You said that: "using a non-certified CMP will not cause limited ad serving". But someone from Google in this webinar (https://www.youtube.com/watch?v=ZpyuVrrShek&t=940s) for AdMob, AdSense and AdManager said at 15:40 that if you are not using a certified CMP by the deadline then only limited ads will be served. So it is indeed necessary to have a certified CMP if you want more than limited ads.

Kind regards,

Martin

[Mobile Ads SDK Forum Advisor]

Hi Martin,

Thank you for your response.

As per this article (https://support.google.com/admob/answer/13554020?hl=en&sjid=11447384940574596772-AP#:~:text=Web%20and%20app%20fallback%20behavior%3A), if a partner does not adopt a Google-certified CMP, only limited ads will be eligible to serve. Traffic from a Google-certified CMP will continue to be eligible for personalized ads, non-personalized ads (NPA), or limited ads. You can also see this in your account under the notifications if you haven't yet used the Google-certified Consent Management Platform (CMP). You can use any Google-certified CMP (https://support.google.com/admob/answer/13554116) for this purpose, including Google's own consent management solution. 

[Test Dvd]

Hello,
Is it possible to implement another sdk than the ump one so that the consent message appears?

How would this be done?

Thank you

[Danny]

Does anyone have any guidance on how to parse the UMP string? I would like to be able to determine if whatever the user has selected will prevent ads from being displayed; I imagine that parsing those values would enable me to compare them against the minimum requirements for Google non-personalized ads. 

A nice enhancement to the framework would be a simple flag that would indicate whether AdMob will be rejecting ad requests based on whatever configuration has been selected by the user. That would certainly meet my needs. 

[Danny]

To answer my own question (at least with respect to Android apps), the examples in this blog are "pure gold". My only concern at this point is that  PreferenceManager.getDefaultSharedPreferences  is deprecated. I am still trying to figure out how to replace that using the current AndroidX Preference manager.

If anyone has similar guidance for IOS, I would appreciate hearing about it!

https://itnext.io/android-admob-consent-with-ump-personalized-or-non-personalized-ads-in-eea-3592e192ec90

[Danny]

Last post on this topic, for now.

Using the code from my previous post and the guidance provided earlier, I was able to manually configure a GDPR consent to successfully get ads in my Android application. I could still really use some feedback/assistance in the world of IOS.

This is what I've found and, IMHO, this is not a solution:

1. I've been developing for decades. It took me 5 attempts to "get it right". My ultimate "malfunction" was in not granting permission specifically to "Google Advertising Products" (or whatever the full name is).

2. It took me 5-10 minutes on the final, successful configuration. No user is going to do that. I feel confident stating that as "fact".

3. I realized I had to find "Google" in the vendor list. That meant scrolling through the entire list because it's not alphabetized - for real!

4. If I only grant consent to Google, those are the only ads I see; nobody else from my mediation sources appears. Doesn't that kill the concept of "bidding" for ads? I can't imagine how I'm supposed to communicate to a user what all of my mediation sources are so, were they so inclined, they would kindly check them all. More importantly, doesn't that basically kill the idea of "mediation groups"? What happens if I add a new sources AFTER the user has gone through the GDPR acceptance process? Am I supposed to tie something to mediation that invalidates any prior GDPR acceptance? Perhaps a Firebase remote config flag? I can imagine that routinely being asked to jump through those hoops would not be a great UX.

I appreciate that Google is trying to respect the EU & GDPR rules, but the implementation in this framework is extremely flawed. IMHO it is not considering UX at all; it is purely focused on implementing a Rules Engine. For example, I noticed that for each vendor, there is a description of their specific data usage policies; in some cases, it is just how long cookies will live. Many of the descriptions are the same. Can't those be consolidated into a set of contained choices that can be used to determine which vendors can be approved based on user selections? In other words, skip the names of the vendors and focus on how they are using the device or data. I personally didn't recognize many of the vendor names.

[Mobile Ads SDK Forum Advisor]

Hello Danny,

Thank you for providing your insight in detailed. It is indeed that the UMP SDK is built to fully follow and respect the EU & GDPR rules which might sacrificing the UX currently. That being said, do kindly note that we always do strive to improve UMP SDK with each releases and update, in our efforts to slowly improve the UX while following the rules of EU & GDPR. In the meantime, you may keep an eye on our developer blog (https://ads-developers.googleblog.com/search/label/admob_sdk) regarding this.

For your regarding the mediation, you must identify each ad network in your mediation chain that may collect, receive, or use personal data and provide information about each network's use. Google currently is unable to pass the user's consent choice to such networks automatically. So for your use case when adding a mediation, you will need to ask a consent for that mediation as well.

[Danny]

I'm not following the last paragraph of the response. Are you saying that if I have multiple ad sources in a single AdMob mediation group (e.g. AppLovin, AdColony, InMobi...), those sources will not get the response information from the Google UMP and that I will actually need to display three additional consent dialogs to the user? One for each ad source in the mediation group?

[Danny]

clarification to my earlier post: I'm referring to "bidding sources"; I don't use Waterfall.

[Danny]

I was able to refactor the code from the earlier Android link to work with Swift (IOS). The UMP strings are stored in NSDefaults which can be accessed via UserDefaults.standard

I posted my converted helper methods on stackoverflow because I couldn't figure out how to format code blocks here. 

https://stackoverflow.com/questions/77054664/parsing-the-google-gdrp-consent-string-in-swift-ios

I also posed the following question and will ask it here, as well:

Does anyone know if it is a violation of Google Play or App Store developer policies to prevent a User from using my app if I determine that their consent configuration would prevent AdMob ads from being shown?

On Tuesday, September 5, 2023 at 7:23:39 PM UTC-4 Danny wrote:

[Mobile Ads SDK Forum Advisor]

Hello Danny,

No, you don't have to display separate consent dialogues for each mediation group.

Passing TC string to mediation partners: The IAB TC string will be available in device local storage (NSUserDefaultsfor iOS or SharedPreferences for Android) and accessible to all mediation partners to obtain, parse, and respect when called in a mediation waterfall request.

This means that once the user has given their consent, the information will be available for all mediation partners without any further input.
 

[Mobile Ads SDK Forum Advisor]

Hello Danny,

No, it will not cause any policy violation as limiting any features of your app is within your own discretion.

[Danny]

Which leads to a follow-up - sorry!

I a User jumps through all of the hoops to set the correct consents and gets to the vendor list and, in my example, provides consent to "Google Advertising Products" but does not toggle the consent for AppLovin, AdColony, InMobi and the rest of the bidding sources, will those  non-Google providers be disqualified from the bidding process?

[Danny]

Thank you. Should I assume this is a "Google Play" perspective and that mileage may vary with Apple?

Only putting this out here as "food for thought" for others:

I was initially considering disallowing access to the app if ads cannot be served, but I got some inspiration from a post elsewhere and may just severely restrict app functionality. Probably a better approach so the User can at least evaluate the app. Then, I will reset the GDPR status so they are prompted again the next time they launch in case they want to change their mind. 

[Mobile Ads SDK Forum Advisor]

Hello,

Thank you for responding back.

Although Google currently is unable to pass the user's consent choice to such networks automatically, mediation networks have their own method to pass the consent of your  users. You may want to check AppLovin as example here: https://developers.google.com/admob/android/mediation/applovin#eu_consent_and_gdpr.

[Kwong]

Does it mean we have to parse the TC string ourselves and grab the correct value and pass it to certain mediation networks? I noticed some mediation networks such as AdColony are TCF 2.0 compliant. In that case, do they consume the TC string automatically (via adapter) since they are TCF compliant? 

[Mobile Ads SDK Forum Advisor]

Hi,

Thank you for getting back to us.

I will check with our team regarding your query and one of my team members will reach out to you once we have an update on this. Meanwhile, your patience is highly appreciated.
 

This message is in relation to case "ref:!00D1U01174p.!5004Q02mqCo7:ref"

Thanks,
 

Mobile Ads SDK Team

[Mobile Ads SDK Forum Advisor]

Hello,

There are multiple threads from multiple users so I will summarize a response:

- Please consult the available information of your specific mediation providers to determine how they handle consent. 
- If you are looking to the read the user's consent choices from UserDefaults or SharedPreferences, you can follow our iOS and Android docs. 
- More information on the TCF framework can be found here.

Thanks,
Justin

ref:!00D1U01174p.!5004Q02mqCo7:ref