Terms and privacy policy flow

[COMPONENT: Terms1]

[COMPONENT: ATTbug]

AppLovin MAX SDK, when used with Google UMP, complies with TCF v2: The MAX SDK can ingest the consent string and AC string and forward the TCF v2 Consent strings / states to the mediated networks as described in TCF v2 consent.

If you do not use Google UMP as your CMP, either through AppLovin’s automated flow or otherwise, you must ensure that the CMP you choose supports the mediated networks you integrate.

If you do not use a CMP, you must continue to set AppLovin’s SDK’s binary consent flags as described in Consent and other applicable flags in GDPR and other regions.

[COMPONENT: TermsFlowchart]

[COMPONENT: Terms2]

[COMPONENT: EnablingGoogleUMP]

Enabling MAX terms and privacy policy flow

Follow these steps to enable Terms and Privacy Policy Flow:

1. In Unity, select AppLovin > Integration Manager. The AppLovin Integration Manager dialog appears.
2. In Privacy Settings check Enable MAX Terms and Privacy Policy Flow.
3. You must include values for your Privacy Policy URL and the base User Tracking Usage Description. The AppLovin Integration Manager will populate the English (base) User Tracking Usage Description and a variety of localizations of that description with default values for you.
4. Optionally, you may also set the Terms of Service URL and whether to Show Terms and Privacy Policy Flow when in GDPR Regions (disabled by default).
5. Close the AppLovin Integration Manager dialog.

When you submit your app to App Store Connect for review, you must notify the reviewer that you enabled the App Tracking Transparency framework permission request for iOS 14.5+ only. Do this in the Review Notes section. If you do not do this, Apple may reject your build.

Integration

[COMPONENT: FinishConsentFlow]

If you set the user ID in your MMP integration, set it where you set the AppLovin user ID. The code snippets below use Adjust as an example. Refer to Adjust’s documentation to learn how to initialize Adjust and set the user ID.

Localizing NSUserTrackingUsageDescription

The AppLovin MAX Unity plugin includes a default set of User Tracking Usage Descriptions. If you wish to override them, check the Override Default User Tracking Usage Description setting in the Integration Manager and enter your desired descriptions.

Show GDPR flow to existing users

AppLovin recommends that you allow existing users in GDPR regions to reenter the GDPR flow. Typically, users do this in your app’s Settings section via an option to Manage Existing Privacy Settings. If a user is in a GDPR region you can conditionally show that settings option. To determine this, use the SDK API MaxSdk.GetSdkConfiguration().ConsentFlowUserGeography. The user is in GDPR region when ConsentFlowUserGeography is ConsentFlowUserGeography.Gdpr.

When the user clicks Manage Existing Privacy Settings (or its equivalent), call MaxSdk.CmpService.ShowCmpForExistingUser(). This resets the user’s existing consent information.

Testing

If you want to test the Google CMP outside the GDPR region, set the Debug User Geography to GDPR in the Integration Manager as shown below:

Then, set the test device hash ID as an SDK extra parameter before you initialize the MAX SDK. The Google CMP SDK logs this test device hash ID when the app runs on a device. Set the test device hash ID by making the following call:

[COMPONENT: TestingUMPIntegration]

Enabling Google UMP

Enabling Google CMP on AdMob dashboard

For MAX consent flow to display the Google GDPR form, you must first create and publish the Google GDPR message on the AdMob dashboard. To do so:

1. Sign in to your AdMob account at apps.admob.com.
   • Add your apps to the AdMob dashboard, if you have not done so already.
2. Click Privacy & messaging.
3. Click GDPR.
4. Click Create message. The GDPR message page opens.
5. Select the apps that you want to display your message:
   1. Click Select apps.
   2. Select the desired apps.
   3. Click Save.
6. Select the languages in which you want to display your message.
7. In the User consent options section, select Consent or Manage options.

1. In the Targeting section, select Countries subject to GDPR (EEA and UK).
2. Click Continue. The Edit message page opens.
3. In the Message name field, enter a descriptive message name to help you identify the message later. This name appears on the Privacy & messaging page and is not visible to users.
4. Select the Styling tab.
   1. Under the Global section, set the Secondary color to white (#ffffff).
   2. Under the Buttons section, set the Secondary color to gray (#6e6e6e).
5. Click Publish.

Customize ad partners list

In its default GDPR message, Google might not show all your ad network partners. If you fail to include these networks, this could adversely affect your ad revenue. Follow the steps in this section to ensure all your ad partners appear in the GDPR message.

1. Open the GDPR settings page.
2. Click the edit icon under the Review your ad partners section.
3. Select either Automatically include commonly used ad partners or Do not automatically include commonly used ad partners. Then select all the networks that you integrated into your app.

1. Click Confirm.
2. Click Save at the bottom of the GDPR settings page.

The SDK presents the consent flow when you initialize the SDK. When the user completes the flow, the SDK calls your initialization-completion callback.

This page explains how you can use the MAX Terms & Privacy Policy Flow to prompt acceptance of your Terms of Use and Privacy Policy.

Verifying missing networks

In the CMP CONFIGURATION section, you can verify which networks integrate with or are missing from your Google UMP configuration. This is an exhaustive list of all networks that are available to MAX. You can ignore any networks that you did not integrate in your application.

On your CMP flow you must list the networks that you integrate in your application. To check if any of those networks are missing, and to fix this problem:

1. Complete the CMP flow, granting consent to all networks.
2. Open the Mediation Debugger. The Mediation Debugger parses the TC and AC strings and displays two lists:
   1. Integrated networks you listed on your CMP flow
   2. Networks that are missing which you might need to add (under Configured CMP Networks in the CMP CONFIGURATION section)
3. You will see missing networks in the MISSING ATP NETWORKS or MISSING TCF VENDORS lists. If any of these are networks that you integrated into your application:
   1. Return to your CMP’s dashboard. Add the missing networks to those covered by the GDPR message. (See Customize ad partners list for how to do this in Google’s Unified Consent Flow.)
   2. Restart your app.

Repeat these steps until you verify that you included all of your networks in the CMP flow.

The flow shows only to new users. If you want to test the flow after you complete the CMP prompt, you must delete and re-install the app.

Due to a bug in iOS 17.4, the App Tracking Transparency (ATT) prompt may prematurely indicate that a user rejected ATT. This causes the AppLovin SDK to initialize your Ad Units with LAT-configured ad networks, even for a user who might consent to ATT. If you use AppLovin’s Unifed Consent Flow, update to the latest iOS SDK (12.3.0+) to mitigate this issue.

Do not check the Close (do not consent) option.

See “Manage GDPR ad partners” at the Google AdMob Help site for the list of ad partners that are GDPR-certified with Google.

You must wait until the user finishes the consent flow before you initialize third-party SDKs (such as MMPs or analytics SDKs). For this reason, initialize such SDKs in your initialization-completion callback. If you initialize third-party SDKs before the user completes the consent flow, these SDKs cannot access relevant identifiers, and you suffer a material impact on measurement, reporting, and ad revenue.

Do not initialize MAX mediated network SDKs in your initialization callback. MAX performs this initialization automatically.