gdpr privacy data-protection
Is Google&#39;s Consent Management Platform not GDPR compliant since it does not show a consent form when &#39;personalised ads&#39; are disabled?
<p><em>This question borders the line between technical and legal but I am posting here because it is not a coding problem in itself. Apologies if this is the wrong forum.</em></p>
<p>I have set up my mobile app to use Google's own Consent Management Platform called User Messaging Platform / UMP (<a href="https://developers.google.com/admob/ump/android/quick-start" rel="nofollow noreferrer">https://developers.google.com/admob/ump/android/quick-start</a>) via Admob to gather consent to show ads. My Admob account is set to show either personalised or non-personalised ads depending on which settings users select in the consent form.</p>
<p>The consent form shows up fine so long as users do not have personalisation disabled in their phone settings / Google account and so long as I haven't disabled personalised ads completely from within the Admob / UMP interface. In this case, users who use the form are able to disable whichever aspects of data processing they want and Google Admob automatically disables elements of ad personalisation accordingly, and completely disables all ads if users do not select the required elements in the consent form.</p>
<p>However, if a user does have personalised ads disabled on their phone / Google settings or if I have disabled all personalised ads from within the Admob / UMP interface, then the consent form is not able to be displayed to users. In this case, users will simply see non-personalised ads in the app without having been presented with a form beforehand. There is no way at all to present a form to users because the request is always unavailable.</p>
<p>It turns out that this is expected behaviour and exactly how the UMP consent form is apparently supposed to function. To demonstrate this, Google displays this message in the Admob interface about their consent platform messages:</p>
<p><a href="https://i.stack.imgur.com/MzSxt.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/MzSxt.png" alt="Google's message" /></a></p>
<p>This is the answer that Google gave <strong>directly</strong> to this question:</p>
<blockquote>
<p>If you have disabled personalized ads then there is no
need to display the consent form. The forms and all consent are only
needed for when you are looking to show personalized ads. So to be
compliant with GDPR you just need to have the ability to call the
consent and if the person has the phone set to show personalized ads,
it will then show them the form.</p>
<p>With the steps that you have mentioned, the behavior looks actually to
be correct, if you have chosen to not show personalized ads, then
there is no need for the forms.</p>
</blockquote>
<p>This appears to me to be <strong>contradictory to the advice that Google themselves display on their site</strong>, which states that <strong>'non-personalised' ads still use cookies and therefore require consent to display</strong>:</p>
<p><a href="https://www.google.com/intl/en_uk/about/company/user-consent-policy-help/" rel="nofollow noreferrer">https://www.google.com/intl/en_uk/about/company/user-consent-policy-help/</a></p>
<blockquote>
<p><strong>What if I’m a publisher serving only non-personalised ads to EEA and
UK users?</strong></p>
<p>If you do not serve personalised ads to users that visit
your site, and visits to your site do not influence the ads served
elsewhere, you are still required to obtain consent for the use of
cookies or mobile identifiers, where legally required. Consent for
cookies or mobile identifiers is still required because
non-personalised ads still use cookies or mobile identifiers to combat
fraud and abuse, for frequency capping and for aggregated ad
reporting.</p>
</blockquote>
<p><a href="https://support.google.com/adsense/answer/9007336?hl=en-GB" rel="nofollow noreferrer">https://support.google.com/adsense/answer/9007336?hl=en-GB</a></p>
<blockquote>
<p><strong>Non-personalised ads (NPA)</strong></p>
<p>Although non-personalised ads don’t use cookies or mobile ad
identifiers for ad targeting, they do still use cookies or mobile ad
identifiers for frequency capping, aggregated ad reporting and to
combat fraud and abuse. Therefore, you must obtain consent to use
cookies or mobile ad identifiers for those purposes where legally
required, per the ePrivacy Directive in certain EEA countries.</p>
</blockquote>
<p>Therefore, I'm completely confused by this. Is this a case of Google's team not understanding their own legal obligations? Should I be wary about releasing my app using Google's UMP which I have already integrated? Or is there a technical detail that I'm not aware of which makes Google's approach GDPR compliant?</p>
<p>For reference, here is Google's AdMob &amp; AdSense program policies Publisher integration with the IAB TCF v2.0:</p>
<p><a href="https://support.google.com/admob/answer/9760862?hl=en&amp;ref_topic=9756841" rel="nofollow noreferrer">https://support.google.com/admob/answer/9760862?hl=en&amp;ref_topic=9756841</a></p>

<p>Obtaining consent for cookies is not required by the GDPR at all. Instead it is covered by the e-privacy directive, which as a directive rather than a regulation, must be implements by specific legislation in each individual country. The exact requirements vary with the law of each country.</p>
<p>An e-privacy <strong>regulation</strong> has been proposed, which would have scope similar to the GDPR, would replace the Directive, and would not require national implementing legislation. However it has not yet been adopted. Proposed versions have significantly different requirements than the current Directive.</p>
<p>Nor does the GDPR require consent for advertising that does not involve the processing of personal information, unlike some other privacy laws such as the California CCPA.</p>
<p>However, if the Google package sets cookies without consent that are not <em><strong>strictly necessary</strong></em> for operation of the web site, it might well fail compliance with some of those national laws implementing e-privacy. Also, even necessary cookies must be disclosed to the user, as I understand it, possibly only in general terms.</p>
<p>Several national Data Protection agencies have said that cookie compliance is not a major priority, at least not until an e-privacy regulation is in place. But that does not mean that lack of compliance is legal.</p>
<p>Unfortunately I see no way for a developer using the Google package to correct this issue  within the package. One would either have to implement a different solution, or trust that Google will fix this before enforcement becomes a serious issue.</p>
<p>However, the app developer <strong>could</strong> add a separate general cookie consent banner, and turn off all adds if consent is not given, I believe.</p>

<p>Note that this is for a 'mobile' app, not a website. So cookies are not relevant and instead the 'Advertising Id' is the relevant piece of data. Device Identifiers are considered to be 'personal data' by the GDPR so it falls under the regulation and consent is required to use them.</p>
<p>However if the usage is only for fraud detection, frequency capping and so on, this could potentially be considered a 'Legitimate Interest' and therefore bypass explicit consent.</p>
