Privacy

[COMPONENT: Privacy1]

[COMPONENT: Privacy1a]

[COMPONENT: Privacy1b]

TCF v2 consent

[COMPONENT: Privacy3]

[COMPONENT: Privacy4]

[COMPONENT: MultiStateConsumerPrivacyLaws]

[COMPONENT: MultiStateConsumerPrivacyLaws1a]

[COMPONENT: MultiStateConsumerPrivacyLaws1b]

[COMPONENT: MetaCalifornia]

[COMPONENT: Privacy5]

Meta Audience Network data processing options for users in California

To learn how to implement Meta Audience Network’s “Limited Data Use” flag, read the Meta for Developers documentation.

Multi-state consumer privacy laws

State laws in the United States may require you to display a “Do Not Sell or Share My Personal Information” link to users in those states, or to provide other options through which those users can opt out of interest-based advertising. Such users can opt out of both interest-based advertising and the sale or sharing of their personal information for interest-based advertising. You must set a flag for users from those states that indicates whether those users opt out in this way. If a user does not opt out in these ways, set the do-not-sell flag this way before initializing or using the AppLovin SDK:

If a user does opt out of interest-based advertising, set the do-not-sell flag this way:

AppLovin MAX helps you handle opt-out values on behalf of some mediation partners. MAX shares these values via adapters. This works only if you use supported network SDKs. Consult with your network partner to determine the correct SDK versions.

MAX does not support handling opt-out values for some networks. For those, you must work directly with the network partner.

Consent, other applicable flags, and data APIs

When you use the AppLovin SDK, you are responsible for complying with applicable privacy regulations. If you collect and/or transmit personally identifiable information, you are responsible for protecting and managing that data.

You are fully responsible for collecting consent values and other applicable flags and for passing those to AppLovin. This is true whether you use your own consent mechanism or a third-party API. MAX provides APIs with which you pass consent and other applicable flags to AppLovin.

Best practices:

• Solicit your own legal advice. Nothing in this document should be construed as legal advice.
• Read and understand AppLovin Policies for Publishers, AppLovin’s Privacy Policy, and integration guides offered by AppLovin.
• List AppLovin in your privacy policy as a third-party that collects data. Include a link to AppLovin in your privacy policy.

This framework helps facilitate compliance with:

• The General Data Protection Regulation (“GDPR”) and laws of similar effect
• Certain U.S. multi-state privacy requirements
• Data restrictions under GDPR, COPPA, and App Store policies

Consent and privacy requirements may extend beyond these. Apply them accordingly, based on the jurisdiction(s) of your users.

Consent and other applicable flags in GDPR and other regions

When you use the AppLovin SDK, AppLovin requires you to set certain consent values and other applicable flags and to send those to AppLovin. You are fully responsible for collecting and sending these values and flags. This is true whether you use your own consent mechanism or a third-party API.

Some of these flags indicate whether users from certain locations provided opt-in consent to collect and use their personal data for interest-based advertising. These locations include the European Union, European Economic Area, United Kingdom, and Switzerland.

Another flag indicates whether users from certain U.S. states opted out of the sale of their information.

When you initialize the AppLovin SDK, the SDK records the values that you set in the “Privacy States” fields to the log. These fields include “Has User Consent” and “Do Not Sell”. Because the AppLovin SDK records the values of these fields when the SDK initializes, you must set these values before you initialize the AppLovin SDK. This ensures that the values are passed to AppLovin. Refer to the Mediation Debugger or to the section marked “Privacy States” in the logs to verify that you set these values.

If the user consents to interest-based advertising, set the user consent flag accordingly, then initialize the AppLovin SDK, and start requesting ads. After you set the consent value for a particular user, AppLovin will continue to respect that value for the lifetime of your application or until the user revokes consent to interest-based advertising.

If the user does not consent to interest-based advertising, set the user consent flag accordingly, then initialize the AppLovin SDK and start requesting ads. After you set the consent value for a user, AppLovin respects that value for the lifetime of your application or until the user consents to interest-based advertising.

You must verify that you set the consent flag. If you set the consent flag, the “Has User Consent” value shown in the logs (under “Privacy States”) is either “true” or “false”. You can also check the value of the consent flag in the Mediation Debugger. As described above, after you set the consent value, AppLovin respects that value for the lifetime of your application or until the consent value changes.

AppLovin MAX helps you handle consent values on behalf of supported mediation partners. MAX shares these consent values via adapters. To do this, you must use GDPR-supported network SDKs. Consult with your network partner to determine which of their SDK versions support GDPR.

AppLovin MAX does not support your handling of consent values on behalf of Meta, Inc. You must work directly with Meta to determine what support Meta provides for GDPR compliance.

As explained in AppLovin’s Terms of Use Agreement and Policies for Publishers, you may not provide AppLovin with children data or cause that information to be provided via a third party. You may not initialize or use the AppLovin SDK in any way or otherwise use the AppLovin Services in connection with a “child” as defined under applicable laws. For more details, see the section below entitled “Prohibition on children data or using the services for children or apps exclusively targeted to children”.

If you implement a CMP that complies with IAB TCF v2 (Transparency & Consent Framework) for your user consent flow, MAX sends the TCF v2 strings to mediated networks in the following ways:

For Amazon, BidMachine (Android), Google, InMobi, Ogury, Smaato, Verve, and YSO Network : These SDKs read the TCF v2 consent strings from NSUserDefaults or SharedPreferences. You do not have to do more configuration to make this happen.

For BidMachine (iOS) and DT Exchange (versions 8.2.7.0+) : MAX SDK sends the TCF v2 consent strings to each network via adapters. You can find compatible adapter and SDK versions on the individual network adapter changelogs. Contact the network partner for more information.

For DT Exchange (versions before 8.2.7.0) : MAX SDK checks the consent status in the TCF v2 consent string. It then passes the consent state to the network via the adapter.

For AppLovin, Chartboost, ironSource, Liftoff Monetize, LINE, and Unity Ads : If you use Google UMP as your CMP, the MAX SDK leverages Google UMP’s Additional Consent (AC) Mode. MAX sends the consent states to each network via the adapter, in the AC string. If you do not use Google UMP as your CMP, contact your CMP provider to learn how to send the consent state to these networks.

For Meta Audience Network : If you use Google UMP as your CMP, you can read the consent state by following their Additional Consent Mode guide. Then you can forward the consent state to their SDK. For specific instructions, see “Meta Audience Network data processing options”. If you do not use Google UMP as your CMP, contact your CMP provider to learn how to send the consent state to Meta Audience Network.

For Mintegral : On adapter versions 16.5.71.0 (Android)/7.5.1.0.0 (iOS) or above, the SDK automatically reads the TCF v2 consent strings from NSUserDefaults or SharedPreferences. On other adapter versions, the MAX SDK checks the consent status in the TCF v2 string and passes the consent state to the network through the adapter.

For MobileFuse : On adapter versions 1.8.0.1 (Android/iOS) or above, MAX SDK no longer sends TCF v2 consent strings, as MobileFuse does not monetize in GDPR regions. For more information, refer to MobileFuse’s Privacy and Compliance Policies.

For custom networks and networks that are not compliant with TCF v2 : These networks are in the final waterfall, but MAX does not pass any consent flags to them via the adapter.

Prohibition on children data or using the services for children or apps exclusively targeted to children

As explained in AppLovin’s Terms of Use Agreement and Policies for Publishers, you may not provide AppLovin with children data or cause that information to be provided via a third party. You may not initialize or use the AppLovin SDK in any way or otherwise use the AppLovin Services in connection with a “child” as defined under applicable laws. For example, mixed-audience apps or “everyone” apps—i.e., apps whose users may include children—if a particular user of your app qualifies as a “child,” should not initialize or use the AppLovin SDK in any way.

Consistent with these requirements, setIsAgeRestrictedUser is no longer supported, as you may not initialize or use the SDK in any way if the user qualifies a “child.” Update your apps to the latest SDK to comply with AppLovin’s policies.

You cannot use AppLovin Services in apps exclusively designed for, or exclusively directed to, children. For example, iOS Apps in the “Kids” category, and Google Play apps that target children and must follow Families Ads & Monetization Policy requirements, may not use the AppLovin Services at all. AppLovin does not knowingly collect personal information from children or serve advertisements to children.

You can find more examples in the following table:

Google play families policy (Android)

This section concerns updates to the Google Play Families Policy. Your designation under the Google Play Families Policy impacts whether you may initialize or use the AppLovin SDK. You can find complete details on Google Play’s Policy Center.

Who does this policy apply to?

According to Google, if you serve ads in your app and your target audience includes only children, then you must use only Families Self-Certified Ads SDKs.

If the target audience for your app includes both children and older users, then you must comply with Google Play Families Policy. You must also ensure that ads you show to children come exclusively from Families Self-Certified Ads SDKs.

What does this mean for your use of the AppLovin SDK and MAX?

As explained in AppLovin’s Terms of Use Agreement and Policies for Publishers, you may not provide AppLovin with children data or cause that information to be provided via third party. You cannot use the AppLovin Services in apps exclusively designed for, or exclusively directed to, children. AppLovin does not knowingly collect personal information from children or serve advertisements to children.

As explained above, you may not initialize or use the AppLovin SDK in any way or otherwise use the AppLovin Services in connection with a “child” as defined under applicable laws.

Mixed-audience apps or “everyone” apps—apps whose users may include children—if a particular user of your app qualifies as a “child,” should not initialize or use the AppLovin SDK in any way.

Requirements

If you design your app primarily for children under the age of 13: : Google Play requires that you participate in the Designed for Families program and show ads to children exclusively from Families Self-Certified Ads SDKs. : You must also comply with Google Play’s Families Policy Requirements. : You cannot use AppLovin Services in any way in apps exclusively directed to children. See AppLovin’s Terms of Use Agreement.

If you design your app for everyone, including children: : You must adhere to Google Play’s Families Policy Requirements. : If a particular user of your app qualifies as a “child,” do not initialize or use the AppLovin SDK in any way. For more information, see “Prohibition on children data or using the services for children or apps exclusively targeted to children” above.

If you did not design your app for children: : You still must meet the requirements outlined in the Google Play Developer Program Policies and Developer Distribution Agreement. : If a particular user of your app qualifies as a “child,” do not initialize or use the AppLovin SDK in any way. For more information, see “Prohibition on children data or using the services for children or apps exclusively targeted to children” above.

For more information about the Families Policy, including tips on how to determine the target audience for your app, review Google Play’s Policy Center.

If you use Google’s CMP (UMP), MAX handles CMP integration. It also ensures that you establish the consent status when you initialize the SDK. See “Google UMP automation” for more details.

If you use a different CMP, you must perform this integration yourself. You must also ensure that the CMP establishes consent status before you initialize the SDK.

If you access Google demand through MAX, review the Google CMP requirements before you start the integration process.