GDPR Consent form does not offer proper user denied response call back

[HoldToRun]

Google Consent for return always consent Obtained even if user disabled all necessary permissions or pressed the generic do not consent.

This leads in a situation where AdMod will not supply ads anymore due to user inhibition but still google consent library returns consent Obtained.

Now the Ad monetized app has no chance at all to react if it should demand paid version for user and is forced to operate as a freemium with 0 ads. NO SENSE AT ALL.

The consent form library https://developers.google.com/admob/android/privacy?consent=legacy#google_rendered_consent_form  requires proper call back which can be used to detect if paid version should be used instead.

[Mobile Ads SDK Forum Advisor]

Hello,

Thank you for reaching out to us.

The ConsentInformation.ConsentStatus (https://developers.google.com/admob/android/privacy/api/reference/com/google/android/ump/ConsentInformation.ConsentStatus) only checks if user consent not required, user consent obtained, user consent required but not yet obtained, or consent status is unknown. The 'Do not consent' or if a user disabled all necessary permissions option will still be counted as consent obtained. Personalized vs non-personalized will be handled by the TC string.

You can read more information about the TC string and Consent policies in this document: https://support.google.com/admob/answer/9760862.

If the user's consent does not allow ad serving based the consent settings as mentioned in the previous document, you may limit your app's functionality until the user has consented to the criteria for Personalized or Non-Personalized Ads.

Feel free to reach out back to us if you have any further concerns or inquiries.
 

This message is in relation to case "ref:_00D1U1174p._5004Q2mrrli:ref"

Thanks,
 

Mobile Ads SDK Team

[Test Dvd]

Hello, if the user does not give their consent to display ads, can you prevent them from entering the application?

If the answer is yes, how can this be done?

Thank you.

[James N]

I found a link to this GitHub page for "detecting insufficient consent" and "detecting outdated consent". Does the Google team plan on adding support for that to UPM SDK? Or will we have to manually get the TC strings like that example? Although that example is helpful, it would be much better to have that built into the UPM SDK.

Also, I'm wanting clarification as well on the previous questions. It sounds like if a user doesn't consent to Personalized or Non-Personalized Ads we don't have to allow them to use the rest of our app, right?

If so, I'm wondering what that flow will look like because right now it seems pretty unintuitive. E.g. If they start the game/app the UMP dialog will show. Then if they click "Manage Options" and then "Confirm choices", the dialog will close. Then in my code, I will check the TC string to see if they consented to display personal (or non-personalized) ads. And because they didn't, I will then show a popup saying that to play the game they must consent (to keep the game/app free), so I will then again show the UMP dialog for them to consent to, which if they do, they can then play the game.

Is my understanding correct? Because if so, that seems like an unnecessary loop. And the much simpler way is to just have a popup at the start of the screen for the user to consent to the GDPR/privacy policy, and then when they do, they can continue. (Which is how most game/app companies currently do it).

[Test Dvd]

Hello James,

What you say makes perfect sense.

The option, I think, would be that if the user does not accept either personalized ads or non-personalized ads, a pop-up message appears saying that the application is to be closed.

And if you want to start it again, the ump message will come out again.

[ABQ App Source]

As it is currently implemented, this is forcing app developers to be the "bad guys" to pester users until they just click "Consent to All". I do wonder if this is an intentional choice on Google's part to drive a higher rate of tracking consent... Even a well-intentioned user trying to consent to ads without tracking will find it difficult to actually select the right combination (Purpose 1 AND pick Google from the giant non-alphabetical list). I wrote the StackOverflow posts on how to query the TCF strings, but it still leaves app developers with having to implement a terrible user experience

https://stackoverflow.com/questions/69307205/mandatory-consent-for-admob-user-messaging-platform/70324431#70324431

https://stackoverflow.com/questions/65351543/how-to-implement-ump-sdk-correctly-for-eu-consent/68310602#68310602

My example from the other thread:

To help explain the core issue, consider the following scenario:

  1. App User Joe is shown the CMP dialog and would like to use the app for free, but with less tracking, so he goes to the Manage Options screen and enables the "Basic Ads" permission
  2. He clicks Submit, and the app queries the TCFv2 strings and says "Sorry, you haven't given enough permission to show ads so the app will be in demo mode" because he didn't know he needs to pick Google from the vendor list.
  3. App User Joe goes back to the CMP dialog (and all his prior selections are now erased) and picks "Basic Ads" and "Store data on Device" and clicks Submit - same response, no ads can be shown so the app is in demo mode (because he didn't also select Google on the third screen)
 
What do you expect App User Joe to do here? Keep trying combinations until he gets the right one? Give up and click "Consent to All"?

[James N]

The ATT popup for iOS is the perfect example of how to keep things simple, respect user privacy, and still allow ads to be shown. Most users when they open up a new game/app they don't want to scroll through all these privacy settings just to have non-personalized ads. Having a simple popup with 2 options - "personalized ads" or "non-personalized ads" makes so much more sense.

[Test Dvd]

Exactly James, it is as you explain it.

But rest assured that Google is not going to do it like that.

If nothing has changed in 3 years...

[James N]

Crazy. Well hopefully things do change, but for now, I think I have enough information on how to approach this. Albeit a terrible user experience. And thanks for the links ABQ App Source, I'll check those out.

[HoldToRun]

Hello,

Thank you all for this https://stackoverflow.com/questions/69307205/mandatory-consent-for-admob-user-messaging-platform/70324431#70324431

The custom TCF string functions indeed does detect if user has denied all consent and is at GDPR geography area. Below what I logged with these after denying all consent related permits:

LOGGER --> consentTracker GDPR: true, PersonalisedAds: false, Ads: false

With this it is possible to take further actions. I hope Google does not tragically change the TCF strings which would totally mess this up... Even better as everyone clearly stated this should have been built in already in the google SDK itself! Seems rather intentional from google.

[Mobile Ads SDK Forum Advisor]

Hi All,

Thank you for your response.

I've seen that most of you are already chime in on this forum thread (https://groups.google.com/g/google-admob-ads-sdk/c/InmLIbFm8Xg/m/Q-xaCrR2AgAJ?utm_medium=email&utm_source=footer) where we already shared to the wider team and in which they are now handling it. In that thread, our team mentioned that, this recent update (https://blog.google/products/ads-commerce/new-cmp-requirement/) says, "Later this year, we will require all partners using our publisher products — Google AdSense, Ad Manager, or AdMob — to use a Google certified CMP that integrates with the TCF when serving ads to users in the European Economic Area or the UK."

As for your choice of CMP, it is not a requirement to use the UMP SDK as a means to gather consent. You are free to use another Google certified consent management platform. However, you will be required to use a CMP starting later this year. Since in the blog post with regard to the new CMP, mentioned that with CMP that integrates with the TCF when serving ads to users, you may use and create your functionality with the use of TCF string functions (https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20-%20CMP%20API%20v2.md#in-app-details) to detect the consent.

If you have any other concerns for the consent, we suggest that you continue the conversation on the forum thread (https://groups.google.com/g/google-admob-ads-sdk/c/InmLIbFm8Xg/m/Q-xaCrR2AgAJ?utm_medium=email&utm_source=footer) as it was being handled by our wider team.

[MSMS]

If we close our apps due to insufficient consent i.e. we disable the app unless we can show ads, won't we just get 1000s of 1 star reviews?

[MSMS]

This looks like an interesting alternative:

https://appodeal.com/blog/sdk-2-7-consent-manager-gdpr-ccpa/

[Test Dvd]

Hello MSMS,

With this sdk, non-personalized ads appear if the user DOES NOT ACCEPT the consent?

[MSMS]

I decided to use Google UMP. I detect if they did not consent and reduce the functionality. I also put a cyan background where the ad would have been.

[Mobile Ads SDK Forum Advisor]

Hi MSMS,

We're glad to know that you're now using UMP SDK. Kindly note, that you should request an update of the user's consent information at every app launch, using requestConsentInfoUpdate()(https://developers.google.com/admob/ump/android/api/reference/com/google/android/ump/ConsentInformation#public-abstract-void-requestconsentinfoupdate-activity-activity,-consentrequestparameters-consentrequestparameters,-consentinformation.onconsentinfoupdatesuccesslistener-successlistener,-consentinformation.onconsentinfoupdatefailurelistener-failurelistener) before loading a form. This can determine whether or not your user needs to provide consent if they hadn't done so already or if their consent has expired. If you encounter any errors in the implementation side, kindly let us know and we are going to assist you. 

[Hezi medina]

" that you should request an update of the user's consent information at every app launch"

here write " It is recommended that you request an update of the consent information at every app launch"
https://developers.google.com/admob/flutter/eu-consent

So its MUST or RECOMMENDED?

[Mobile Ads SDK Forum Advisor]

Hello Hezi,

To clarify, each developer might have a different implementation when updating the consent information. Hence, we only recommend this at every app launch. However, the developer must update consent information when implementing UMP SDK.

Feel free to reach back to us if you have any further concerns or inquiries.