Requesting Consent from European Users

Prerequisites

Complete Get Started with version 1.3.0 of the GMA Flutter plugin, which supports the User Messaging Platform SDK.

Read How IAB requirements affect EU consent messages.

Introduction

The UMP SDK provides tools for publishers to request consent for personalized ads as well as to handle Apple's App Tracking Transparency (ATT) requirements. Publishers can use the UMP SDK to handle either or both of these requests by showing a single form, as all of the configuration happens in AdMob Privacy & messaging.

Under the Google EU User Consent Policy, you must make certain disclosures to your users in the European Economic Area (EEA) along with the UK and obtain their consent to use cookies or other local storage, where legally required, and to use personal data (such as AdID) to serve ads. This policy reflects the requirements of the EU ePrivacy Directive and the General Data Protection Regulation (GDPR).

To support publishers in meeting their duties under this policy, Google offers the User Messaging Platform (UMP) SDK. The UMP SDK has been updated to support the latest IAB standards. We've also simplified the process of setting up consent forms and listing ad partners. All of these configurations can now conveniently be handled in AdMob Privacy & messaging.

This guide walks you through how to install the SDK, implement the IAB solutions, and enable testing features.

App Tracking Transparency (iOS only)

If you plan to use the UMP SDK to handle Apple's App Tracking Transparency requirements, ensure you've created, configured, and published your ATT message using AdMob Privacy & messaging.

In order for the UMP SDK to display a custom alert message, update your Info.plist to add the NSUserTrackingUsageDescription key with a custom message string describing your usage.

<key>NSUserTrackingUsageDescription</key>
<string>This identifier will be used to deliver personalized ads to you.</string>

The usage description appears as part of the ATT dialog when you present the consent form:

Next, you'll need to link the AppTrackingTransparency framework:

While testing, remember that per Apple's requirements, the IDFA ATT dialog will only appear a single time since requestTrackingAuthorization: is a one-time request. To make the alert appear a second time, you must uninstall and reinstall your app on your test device.

Using the SDK

The SDK is designed to be used in a linear fashion. The steps for using the SDK are:

1. Request the latest consent information.
2. Check if consent is required.
3. Check if a form is available and if so load a form.
4. Present the form.
5. Provide a way for users to change their consent.

Request the latest consent information

It is recommended that you request an update of the consent information at every app launch. This will determine whether or not your user needs to provide consent.

final params = ConsentRequestParameters();
ConsentInformation.instance.requestConsentInfoUpdate(
  params,
  () async {
    // The consent information state was updated.
    // You are now ready to check if a form is available.
  },
  (FormError error) {
    // Handle the error
  },
);

Load a form if available

The forms for obtaining consent are created in AdMob UI. Once you have determined that you will ask a user for consent, the next step is to determine if a form is available. There are a variety of reasons why a form may not be available, such as:

• The user has limit ad tracking enabled.
• You tagged the user as under the age of consent.

To check if a form is available, use the isConsentFormAvailable() method on the ConsentInformation instance. Add a wrapper method for loading a form:

final params = ConsentRequestParameters();
ConsentInformation.instance.requestConsentInfoUpdate(
  params,
  () async {
    if (await ConsentInformation.instance.isConsentFormAvailable()) {
      loadForm();
    }
  },
  (FormError error) {
    // Handle the error
  },
);

To load the form you will use the static loadConsentForm() method on the ConsentForm class. Alter your loadForm() method like so:

void loadForm() {
  ConsentForm.loadConsentForm(
    (ConsentForm consentForm) async {
      // Present the form
    },
    (FormError formError) {
      // Handle the error
    },
  );
}

Present the form if required

Note: For iOS, if you have created an ATT message for each of your apps in the AdMob UI, users will be prompted to provide ATT consent as part of the form presentation flow. No additional API calls are required.

To present the consent form, use the show() method on the ConsentForm class. You must determine if the user requires consent prior to presenting the form. To check if consent is required, call getConsentStatus() on the ConsentInformation object, which returns an enum of type ConsentStatus. There are four possible values for ConsentStatus:

• unknown: Unknown consent status.
• required: User consent required but not yet obtained.
• notRequired: User consent not required. For example, the user is not in the EEA or UK.
• obtained: User consent obtained. Personalization not defined.

Alter your loadForm method like so:

void loadForm() {
  ConsentForm.loadConsentForm(
    (ConsentForm consentForm) async {
      var status = await ConsentInformation.instance.getConsentStatus();
      if (status == ConsentStatus.required) {
        consentForm.show(
          (FormError formError) {
            // Handle dismissal by reloading form
            loadForm();
          },
        );
      }
    },
    (formError) {
      // Handle the error
    },
  );
}

If consent is not required, you can maintain a reference to the form so that your user can change their consent status.

Testing

Force a geography

The UMP SDK provides a way to test your app's behavior as though the device was located in the EEA using ConsentDebugSettings.debugGeography.

You will need to provide your test device's hashed ID in your app's debug settings to use the debug functionality. If you call requestConsentInfoUpdate() without setting this value, your app will log the required ID hash when run.

ConsentDebugSettings debugSettings = ConsentDebugSettings(
  debugGeography: DebugGeography.debugGeographyEea,
  testIdentifiers: ['TEST-DEVICE-HASHED-ID']);

ConsentRequestParameters params = ConsentRequestParameters(
  consentDebugSettings: debugSettings);

ConsentInformation.instance.requestConsentInfoUpdate(
  params,
  () {},
  (error) {});

To force the SDK to treat the device as though it is not in the EEA or the UK, use DebugGeography.debugGeographyNotEea. Note that debug settings only work on test devices. Emulators do not need to be added to the device ID list as they have testing enabled by default.

Reset consent state

In testing your app with the UMP SDK, you may find it helpful to reset the state of the SDK so that you can simulate a user's first install experience. The SDK provides the reset method to do this.

ConsentInformation.instance.reset();

Key Point: On iOS, resetting the UMP SDK does not reset the app's ATTrackingManager.AuthorizationStatus. To make the ATT dialog appear a second time, you must uninstall and reinstall your app on your test device.

You should also call reset if you decide to remove the UMP SDK completely from your project.

Delay app measurement (optional)

By default, the Google Mobile Ads SDK initializes app measurement and begins sending user-level event data to Google immediately when the app starts. This initialization behavior ensures you can enable AdMob user metrics without making additional code changes.

However, if your app requires user consent before these events can be sent, you can delay app measurement until you explicitly initialize the Mobile Ads SDK or load an ad.

To delay app measurement for Android add the following <meta-data> tag in your AndroidManifest.xml.

<manifest>
     <application>
        <!-- Delay app measurement until MobileAds.initialize() is called. -->
        <meta-data
            android:name="com.google.android.gms.ads.DELAY_APP_MEASUREMENT_INIT"
            android:value="true"/>
    </application>
</manifest>

To delay app measurement on iOS, add the GADDelayAppMeasurementInit key with a boolean value of YES to your app’s Info.plist. You can make this change programmatically:

<key>GADDelayAppMeasurementInit</key>
<true/>

Or, edit it in the property list editor:

Mediation

If you use mediation, you will need to handle consent for your mediation partners differently based on the consent framework you choose to use on your app. Google supports the IAB Consent Framework but also allows you to have your own custom consent solution. Below are the details about how to handle mediation under each of these options. Learn more about our consent solution.

Important: Regardless of what consent framework you choose, we recommend adding your mediation partners to published GDPR messages in the AdMob UI.

IAB Consent Framework and mediation

Neither the UMP SDK nor the Mobile Ads SDK forwards consent information to mediation partners. Rather, when using the IAB solution, the UMP SDK writes consent status information to local storage and it is the responsibility of each mediation partner's SDK to read the appropriate keys. Be sure to check with each third-party network to determine if they support the IAB solution.

Important: When using the IAB Consent Framework, the Mobile Ads SDK blocks mediation callouts to any mediation partner who has been declined by the end user.

Custom consent solutions and mediation

If using a custom consent solution, it is your responsibility to notify third-party SDKs of your app's consent status. Each mediation network has its own APIs for handling consent, which are documented for Android and iOS.

See Using Network Specific APIs to learn how to call these APIs from Dart.

Important: As it is your responsibility to manage consent for mediation partners when using a custom consent solution, the Mobile Ads SDK will not block mediation partner callouts

Forward consent to the Google Mobile Ads SDK

The default behavior of the Google Mobile Ads SDK is to serve personalized ads. If a user has consented to receive only non-personalized ads, you can configure an AdRequest object with the following code to specify that only non-personalized ads should be requested:

final AdRequest = AdRequest(nonPersonalizedAds: true);

Note: Google's EU User Consent Policy requires that you collect consent for the full list of ad technology providers configured for your publisher IDs before displaying personalized ads, even if you are using a third-party mediation solution to send ad request to Google.

If non-personalized ads are requested, the ad request URL currently includes &npa=1. However, note that this is an internal implementation detail of the Google Mobile Ads SDK and is subject to change.