Consent Messages for Ads: GDPR, TCF and ATT

If any of your users are in Europe, the UK or Switzerland, consent is not optional paperwork. Without a valid consent message, Google and most other networks will limit or stop the ads they serve to those users, and that shows up quickly as lower fill and lower eCPM.

Consent also touches more than Europe. Several US states give people the right to opt out of their data being sold or shared, and on iOS Apple's tracking prompt adds another layer. Getting the messages, the order and the testing right protects both your users and your revenue.

This guide explains how the pieces fit together for apps on AdMob and sites on AdSense. It is practical guidance, not legal advice. Privacy rules and platform requirements change, so confirm the current position in your own account and the official documentation, and speak to a lawyer if your situation is unusual. Our disclaimer sets out the limits of what we cover.

Why ads need consent

Personalised advertising relies on reading and storing identifiers on a device and using data to choose ads. In the European Economic Area, that generally needs the user's consent under the GDPR and the ePrivacy rules. The UK has its own version of the GDPR and its own electronic communications rules, and Switzerland has its own data protection law. In practice, ad platforms treat all three regions in a similar way.

When a user says no, or never sees a message, networks fall back to ads that use less data. Fewer advertisers want those impressions, so prices drop. That is the revenue link, and it is why the setup deserves care.

The IAB TCF and certified CMPs

Most of the ad industry passes consent around using the IAB Europe Transparency and Consent Framework, usually called the TCF. A consent management platform, or CMP, shows the message, records the user's choices and encodes them in a standard consent string that every ad partner can read. The IAB Europe TCF page explains how the framework works.

Google requires publishers serving ads to users in the EEA, the UK and Switzerland to use a Google-certified CMP that integrates with the TCF. You have two routes:

• Google's own tool. Privacy & messaging, built into AdMob and AdSense, is a certified CMP and costs nothing extra.
• A third-party CMP. Useful if you run several ad stacks or need features Google's tool lacks. Check it is on Google's certified list before you rely on it.

If you mediate, partners outside Google read the same TCF string, so one message covers your whole stack as long as those partners are listed in it.

Setting up messages in AdMob

In AdMob, open Privacy & messaging and create a European regulations message. You choose the apps it applies to, the languages, the look of the message and the ad partners users can consent to. Include every network in your mediation stack, or that partner may treat users as not having consented.

In the app, the User Messaging Platform SDK, known as UMP, shows the message. The general flow, described in the AdMob developer documentation, is:

1. Request an update of the user's consent information on every app launch.
2. Load and show the consent form if the SDK says one is required.
3. Only initialise the ads SDK and request ads once the SDK says ads can be requested.
4. Give users a privacy settings entry point, such as a button in your settings screen, so they can change their choice later.

Step 3 matters. Requesting ads before consent has been gathered can mean the first ads in a session are served without valid consent signals.

Setting up messages in AdSense

For websites, AdSense has the same Privacy & messaging area. Create a European regulations message, pick the sites, languages and styling, and publish it. Because the message is delivered through your existing AdSense code, there is usually nothing extra to install. If you use a third-party CMP instead, make sure it loads before your ad code. The AdSense help centre has the current steps.

Once the message is live, visit your site from an incognito window to see the first-visit experience. Check it on a phone as well, since a consent banner that covers a small screen badly can hurt your bounce rate.

US state privacy messages

A growing number of US states give residents the right to opt out of the sale or sharing of their personal data for targeted advertising. Google's Privacy & messaging offers a US state regulations message that adds an opt-out link and passes the choice on to ad partners. The IAB's Global Privacy Platform carries these signals in a way similar to the TCF.

Unlike the European message, this is an opt-out model: ads stay personalised until the user says otherwise. Which states are covered and what wording is required changes often, so check the current list in your account before you publish.

Getting the order right with Apple's ATT

On iOS, App Tracking Transparency asks users whether they will allow tracking across other companies' apps and websites. It is separate from GDPR consent, and you may need both.

A common order for users in Europe is:

1. Show the GDPR consent message first.
2. Optionally show a short explainer screen saying why you are about to ask.
3. Show the ATT system prompt.

Google's Privacy & messaging can show an explainer message just before the ATT prompt. Do not imply that tapping "Allow" is needed to use the app, and do not show the explainer in a way that copies the system dialogue. Apple sets out its rules on the user privacy and data use page. Our guide to ATT and iOS ad earnings covers what opt-in rates do to revenue.

What non-personalised ads mean for revenue

Users who decline personalisation can still see ads, but they are chosen with less data, and some advertisers will not bid at all. Where a user refuses storage of identifiers altogether, Google may serve limited ads, which narrows demand further.

We do not hold a separate benchmark for non-personalised ads, but you can stress-test the impact. Take 10,000 daily users in Tier 2, which in our tables covers Western Europe, each seeing two interstitials. At AdMob's benchmark of $3.20 eCPM, 20,000 impressions earn $64.00 a day. If those impressions fell to the low end of our range, 0.7 times the central figure, they would earn $44.80, a gap of $19.20 a day. Run your own mix through the AdMob revenue calculator or the AdSense revenue calculator at the low end to see your downside.

A clear, honest message tends to do better than a confusing one, so design matters as well as compliance.

Testing with debug geography

You cannot test a European message properly from outside Europe without help. The UMP SDK supports debug settings that let a registered test device behave as if it were in the EEA, and Google has added options for testing regulated US states too. The SDK logs your test device ID the first time it runs, which you add to the debug settings.

When testing:

• Reset the consent state between runs, or you will only see the message once.
• Test accept, reject and the custom choices screen.
• Confirm ads load after each choice, and check your logs for consent errors.
• Remove debug settings before you release.

A short launch checklist

Before you ship, confirm that the message covers every region where you serve ads, every mediation partner is listed, ads only load after consent is gathered, and users can reopen their privacy choices. Consent problems can also feed into serving limits, which our guide to why ad accounts get limited explains. If your app is aimed at children, the rules differ again: see ads in kids' apps. For unfamiliar terms, the A to Z glossary has short definitions, and the home calculator lets you model a European audience against your current mix.