To integrate with the IAB Europe TCF, a publisher must implement an IAB registered TCF CMP on their app. The CMP creates and sends the TC (Transparency & Consent) string. Then, Google’s SDKs consume the TC string they receive from the CMP.
If you do not have consent for Google for Purpose 1 (Store and/or access information on a device), you should not call Google’s ad tag.
General guidance
If you have already implemented an IAB Europe registered TCF CMP on your app, AdMob automatically consumes the TC string from the CMP.
Note: Any CMP vendor selections in your IAB registered TCF CMP will override Ad Technology Provider selections in the EU User Consent Controls. This includes if you have selected to serve non-personalized ads for all EEA, UK, and Swiss users via the EU User Consent Controls.
If you have set NPA in your ad request, we will look at that and the consent indicated by the TC string and apply the most conservative setting.
- Passing TC string to tags: GPT, GPT Passbacks, AdSense, and Ad Exchange Tags will automatically communicate with the IAB CMP to forward the TC string to AdMob without publisher configuration. IMA SDK and Mobile Ads SDK will automatically obtain, parse, and respect the TC string from within local storage. For other tag types you will need to pass the following signals manually:
gdpr={0,1}andgdpr_consent={tc string}. - Passing TC string to programmatic: The IAB TC string is automatically passed to Google’s programmatic channels without configuration required by publishers.
- Passing the TC string to non-programmatic creatives: Work with your creative provider to identify whether you need additional configuration for your creatives to ensure they consume the TC string correctly. AdMob offers support for the IAB TCF macros (
GDPRandGDPR_CONSENT_XXXX) to enable you to manually pass the TC string to other creative vendors as needed. - Passing TC string to mediation partners: The IAB TC string will be available in device local storage (
NSUserDefaultsfor iOS orSharedPreferencesfor Android) and accessible to all mediation partners to obtain, parse, and respect when called in a mediation waterfall request.
Requirements: Personalized & Non-Personalized Ads
Our interoperability guidance is intended to reflect Google's existing policy requirements, in particular the requirements of Google's EU User Consent policy and our policies against fingerprinting for identification (for example, those contained in our Requirements for Third-party Ad Serving). Google’s policies continue to apply and are more restrictive than IAB Europe TCF policies in some cases.
Publishers should review the registration settings for the vendors they choose to work with via the IAB Europe TCF. The following requirements apply specifically when Google is a vendor in the publishers’ CMP.
Requirements to serve personalized ads
Google will serve personalized ads when all of the following criteria are met:
- The end user grants Google consent to:
- Store and/or access information on a device (Purpose 1)
- Create a personalized ads profile (Purposes 3)
- Select personalized ads (Purposes 4)
- Legitimate interest (or consent, where a publisher configures their CMP to request it) is established for Google to:
- Select basic ads (Purpose 2)
- Measure ad performance (Purpose 7)
- Apply market research to generate audience insights (Purpose 9)
- Develop and improve products (Purpose 10)
Requirements to serve non-personalized ads
If the consent requirements for personalized ads are not met, Google will serve non-personalized ads when all of the following criteria are met:
- The end user grants Google consent to:
- Store and/or access information on a device (Purpose 1)
- Legitimate interest (or consent, where a publisher configures their CMP to request it) is established for Google to:
- Select basic ads (Purpose 2)
- Measure ad performance (Purpose 7)
- Apply market research to generate audience insights (Purpose 9)
- Develop and improve products (Purpose 10)
We will handle the following scenarios according to the table below:
| Description | Ad serving behavior |
|---|---|
|
Lack of consent for Google to store and/or access information on a device (Purpose 1) In line with our existing EU User Consent policy, consent for cookies or mobile identifiers is required for both personalized and non-personalized ads. For non-personalized ads, consent for cookies or mobile identifiers is still required because non-personalized ads still use cookies or mobile identifiers to combat fraud and abuse, for frequency capping, and for aggregated ad reporting. |
Publishers should not call Google’s ad tags. If consent is missing for Google for Purpose 1 in the TC string, Google will drop the ad request and no ads will be served. |
|
Invalid TC string The TC string is not parseable (for example some fields are missing). |
We do not serve an ad if the TC string is invalid. |
Flexible vendor registration & publisher restrictions
IAB Europe TCF affords publishers the ability to customize a variety of restrictions. These allow publishers to indicate their own preferences, which will take precedence over a vendor’s preferences, where applicable. Publishers can never cause a vendor to operate under a lawful basis or for a purpose which conflicts with the vendor’s Global Vendor List registration. Hence these are termed restrictions in that they never expand the scope of what a vendor can do but only restrict it.
Publishers should review the registration settings for the vendors they choose to work with via the IAB Europe TCF. If a vendor has registered flexibly with “legitimate interest” as the default lawful basis for a purpose where Google requires “consent” per our interoperability guidance, if a publisher wants to work with that vendor via Google products they should choose consent for that vendor in the publisher restrictions of their CMP.
Google has registered purposes 2, 7, 9, and 10 as flexible, defaulting to requiring legitimate interest. Unless a publisher configures their CMP to restrict Google to consent for these purposes, Google will rely on legitimate interest where the CMP has established it with the user. Google is not flexibly registered for purposes 1, 3, and 4 and always requires consent for these purposes.
Real-Time Bidding (RTB) & Bidding
The IAB Europe TCF logic will apply to bid requests, bid responses and creatives, and cookie-matching requests.
We will allow bid requests to be sent and enable cookie matching when a vendor registers with “Consent” or, in limited cases, “Not used” for Ads Personalization (Purposes 3 and 4 in the TC string). Vendors that register for “Consent” for the Personalized Ads purposes (Purposes 3 and 4 in the TC string), but have not been granted consent by the user:
- Won’t receive bid requests.
- Won’t receive a response to cookie match requests.
- Won’t be allowed to win an auction. Google will block creatives that have vendors that do not meet our policy requirements from winning auctions or serving ads.
Additionally, the user must have given Google consent for Purpose 1, Purpose 3, and Purpose 4.
Mediation
When using the IAB TCF solution, please ensure that you are surfacing all of your mediation partners in your CMP. This will ensure that Google can continue to make call outs to all partners in your mediation waterfall.
The TC and AC strings will be evaluated by serving prior to the construction of the mediation waterfall and identify whether the mediation partner is present in one of the strings.
- If the mediation partner is present and the user has consented or legitimate interest has been established for at least one purpose, the mediation partner will be included in the mediation waterfall as it is constructed.
- If the mediation partner is not present or the mediation partner has been fully declined by the user, the mediation partner will not be called in the mediation waterfall.
The IAB TC & Google AC string will be available in device local storage (NSUserDefaults for iOS or SharedPreferences for Android) and accessible to all mediation partners to obtain, parse, and respect when called in a mediation waterfall request.