About ios GDPR

[Hezi medina]

Hi, 

I see the next: discussion

https://groups.google.com/g/google-admob-ads-sdk/c/4KDuVxIhmE0/m/-uvtg3ayAgAJ

Today its the steps on my app IOS

1. ATT > accept > GDPR > accept > show ads --- its okay

2. ATT > not accept > GDPR MESSAGE > don't show..

The option 2 its okay? I understand with this way its collect cookies? and its not okay for admob ?

" Under Google’s EU User Consent Policy, you must make certain disclosures to your users in the European Economic Area (EEA) and the UK, and obtain their consent for the use of cookies or other local storage where legally required and for the collection, sharing, and use of personal data for ads personalization. This policy reflects the requirements of the EU ePrivacy Directive and the General Data Protection Regulation (GDPR)."

https://support.google.com/admob/answer/10114014

please your update

[Test Dvd]

In that post it says that if the user does not accept the consent, they should no longer show the att.

Is it possible to show the att before the gpdr ? Is it legal for admob and apple?

[Mobile Ads SDK Forum Advisor]

Hi,

Thank you for reaching out to us.

With regard to your question, the Option 2 is okay but not recommended, as if a user chooses to "Not Allow Tracking" in the App Tracking Transparency (ATT) dialog, you are not allowed to show them personalized ads. This is because personalized ads are based on the user's tracking data, which they have chosen not to share. If a user chooses "Not Allow Tracking" in ATT, you must display a GDPR consent form to them. This form must explain how you will use their data, and it must give them the option to consent to personalized ads. If the user does not consent to personalized ads, you must not show them any ads. If you show ads to a user who has chosen "Not Allow Tracking" in ATT, without first displaying a GDPR consent form, you are in violation of Google's EU User Consent Policy. This could result in your app being rejected from the App Store or Google Play. In addition to that, if a user chooses "Not Allow Tracking" in ATT, you can only show them non-personalized ads. If you want to show them personalized ads, they must first consent to the use of their data. 

This message is in relation to case "ref:_00D1U1174p._5004Q2n8zjA:ref"

Thanks,
 

Mobile Ads SDK Team

[Hezi medina]

"If a user chooses "Not Allow Tracking" in ATT, you must display a GDPR consent form to them" 

its not possible see the next:

Guideline 5.1.1 - Legal - Privacy - Data Collection and Storage

We noticed your app includes a GDPR prompt and an App Tracking Transparency permission request, but they are implemented in a way that might confuse the user.

specifically, your app shows the App Tracking Transparency permission request after the user has already requested you not to track on the GDPR prompt.

In addition to App Tracking Transparency, it is important to include all disclosures required by local laws and regulations wherever your app is distributed. These disclosures should be implemented in a way that is clear and respects the user's choices, regardless of the order in which they are presented to the user.

Next Steps

If the user denies permission to track once, do not ask them to allow tracking again within the same permission request flow. There should be no tracking activity until the user grants permission to track.

If your app shows the GDPR prompt before showing the App Tracking Transparency permission request, there is no need to modify the wording of the GDPR prompt

Source: https://groups.google.com/g/google-admob-ads-sdk/c/4KDuVxIhmE0/m/-uvtg3ayAgAJ

"If you show ads to a user who has chosen "Not Allow Tracking" in ATT, without first displaying a GDPR consent form, you are in violation of Google's EU User Consent Policy."

So i understand the correct way

1. MESSAGE GDPR > approve >  IDFA > 

2. MESSAGE GDPR > not approve > dont show the message  IDFA 

RIGHT?

If yes how can I implement this way in the application? in order to be able to guide the programmer to do so

[Mobile Ads SDK Forum Advisor]

Hi Hezi,

Thank you for your response.

You can use the User Messaging Platform (UMP) (https://developers.google.com/admob/ios/privacy) SDK to trigger an IDFA explainer (https://developers.google.com/admob/ios/privacy#app_tracking_transparency) that gives users some context of why you're asking for this permission. Be aware that the usage of the UMP SDK affects all users of your app, then show the ATT (https://developers.google.com/admob/ios/ios14#request). Kindly note that, if user does not consent, then its either non-personalized ads or no ads will return in your app. 

[cuti...@gmail.com]

Our app was rejected with the same reason today. We have integrated latest UMP SDK with GDPR and IDFA/ATT explainer enabled in Admob UI. Our code was simple and followed the Admob Doc.

```

[UMPConsentInformation.sharedInstance
          requestConsentInfoUpdateWithParameters:parameters
              completionHandler:^(NSError *_Nullable requestConsentError) {
                if (requestConsentError) {
                  // Consent gathering failed.
                  NSLog(@"UMP Error: %@", requestConsentError.localizedDescription);
                  return;
                }

         
          NSLog(@"UMP load and present");
                [UMPConsentForm loadAndPresentIfRequiredFromViewController:[UIApplication sharedApplication].keyWindow.rootViewController
                    completionHandler:^(NSError *loadAndPresentError) {
                      if (loadAndPresentError) {
                        // Consent gathering failed.
                        NSLog(@"UMP Error: %@", loadAndPresentError.localizedDescription);
                        return;
                      }

                    NSLog(@"UMP DONE");
                      if (UMPConsentInformation.sharedInstance.canRequestAds) {
                          [[AdManager getInstance] initSdk];
                      }
                    }];
              }];

      // Check if you can initialize the Google Mobile Ads SDK in parallel
      // while checking for new consent information. Consent obtained in
      // the previous session can be used to request ads.
      if (UMPConsentInformation.sharedInstance.canRequestAds) {
          [[AdManager getInstance] initSdk];
      }

```

AFAIK, the flow was controlled by UMP SDK and we have no way to control that. How can we solve this issues? Thanks.

[Mobile Ads SDK Forum Advisor]

Hi,

Thank you for contacting the Mobile Ads SDK Support team.

The code that you have sent is correct. You should request an update of the user's consent information at every app launch, using requestConsentInfoUpdateWithParameters:completionHandler:. 

Make sure to update your Info.plist to add the NSUserTrackingUsageDescription key with a custom message describing your usage. For Ex:
<key>NSUserTrackingUsageDescription</key>
<string>This identifier will be used to deliver personalized ads to you.</string>

If you decide to include App Tracking Transparency(ATT) in your app, you can use the User Messaging Platform (UMP) SDK to trigger an IDFA explainer that gives users some context of why you're asking for this permission. Be aware that the usage of the UMP SDK affects all users of your app. If you aren't using the UMP SDK, the Request App Tracking Transparency authorization shows you how to implement the OS-level ATT authorization request manually. Also, refer to privacy strategies for iOS to decide whether Apple's ATT prompt is right for your app. 

This message is in relation to case "ref:!00D1U01174p.!5004Q02n8zjA:ref" (ADR-00188948)

Thanks,
 

Mobile Ads SDK Team

[cuti...@gmail.com]

Hi,

Thanks for your reply and let me know that it is the correct implementation.

We run the above code every time at app launch and have include ATT in our app and use UMP SDK to trigger IDFA explainer. However, we received this message from AppStore review and rejected our update.

```

Guideline 5.1.1 - Legal - Privacy - Data Collection and Storage

The app includes a GDPR prompt and an App Tracking Transparency permission request, but they are implemented in a way that might confuse the user.


Specifically, the app shows a GDPR prompt that asks permission to track after the user has already selected "Ask App Not to Track" on the App Tracking Transparency permission request.

In addition to App Tracking Transparency, it is important to include all disclosures required by local laws and regulations wherever the app is distributed. These disclosures should be implemented in a way that is clear and respects the user's choices, regardless of the order in which they are presented to the user.

Next Steps

If the user denies permission to track once, do not ask them to allow tracking again within the same permission request flow. There should be no tracking activity until the user grants permission to track.

Resources

- Tracking is linking data collected from the app with third-party data for advertising purposes, or sharing the collected data with a data broker. Learn more about tracking.
- See Frequently Asked Questions about the requirements for apps that track users.

```

I thought this was a bug from the SDK? Thanks.

[Mobile Ads SDK Forum Advisor]

Hi,

Thank you for contacting us.

I've raised this issue to the team, please wait for sometime. I will update you once get any update on this. Meanwhile your patience is important.

[cuti...@gmail.com]

Thanks for your help!

[Mobile Ads SDK Forum Advisor]

Hello,

Per which messages your users will see, the App Tracking Transparency prompt is shown after the GDPR prompt if you configure both messages in the AdMob UI and using the UMP SDK. Additionally, in the event there is not consent for purpose 1 in the GDPR prompt, the UMP SDK will not show the ATT prompt.

Can you describe the flow for how your app displayed a GDPR prompt after an ATT prompt?
 

This message is in relation to case "ref:!00D1U01174p.!5004Q02n8zjA:ref" (ADR-00188948)

Thanks,
 

Eric Leichtenschlag Mobile Ads SDK Team