European regulations settings

Sync consent across multiple apps (Beta)

This feature is currently available for European regulations messages only.

Consent syncing enables you to apply user consent decisions across multiple apps within your app portfolio.

With consent syncing, a user can make a consent decision on the European regulations message in one of your apps, and that decision will be applied to your other apps. This can improve the overall user experience in your apps by reducing the number of consent messages users are shown.

How consent syncing works

Consent syncing uses the Google User Messaging Platform SDK (UMP SDK) and a unique consent sync identifier to confirm a user's previous consent decisions and apply them to other apps that are members of a defined consent group.

When a user makes a consent decision in one of the apps in the group, their decision is sent via the UMP SDK to a consent server where it is stored along with the consent sync identifier assigned to the user. When the same user initializes another app in the group, the UMP SDK sends the identifier to the consent server where it is compared to existing identifier-consent string combinations to determine whether or not the app user has previously made a consent decision in one of your apps that would be applicable to the current app.

Depending on the outcome of that comparison, one of the following actions will be taken:

If a valid and applicable consent decision exists: The Transparency and Consent (TC) string will be fetched and stored locally. The user will not be shown your European regulations message since they have already consented on another app in the consent group. In the case of a conflict between a locally-stored TC and consent server-stored TC:
- If the locally-stored TC string's LastUpdated timestamp is more recent than the timestamp of the version on the consent server, the locally-stored TC string will override the server version.
- If the TC string stored on the consent server has a LastUpdated timestamp that is more recent than or the same as the timestamp on the locally-stored version, the TC string stored on the consent server will be fetched and stored locally, overwriting the locally-stored version.
If a valid and applicable consent decision does not exist: Your European regulations message will be shown to the user. Once the user makes a consent decision on this message, the TC string will be stored on the consent server along with their consent sync identifier.

Any changes a user makes to their consent settings in the current app will be applied to other apps in the consent group the next time those apps perform requestConsentInfoUpdate via the UMP SDK. Apps that are already open on the user's device and are members of the consent group may need to be restarted before the consent decision is applied.

Create a consent group

Before you can start syncing consent across apps, you will need to select the apps you want to sync and add them to a consent group. When a user makes a consent decision on one of the apps in the group, that decision will be applied to other apps in the group that the user accesses afterward.

When creating your consent group, keep the following in mind:

Your privacy policy must clearly list all of the apps in the consent group that will share consent decisions.
Only apps with a published European regulations message are eligible for consent syncing.
- Apps in a consent group may become ineligible (for example, by deleting the app's European regulations message), but they will remain in the consent group. Consent won't be synced again for that app until its eligibility is restored.
- Ineligible apps can't be added to consent groups.
- Messages using in-ad-unit deployment are not eligible for consent syncing.
Once consent syncing is live, the European regulations messages displayed in the consent group member apps will inform users that their consent decisions have been applied to a group of apps and will link to your privacy policy.

Complete the following steps to create a consent group:

Sign in to Google Ad Manager.
Click Privacy & messaging.
Click on the European regulations message type card.
In the "Consent syncing" section, click Add apps.
Select the apps you want to include in the consent group.
Click Confirm. The consent group will be saved.

Consent sync identifiers

Consent sync identifiers are the unique identifiers used to match users to their previous consent decisions. The identifiers must not contain raw personally identifiable information (PII) about users. You may utilize publisher-provided identifiers derived from signed-in data, such as an email address or a unique user ID, to facilitate consent syncing across multiple devices.

Review the Google for Developers documentation and complete the steps to set up consent sync identifiers:

Android
iOS

Consent sync identifier format

The identifier you provide must uniquely identify the user across all of your apps where consent is being synced. Hash or encrypt the identifier to prevent sending personally identifiable information (PII) to Google.

The provided ID must meet the following requirements:

Constructed as a UUID string or matches regular expression ^[0-9a-zA-Z+.=\/_\-$,{}]{22,150}$.
A minimum of 22 characters.
A maximum of 150 characters.

Example

The following are examples of correctly formatted consent sync IDs:

12JD92JD8078S8J29SDOAKC0EF230337
12jd92jd8078s8j29sdoakc0ef230337
12Jd92jD8078s8j29sDoakc0ef230337
123e4567-e89b-12d3-a456-426614174000

The following tools can be used to validate the consent sync identifier format:

Failure to meet the requirements results in the UMP SDK discarding the consent sync ID and logging a warning to the console.

Consent revocation

Consent revocation is the process by which users who consented to personalized ads can revoke that consent under GDPR. You must provide a link in your app's menu that allows users who want to revoke their consent decision to do so. Learn more about implementing consent revocation in your apps.

With consent syncing enabled, when a user revokes consent for one app in the consent group, they will revoke consent for all of the apps in the group.

Consent deletion

As a publisher, you also have the ability to request the deletion of a stored TC string for a user through a web endpoint.

To request data deletion, initiate a POST request using this URL:

https://fundingchoicesmessages.google.com/csd?userid={user's_ID}&appid={one_of_the_appids_in_the_consent_group}

Ensure the URL parameters in the POST request are URL encoded.

Was this helpful?

How can we improve it?