<br />

Under the Google [EU User Consent
Policy](https://www.google.com/about/company/user-consent-policy/), you must
make certain disclosures to your users in the European Economic Area (EEA),
the United Kingdom (UK), and Switzerland, and obtain their consent to use
cookies or other local storage, where legally required, and to use personal
data (such as AdID) to serve ads.

This policy reflects the requirements of the EU ePrivacy Directive and the
General Data Protection Regulation (GDPR).

This guide outlines the steps required to support the GDPR IAB TCF v2 message as
part of the UMP SDK. It is intended to be paired with [Get
started](https://developers.google.com/admob/android/next-gen/privacy) which gives an overview of how to get your app
running with the UMP SDK and the basics of setting up your message. The
following guidance is specific to the GDPR IAB TCF v2 message. For more
information, see

[How IAB requirements affect EU consent messages](https://support.google.com/admob/answer/10207733).


## Prerequisites

- [Set up UMP SDK](https://developers.google.com/admob/android/next-gen/privacy.md.txt).
- Create a [European regulation message for apps](https://support.google.com/admob/answer/10113207).

## Consent revocation

GDPR requires

[consent revocation](https://support.google.com/admob/answer/10113915)

to allow users to withdraw their consent choices at any time. See
[Privacy options](https://developers.google.com/admob/android/next-gen/privacy.md.txt#privacy_options)
to implement a way for users to withdraw their consent choices.

## Tag for under age of consent

To indicate whether a user is under the age of consent, set
`

setTagForUnderAgeOfConsent` (TFUA). When you set TFUA to `true`, the UMP SDK
doesn't request consent from the user. If your app has a mixed audience, set
this parameter for child users to ensure consent is not requested.

> [!IMPORTANT]
> **Important:** The UMP SDK does not forward the TFUA tag set on consent requests to GMA Next-Gen SDK. You must explicitly set `ageRestrictedTreatment` on ad requests. If you don't set `ageRestrictedTreatment` on ad requests, the UMP SDK does not collect any information that allows Google to determine whether or not users under the age of consent use your app. For more information about data processing restrictions for these users, see [Tag an ad request for EEA, the UK, and Switzerland users for restricted data
> processing](https://support.google.com/admob/answer/9009425).

The following example sets TFUA to true on a UMP consent request:

### Java

```java
ConsentRequestParameters params = new ConsentRequestParameters
    .Builder()
    // Indicate the user is under age of consent.
.setTagForUnderAgeOfConsent(true)
    .build();

consentInformation = UserMessagingPlatform.getConsentInformation(this);
consentInformation.requestConsentInfoUpdate(
    this,
    params,
    (OnConsentInfoUpdateSuccessListener) () -> {
      // ...
    },
    (OnConsentInfoUpdateFailureListener) requestConsentError -> {
      // ...
    });
```

### Kotlin

```kotlin
val params = ConsentRequestParameters
    .Builder()
    // Indicate the user is under age of consent.
.setTagForUnderAgeOfConsent(true)
    .build()

consentInformation = UserMessagingPlatform.getConsentInformation(this)
consentInformation.requestConsentInfoUpdate(
    this,
    params,
    ConsentInformation.OnConsentInfoUpdateSuccessListener {
      // ...
    },
    ConsentInformation.OnConsentInfoUpdateFailureListener {
      requestConsentError ->
      // ...
    })
```

## Set up consent in AdMob Mediation

To set up consent in AdMob Mediation, complete the steps in the following
sections.

### Add ad partners to GDPR messages

Follow the steps in

[Add ad partners to published GDPR
messages](https://support.google.com/admob/answer/10113004#adding_ad_partners_to_published_gdpr_messages)

to add your mediation partners to the ad partners list. Failure to do so can
lead to partners failing to serve ads on your app.

The following table lists the ad tech partner name for each ad source:

| Ad source | Ad tech partner name |
|---|---|
| AppLovin | AppLovin Corp. |
| BidMachine | BidMachine |
| BIGO Ads SDK | Empathy Technology Pte.Ltd. (BIGO Ads) |
| Chartboost | Chartboost |
| DT Exchange | DT Exchange (Fyber Monetization) |
| i-mobile | i-mobile |
| InMobi | InMobi |
| ironSource Ads | ironSource Mobile |
| Liftoff Monetize | Liftoff |
| LY Ads Network | LY Ads Network |
| maio | maio |
| Meta Audience Network | Meta |
| Mintegral | Mobvista/Mintegral |
| Moloco Ads SDK | Moloco Ads |
| myTarget | Mail.ru |
| Pangle | Pangle DSP |
| PubMatic OpenWrap SDK | PubMatic |
| Unity Ads | Unity Ads |
| Verve HyBid SDK | Verve Group |

### Forward consent to ad sources

The following table shows which ad sources support passing GDPR consent
signals from consent management platforms that integrate with IAB's Transparency
and Consent Framework (TCF) and

[Google's Additional Consent specification](https://support.google.com/admob/answer/9681920)

to the SDK of the ad sources:

| Ad source | Minimum supported version |
|---|---|
| AppLovin | 12.0.0.0 |
| BidMachine | 3.3.0.0 |
| BIGO Ads SDK | 5.5.2.0 |
| Chartboost | 9.13.0.0 |
| DT Exchange | 8.3.0.0 |
| i-mobile | N/A[^1^](https://developers.google.com/admob/android/next-gen/privacy/gdpr.md.txt#eea-traffic-footnote) |
| InMobi | 10.7.5.0 |
| ironSource Ads | 7.7.0.0 |
| Liftoff Monetize | 7.4.1.0 |
| LY Ads Network | N/A[^1^](https://developers.google.com/admob/android/next-gen/privacy/gdpr.md.txt#eea-traffic-footnote) |
| maio | N/A[^1^](https://developers.google.com/admob/android/next-gen/privacy/gdpr.md.txt#eea-traffic-footnote) |
| Meta Audience Network | N/A[^2^](https://developers.google.com/admob/android/next-gen/privacy/gdpr.md.txt#meta-consent-footnote) |
| Mintegral | 17.1.61.1 |
| Moloco Ads SDK | 3.5.0.0 |
| myTarget | 5.51.2.0 |
| Pangle | 7.9.0.9.0 |
| PubMatic OpenWrap SDK | 4.7.0.0 |
| Unity Ads | 4.19.0.1 |
| Verve HyBid SDK | 3.7.1.0 |

^1^
Ad source doesn't serve EEA traffic.

^2^
For details, reach out to your
Meta
partner manager.

## How to read consent choices

After GDPR consent has been collected, you can read consent choices from local
storage following the
[TCF v2 spec](https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20-%20CMP%20API%20v2.md#in-app-details).
The `IABTCF_PurposeConsents` key indicates consent for each of the
[TCF purposes](https://iabeurope.eu/iab-europe-transparency-consent-framework-policies/#A_Purposes).

The following code snippet shows how to check consent for Purpose 1:

### Java

```java
SharedPreferences sharedPref = PreferenceManager.getDefaultSharedPreferences(context);
// Example value: "1111111111"
String purposeConsents = sharedPref.getString("IABTCF_PurposeConsents", "");
// Purposes are zero-indexed. Index 0 contains information about Purpose 1.
if (!purposeConsents.isEmpty()) {
  String purposeOneString = purposeConsents.charAt(0).toString();
  boolean hasConsentForPurposeOne = purposeOneString.equals("1");
}
```

### Kotlin

```kotlin
val sharedPref = PreferenceManager.getDefaultSharedPreferences(context)
// Example value: "1111111111"
val purposeConsents = sharedPref.getString("IABTCF_PurposeConsents", "")
// Purposes are zero-indexed. Index 0 contains information about Purpose 1.
if (purposeConsents?.isEmpty() == false) {
  val purposeOneString = purposeConsents.first().toString()
  val hasConsentForPurposeOne = purposeOneString == "1"
}
```

<br />

## Frequently asked questions

> [!IMPORTANT]
> **Key Point:** See [European regulations message FAQs](https://support.google.com/admob/answer/10113207) for additional frequently asked questions.

What happens if I take no action to meet the [Consent Management Platform Requirements for serving ads in the EEA, the UK, and Switzerland](https://support.google.com/admob/answer/13554116)?

:   Beginning January 16, 2024, if a partner doesn't adopt a

    [Google-certified CMP](https://support.google.com/admob/answer/13554116#zippy=%2Cgoogle-certified-cmps),

    only

    [Limited Ads](https://support.google.com/admob/answer/10105530)

    will be eligible to serve on EEA and UK traffic.

    Enforcement will begin January 16, 2024 on a small percentage of EEA and UK
    traffic and will ramp up until Google enforces across all EEA and UK traffic
    by the end of February 2024. Have a certified CMP in place by January 16,
    2024 to ensure your monetization is not impacted.

How can I check if the user consented?

:   Consent is not represented by a single bit, but rather a set of purposes and
    vendors as defined in the [IAB TCF specification](https://iabeurope.eu/transparency-consent-framework/). See

    [Consent Policies: Personalized \& Non-Personalized Ads](https://support.google.com/admob/answer/9760862#consent-policies)

    for Google Ads personalization criteria.

    Additionally, ad techs on Google's

    [Ad technology providers](https://support.google.com/admob/answer/9012903)

    (ATP) list that are not registered in the
    [TCF vendor list](https://iabeurope.eu/vendor-list-tcf/) use

    [Google's Additional Consent technical specification](https://support.google.com/admob/answer/9681920)

    for consent collection. Google
    publishes the list of ad technology providers not registered with the IAB
    and their IDs at the following location:
    <https://storage.googleapis.com/tcfac/additional-consent-providers.csv>.

    To debug an individual ad request, use the
    [Troubleshoot privacy settings](https://developers.google.com/admob/android/next-gen/ad-inspector/troubleshoot-privacy-settings.md.txt)
    feature in ad inspector to view the following privacy signals passed in the
    ad request as part of
    [Publisher integration with the IAB Europe TCF](https://support.google.com/admob/answer/9760862):

    | Ad inspector label | Ad request query parameter | Meaning |
    |---|---|---|
    | GDPR applies (IABTCF_gdprApplies) | `gdpr` | Whether GDPR applies for this ad request. |
    | TC string (IABTCF_TCString) | `gdpr_consent` | The TC String. The IAB provides a web tool where you can manually [decode](https://iabtcf.com/#/decode) the value. |
    | AC string (IABTCF_AddtlConsent) | `addtl_consent` | The AC string from [Google's Additional Consent technical specification](https://support.google.com/admob/answer/9681920). |

    To read consent choices programmatically, see

    [How to read consent choices](https://developers.google.com/admob/android/next-gen/privacy/gdpr.md.txt#how_to_read_consent_choices)

    for more information.

Do I need to use Google's UMP SDK to meet the CMP requirement?

:   No, you can use any CMP from the

    [List of Google-certified CMP](https://support.google.com/admob/answer/13554116#zippy=%2Cgoogle-certified-cmps)

    to serve ads.

How can I show the consent form again using the UMP SDK even if the user has already consented?

:   If a user has already made a consent decision, Google's consent management
    solution won't request to gather new consent until the TC string is expired
    or otherwise becomes invalid.

    GDPR requires consent modification to allow users to withdraw their consent
    choices at any time. See
    [privacy options](https://developers.google.com/admob/android/next-gen/privacy.md.txt#privacy_options) to
    implement a way for users to withdraw their consent choices. To show a
    consent form again, call `
    showPrivacyOptionsForm()`.

I integrated a Google-certified CMP, but I'm not seeing any ad requests get made to mediation partners even from users who consented. Why is this happening?

:   Under TCF, Google checks that ad technology providers and other programmatic
    demand sources don't violate Google policy and have at least one legal basis
    for processing data prior to including them in the mediation waterfall.
    Navigate to the

    [mediation](https://support.google.com/admob/answer/10105530)

    section for more information.

    Some mediation partners in

    [Google's Ad Tech Providers (ATP) list](https://support.google.com/admob/answer/9012903)

    are not registered in the [TCF vendor list](https://iabeurope.eu/vendor-list-tcf/).
    These partners instead use

    [Google's Additional Consent technical specification](https://support.google.com/admob/answer/9681920)

    for consent collection. Google publishes the list of ad technology providers
    not registered with the IAB and their IDs at the following location:
    <https://storage.googleapis.com/tcfac/additional-consent-providers.csv>

    The UMP SDK supports storing the ACString, enabling you to

    [Add ad partners to published GDPR messages](https://support.google.com/admob/answer/10113004#adding_ad_partners_to_published_gdpr_messages)

    without needing to understand whether partners are TCF-registered. When using
    a third-party CMP, you should do the following:

    1. Confirm that the third-party CMP supports storing the ACString.
    2. Include each mediation partner in the list of ad technology providers that the third-party CMP uses to gather consent.

Can I change how my app functions if users don't consent? Is this allowed by policy?

:   Publishers can read the IAB TCF string in their apps. See

    [How to read consent choices](https://developers.google.com/admob/android/next-gen/privacy/gdpr.md.txt#how_to_read_consent_choices)

    for information on reading consent choices programmatically. Publishers
    should review their obligations under relevant regulations with legal
    counsel.

When I select **Manage Options** and consent to all purposes, I'm not seeing any ads? Why is this happening?

:   In addition to collecting purposes consent you also need to collect vendor
    consent. Both purposes consent and vendor consent are required for any
    vendor, such as Google, to serve appropriate ads.


How do I implement the AC String version 2 for users who already consented to version 1?

:   Check the `IABTCF_AddtlConsent` key in local storage per

    [Google's Additional Consent technical specification](https://support.google.com/admob/answer/9681920)

    to determine whether a user has consented to AC String version 2 and if you
    need to show the consent form again.

    ### Java

    ```java
    SharedPreferences sharedPref = PreferenceManager.getDefaultSharedPreferences(context);
    // Example value: "2~1.35.41.101~dv.9.21.81"
    String additionalConsent = sharedPref.getString("IABTCF_AddtlConsent", "");
    // Index 0 contains information about the specification version number.
    if (!additionalConsent.isEmpty()) {
      String specACVersion = additionalConsent.charAt(0);
      boolean isACVersion2 = purposeOneString.equals("2");
    }
    ```

    ### Kotlin

    ```kotlin
    val sharedPref = PreferenceManager.getDefaultSharedPreferences(context)
    // Example value: "2~1.35.41.101~dv.9.21.81"
    val additionalConsent = sharedPref.getString("IABTCF_AddtlConsent", "")
    // Index 0 contains information about the specification version number.
    if (!additionalConsent.isEmpty()) {
      val specACVersion = additionalConsent.first()
      val isACVersion2 = specACVersion == "2"
    }
    ```