Users should NOT be given ability to unconsent from legitimate interest. This will kill AdMob

[Alex Cretney]

I am copying here some feedback i've added on the 'Manage Legitimate Interest Settings' help page. This needs to be escalated and addressed ASAP or many developers using your service will be at risk of bankruptcy! I've raised this once before and when i pointed out your engineer did not understand the correct definition of 'legitimate interest' i was then ignored. The seriousness of this situation cannot be overstated! BTW i speak as someone who was a Data Privacy specialist in a previous role and i have implemented GDPR compliance for companies in the past. 

Im sorry, but your implementation of your CMP is fundamentally flawed and will destroy  AdMob as a monetisation platform.

It is NOT appropriate or logical to give users the option to unconsent from 'legitimate interest'.

CONSENT, is a fundamentally different legal basis than 'legitimate interest'. To give the user the ability to unconsent from legitimate interest, would be the same as giving them the ability to unconsent from 'vital interest' or unconsent from 'legal obligation'.

Consent is the ONLY legal basis for which users should be asked to... consent!

It is the DEVELOPER who specifies whether data collection happens under 'legitimate interest'. The user has NO SAY in that matter, beyond their freedom to not download the app in the first place.

When a developer says they require some data under legitimate interest... They are saying it is the minimum level of data required for the app to function. The end-user has no say in this, its a assertion of the developer. The user has no idea what data is required for an app to function. Wrapped up in this idea, is that apps come with infrastructure costs!!! Therefor it is a matter of LEGITIMATE INTEREST that we have access to at least the data necessary to serve untargeted ads and offset those costs!! 

We simply cannot take on overhead, without corresponding revenue! That is why a certain level of data collection is required under 'legitimate interest'. Without that data collection, the costs of the app literally cannot be supported and therefore the app cannot function.

That is why every user implicitly accepts (as a condition of using the app which they are free not to download) that some level of data collection WILL OCCUR to at least serve them untargeted ads. That data collection happens under 'Legitimate Interest' which they should NOT be able to simply switch off.

They can then optionally CONSENT to a higher level of data collection to enable targeted ads.

The implications of your implementation is that if a user 'unconsents' to 'legitimate interest' (which is wrong even in concept as i have explained, no data privacy professional would understand this idea as a concept), then a developer could end up in a situation having to fund the infrastructure costs for 100,000 users with NO corresponding income because we can't even serve untargeted ads!

This is obviously ludicrous! All controls to 'consent' to legitimate interest need to be removed ASAP. Otherwise all developers are simply going to move to alternative ad serving platforms. 

This needs to be escalated within google for immediate rectification as it's a matter of extreme urgency given your deadline on mandatory consent forms and the fact that many developers have recurrent infrastructure costs which are going to bankrupt them if they cant advertise to any of their customers come 2024!

Please don't ignore this!! 

[bellissimo]

It is a curious one. According to the GDPR docs, people do have a 'Right To Object' to Legitimate Interest data usage, but this will only be considered where the damage caused by the use of the personal data outweighs the requirements of the company to use it. I guess this is 'possible' in these circumstances, but highly unlikely and would need to be considered on a case by case basis. So I suppose the easy solution is to always uphold all 'Rights to Object' and deny the legitimate interest. Not sure whether this is right or wrong, though certainly confusing, especially when you also have a 'Consent' button next to the 'Legitimate Interest' button. Then you have a situation where you can both 'Consent' and also 'Object' to data usage, with the Objection winning out.

[Test Dvd]

Hello Alex,

You couldn't have explained it better.

Will they listen to you? I doubt it ...

[Alex Cretney]

I think the 'right to object' would be an extremely exceptional case that would come off the back of a poorly handled data subject access request. This would only ever happen if a user was actually inconvenienced in some way. 

In the real world if you explicitly ask someone if they want to deny legitimate interest as a legal basis, they will do it 100% of the time simply because they were asked! The provision for 'objection' should be handled as an exception, 'objection' is not the same as 'consent'. they should never be asked to 'consent' to legitimate interest up front! 

I have just spoken with a friend of mine. He is the Group Data Protection Officer for an international betting company with over 7 offices and 2000 employees worldwide. He works in the gambling domain... He REALLY knows his stuff... He agreed completely... "consenting" to legitimate interest is utterly wrong in concept and this implementation is crazy! 

[Alex Cretney]

If this gets ignored i'll be tempted to start DM-ing senior google people in linkedIn... If the support team keep treating this as some 'just another' support gripe, they're literally going to kill AdMob as a business. 

Meanwhile i'm already looking into alternative mediation networks. Here's a nice introductory link to some options

https://www.adpushup.com/blog/mobile-ad-mediation-complete-guide-for-publishers/#:~:text=Appodeal%20is%20a%20mobile%20ad,ad%20network%20for%20each%20impression.

[bellissimo]

Isn't a lot of the low level implementation driven by the TCF anyway? It is the same thing you see on websites all over the place, so not specific to the UMP. If Google are to be TCF certified, this is the way the TCF are saying it needs to be implemented. Not saying it makes sense, the whole TCF framework is nuts.

[Alex Cretney]

bellissimo do you secretly work for google? 

All you're doing with these contributions is undermining the criticality of an issue which is about to destroy livelihoods and making this look like a tit-for-tat shrug of the shoulders... "well it it was it is" sort of problem! 

This isn't a case of "well its a hot debating ground and there's lots of differing opinions" . This is not a debatable issue. This is sector destroying! Can we just let google comment? 

If this is all about TCF certification, and we agree the TCF framework is nuts...  then google should NOT volunteer for that standard! It is voluntary after all! The whole thing is put together by bureaucratic grifters and provides absolutely zero benefit to a typical user in anycase. If it WAS intended to benefit the man on the street, the entire thing would be written in normal language. 

Google has an obligation to stick up for the hundreds of thousands of developers that have loyally published to, and provided untold value to their platforms rather than ticking some idiot boxes for some eu bureaucrat! As thing stands... Google are expecting us to publish and front the costs of publishing to their platforms without ANY share of the profits! They still sell their phones, charge us for hosting,  take their developer fees etc.... but they're happy for us to take nothing from ads! This is revolting and unethical. 

[Andreas]

> If this gets ignored i'll be tempted to start DM-ing senior google people in linkedIn...

If you have that option, please do. Various obvious shortcomings of Google's CMP have been discussed here for more than three years, without any meaningful progress (or even just any change for the most part) on their side. Meanwhile, most answers by "Forum Support" in here read as if they have been written by an LLM with minor human oversight. Even if they won't ignore you, I'd be surprised if you got an answer that is in any way relevant.

[Rafael]

consent is opt in
legitimate interest is opt out
90%+ won't opt out. I think it is not the major problem. You should focus on the consent / opt in process. If you mess it up there, you can loose 30-90% of your revenue. If you do a good job you loose just 5-10% of your revenue.

[Mobile Ads SDK Forum Advisor]

Hi,

Thank you for contacting the Mobile Ads SDK Support team.

We regret the inconvenience caused. I understand that your query is related to GDPR/ UMP implementation. Please note that your specific queries related to GDPR/UMP are out of scope for our team. I would recommend reaching out to the Product support team as they are better equipped to address your concern. 
 

This message is in relation to case "ref:_00D1U1174p._5004Q2p2MoE:ref"

Thanks,
 

Mobile Ads SDK Team

[Mobile Ads SDK Forum Advisor]

Hi,

I see that you have already raised this concern on another thread with the subject 'Users should NOT be given ability to unconsent from legitimate interest. This will kill AdMob', and we have already responded there for this issue. To avoid multiple threads on the same issue, please take a look at that thread and continue the discussion on the same for further updates on the issue.
 

This message is in relation to case "ref:_00D1U1174p._5004Q2p2PBg:ref"

Thanks,
 

Mobile Ads SDK Team

[Mobile Ads SDK Forum Advisor]

Hi,

Thank you for contacting the Mobile Ads SDK support team. 

Thank you for the feedback. I would recommend reaching out to the Product support team as they are better equipped to address your concern. 

Please note that we can only assist with technical queries/concerns related to the Mobile Ads SDK.

This message is in relation to case "ref:_00D1U1174p._5004Q2p2PI8:ref"

Thanks,
 

Mobile Ads SDK Team

[Mobile Ads SDK Forum Advisor]

Hi,

Thank you for contacting the Mobile Ads SDK support team. 

Thank you for the feedback. I would recommend reaching out to the Product support team as they are better equipped to address your concern. 

Please note that we can only assist with technical queries/concerns related to the Mobile Ads SDK.

This message is in relation to case "ref:_00D1U1174p._5004Q2p2wYs:ref"

Thanks,
 

Mobile Ads SDK Team

[Mobile Ads SDK Forum Advisor]

Hi,

Thank you for contacting the Mobile Ads SDK support team. 

Thank you for the feedback. I would recommend reaching out to the Product support team as they are better equipped to address your concern. 

Please note that we can only assist with technical queries/concerns related to the Mobile Ads SDK.

This message is in relation to case "ref:_00D1U1174p._5004Q2p345u:ref"

Thanks,
 

Mobile Ads SDK Team

[bellissimo]

I don't know what this is in response to, but the other thread you are referring to is actually this thread?

[Mobile Ads SDK Forum Advisor]

Hello,

The current behavior of the UMP SDK allowing users to toggle legitimate interests is working as intended and there are currently no plans to change this behavior.

Note that you are not required to use the UMP SDK to gather consent. Per https://support.google.com/admob/answer/13554116, you have the option to use any 3rd party Google-certified TCF-compliant consent management provider to gather consent. If you feel a different CMP gathers consent in a way that better meets your business requirements, you are free to try them out.

Thanks,
Eric, Mobile Ads SDK Team

 

ref:!00D1U01174p.!5004Q02p2MoE:ref

[Alex Cretney]

Thanks Eric,

Basically your data privacy advisor has absolutely no idea what they're doing but your doubling down anyway. Unconsenting from 'legitimate interest' is not a thing. This is a contradiction in terms. You won't find another Data Privacy specialist anywhere in the world that will make sense of 'unconsenting from the legitimate interest' for you. Anyway, to hell with all the developers who provide so much value to your platform. 

Being able to monetise isn't MY 'business requirement', it's a requirement of every single developer who spends blood sweat and tears in developing and then maintaining these apps on your ecosystem.

As is made clear in your response, googles decision is to continue to profit from the products developers publish to your system, to continue to charge them development and infrastructure fees, but to cut them out of the revenue loop... Im sure this must be a violation of googles anti-slavery policy no? This is not 'Doing the right thing'... It's arguably 'being evil'. What would Larry Page think of this? 

Ive spent a year of my life learning to code and developing this app with the basic expectation i would be compensated for that work through the right to advertise on my own product. 

As google are rescinding that right and now intend to take all the profits for themselves, i will indeed look into 3rd party solutions. For all i know the fees associated with those 3rd party solutions exceed what i'd receive from the ads but i guess i just have to jump into the abyss and hope for the best. Perhaps i've wasted a year of my life on this and will just have to get a job pushing a trolley somewhere because your data privacy advisor thinks 'unconsenting from legitimate interest is a thing', and google think cutting developers out of the revenue loop is ethical. 

Anyway thanks for your response.. i'll look to third party ad solutions

[Test Dvd]

Hi Alex,

Do you mean that you are going to put non-Google ads in your application?

[Mobile Ads SDK Forum Advisor]

Hi Alex,

In case it wasn't clear, you can use any one of the CMPs at https://support.google.com/admob/answer/13554116#zippy=%2Cgoogle-certified-cmps along with Google Mobile Ads SDK to serve Google ads in Europe post enforcement in January 2024. You do not necessarily need to switch ad solutions.

So just picking a few from the top of that list, 1&1 Mail & Media GmbH, AdOcean, Alma CMP, etc are certified CMPs for app. So if you find one of those certified CMPs that you feel does a better job of presenting consent to the user, you can implement that consent solution to complete the job of gathering consent.

It's the job of the CMP to gather consent and write the TCString. Google Mobile Ads SDK just reads the TCString at ad request time and starting January 2024 will read  verify it comes from a certified CMP when in a GDPR-affected region. The UMP SDK is just Google's CMP solution for consent gathering, but that is interchangeable with another CMP solution.

[Alex Cretney]

@TestDvd thats the plan. This issue aside i can't display ads with AdMob even WITH consent because i get nothing but no fill errors. Google tells me this is because of a 'payment hold' on my AdSense account and that i need to confirm my details with a pin... Of course i can't get the pin because i can't reach the £60 payment threshold because they're not giving me ads... Its literally ridiculous. 

I'm currently trying to get Appodeal working but finding some issues with their flutter SDK. Currently working with their engineers to resolve. 

[Andreas]

@Alex, if you find something that works for you, I'd appreciate it if you mentioned that here (or in a private comment, although I believe the information would be useful for many of us), because I am in a similar situation.

For what it is worth, I've had a cursory glance at Applovin, but so far I can't even tell what their upfront cost might be. Also, it seems as if for waterfall with Google AdMobs and several other networks to work via Applovin, we'd still be stuck with having to use a CMP certified by Google (basically UMP again!), so it would probably have to stand on its own.

[Alex Cretney]

Thanks @Eric,

I do understand. I'm just pointing out that googles own solution which gives users the option to unconsent from 'legitimate interest' as a legal basis for data collection...

a) demonstrates a serious misunderstanding of GDPR and requirements around privacy law which is a very bad look for google

b) results in a funnel through which developers simply cannot monetise their users at all

Ethically, if your own implementation results in non-monetisable users, there should be some agreement with your firebase team that we shouldn't be charged to support those users.  

I do understand there are other CMP providers... CookieYes for example looks like a free option so i'll look into that... 

I'm just saying that the UMP is not fit for purpose as a means of gathering consent, because you are requesting consent for 'legitimate interest' which in legal consent parlance is a contradiction in terms... The only legal basis which users should ever be asked to 'consent' to, is the legal basis which is actually called 'consent'. Thats why its called consent! 'Legitimate interest' is declared by the provider of the service, the user doesn't get a vote on it because they have no idea if a particular bit of data is required under legitimate interest. Only the service provider knows that. 

Anyway, thanks for the link i'll certainly look at those options. I'm probably have to go with another AdNetwork at this point anyway however because i have a 'no fill' error that that support team have been unable to resolve. 

I'll stop ranting now. Thanks for responding anyway and have a good evening

[Test Dvd]

Hi,

@Alex, @Eric, if we use other certified CMPs to ask for consent, would we NOT have Google Admob ads?

Would non-personalized ads be shown if the user does not give consent?

Thank you

[Alex Cretney]

@Andreas - I've been pulling my hair out all day but i've found and installed an alternative ad platform called 'Appodeal'

It works pretty much the same as Admob, you can even link Admob as an ad partner through mediation. 

Crucially, their consent dialog is actually functional! The user either accepts personalized ads or they dont... If they accept they get targetted ads, if they don't they get untargetted ones... There's no unconsenting from legitimate interest nonsense and users are always monetized. 

If you want to give it a try... 

You can setup an account here

https://appodeal.com/

and install their latest SDK here

https://github.com/appodeal/Appodeal-Flutter-Plugin#adjust

A few Gotchyas! 

The SDK was breaking my IOS builds for a long while... Im using an M1 mac and am really quite clueless when it comes to the app ecosystem (pod files, gems etc...) - Perhaps my issues were specific to my setup, but if you run into problems yourself here is what i would advise trying

1) Uninstall the admob_flutter sdk before you install the Appodeal one. The Admob SDK is included within the Appodeal SDK and having 2 installations was creating conflicts and giving me weird errors

2) Do NOT include the following optional pods 

pod 'APDDTExchangeAdapter', '3.2.0.0-beta.1' 

pod 'BidonAdapterDTExchange', '~> 0.4'

These (i think) are the Digital Turbine pods and contain their own dependancy and implementation of Crashlytics... I was stuck on some cryptic dSYM error for about 3 hours today and it turns out that these are crashlytics symbol files generated from those pods! Exclude the pods and you'll have no problems. 

3) This may or may not be necessary but i set the deployment target to IOS 13.0 within Xcode in the following places 

• Runner > Project (Runner) > Build Settings > Deployment
• Runner > Target (Runner) > Build Settings > Deployment
• Pods > Project (Pods) > Build Settings > Deployment

Good luck

[Mobile Ads SDK Forum Advisor]

Hi Test Dvd,

If using a 3rd party certified CMP, you can still get Google personalized ads. The same requirements for which purposes must be consented to/legitimate interest apply - see https://support.google.com/admob/answer/9760862#consent-policies for more information.

Additionally, you will need to make sure that the vendor with ID 755 (see https://iabeurope.eu/vendor-list-tcf/ and search for "Google Advertising Products") is included in the list of vendors that the consented purposes apply to. A 3rd party CMP will probably have different UI controls to configure which partners to request consent from. For the UMP SDK, it is the AdMob UI privacy and messaging tools where you do that.

If you use UMP SDK, you'll also notice the AdMob UI has a default list of ~200 vendors and I only talked about 755 above. Vendor 755 is what's needed for "Google Demand". However, the "AdMob Network" ad source also includes some ads from 3rd parties through an exchange. See https://support.google.com/admob/answer/10989569 for how to include a dimension in reporting to see where your different ads come from. Google demand is likely going to be a majority of your traffic, but I would recommend checking there to see where else your impressions are coming from so you have an idea of which other vendors you may need to include as part of your consent if using a 3rd party CMP. 

Finally, if you end up using a 3p CMP that writes the consent string, if you know how to read it from local storage you can pop it into https://iabtcf.com/#/decode and see what's included there. https://developers.google.com/admob/android/privacy/gdpr#how_to_read_consent_choices_2 gives some hints at how to read this, but the full string would be the IABTCF_TCString key from https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20-%20CMP%20API%20v2.md#in-app-details.

[Test Dvd]

Hello @Alex,

What good news that you were able to implement the cmp and it works correctly!!!

I have some questions, it would be great if you could answer.

1) You are using medition in your apps, right? If you include Admob in the partners, if the user does not accept the consent, do ads still appear??

2) If you use appodeal, who pays you? appodeal or admob?

3) is appodeal paid? I guess so, what is the price?

Thank you.

[Test Dvd]

@Alex, Can you answer the questions from the previous post?

Thanks.

[Alex Cretney]

Hey @TestDvd,

Apologies for the late reply im stuck in some catastrophic problems at the moment. I don't know the answer to your questions of the top of my head but if you reach out to Appodeal and ask them im sure they'll be happy to help

[bellissimo]

Just to be clear, that list shows Google Certified CMPs, however that does not mean they are publicly available. In fact most of them seem to be private implementations, so you can't just use any one of them. It would be much more helpful to have a list of CMPs which are available for the public to use.

[Test Dvd]

@Alex, 

ok, thanks for responding. I'm going to write to appodeal.

I hope those catastrophic problems are not with the GDPR!

------------------------------

@bellissimo,

Yes, the list is of private sites. And we don't even know if ads will appear if the user does not accept consent.

I think the only public is Google's own.