I have opened this question in SO, but was suggested to ask here, as the solution might come from a lawyer, rather than developer.

I work on a native ads SDK for iOS/Android (banner, interstitial, video ads etc.).
We want to comply with GDPR regulations (and others, like COPPA, later).

So I have few questions here:

  1. Should the SDK provide a way (set of get/set functions) for publisher to read/write the GDPR data? I talk here about the values of IABConsent_SubjectToGDPR, IABConsent_ConsentString, IABConsent_ParsedPurposeConsents and IABConsent_ParsedVendorConsents in user defaults or shared preferences...
  2. If yes then should the SDK parse the IABConsent_ConsentString and store the parsed data to IABConsent_ParsedPurposeConsents and IABConsent_ParsedVendorConsents?
  3. Or, maybe the SDK should ask the user by itself for the consent data?
  4. Even if none of the above has to be implemented in the SDK, it still has to read the GDPR related data from NSUserDefaults/SharedPreferences. So should it read the IABConsent_ConsentString and parse it by itself? Or can I just rely on the parsed values (IABConsent_ParsedPurposeConsents and IABConsent_ParsedVendorConsents)?
  5. And, in general, who is responsible to collect this data from the user, build consent string and parse it to vendors and purposes lists? Is it the publisher (app developer) or each one who touches this data (e.g. SDKs in use)?

Thank you.

  • In your question you make the assumption that the GDPR is relevant, but you don't explain why. In what way does the ads sdk process personal data?
    – wimh
    Commented Oct 31, 2019 at 21:47
  • @wimh the ads may be generated according to user's gender, age, location etc. We want the SDK to be compliant with GDPR and COPPA so that any app will be able to use it without compromising its own compliance. Commented Nov 3, 2019 at 7:51

2 Answers 2


Generally if an app is using a third party add service, the app handles the GDPR rules.

That could change with future court rulings, but ,for now, the app should tell the user what info is being shared with the third party advertisers and let the users consent.

Additionally, if you are using a 3rd-party to show ads (aka using an ad network/exchange), it's possible you'll need to mention all those involved (the ad server, exchange, DMPs, DSPs, etc), which makes getting consent for programmatic ads infeasible. That said, it may be that a broader statement of "we'll be sharing with various advertising partners" would be enough. https://adzerk.com/blog/gdpr-ad-tech/

The app may use other ad networks in addition to the one you work for, so it is best left up to the app so you don't force the user to go through multiple GDPR notices.


Disclaimer: I am not a lawyer, this is not legal advice, always obtain proper advice from a qualified practitioner in the relevant field. I make no warranties in relation to this information.

I would suggest that it is always the publishers responsibility to collect the necessary consents and display the required notices in relation to the third parties it works with, to the user's of its app / website.

That includes any notices necessary to describe what your SDK is doing in relation to personal data.

It is also necessary for any SDK that may pass personal data on to downstream parties / vendors to have a mechanism to obtain / be provided with the consent state for the user. It then needs to ensure it passes it on in a way that the downstream vender can understand.

So an API would be desirable in your SDK which can be used to give you the consent state for the user. It is even better if you can use an API spec that's well understood. It will be easier for people to integrate your sdk.

I do not think you want to get into the business of providing the UI experience for consent collection into your product, as thats hugely complex and really needs to be expertly aligned with the obligations for transparency, and meet the standard for consent, and still be flexible enough for different apps to want to use it.

Having said that, if you are interested in capturing consent perhaps you might be interested in building a consent management SDK. You might want to look at being a CMP provider for the IABs Transparency & Consent Framework Version 2.0, which does include specifications for mobile app implementations. Find out more here: https://iabtechlab.com/standards/gdpr-transparency-and-consent-framework/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .