Is Google's Consent Management Platform not GDPR compliant since it does not show a consent form when 'personalised ads' are disabled?

Question

This question borders the line between technical and legal but I am posting here because it is not a coding problem in itself. Apologies if this is the wrong forum.

I have set up my mobile app to use Google's own Consent Management Platform called User Messaging Platform / UMP (https://developers.google.com/admob/ump/android/quick-start) via Admob to gather consent to show ads. My Admob account is set to show either personalised or non-personalised ads depending on which settings users select in the consent form.

The consent form shows up fine so long as users do not have personalisation disabled in their phone settings / Google account and so long as I haven't disabled personalised ads completely from within the Admob / UMP interface. In this case, users who use the form are able to disable whichever aspects of data processing they want and Google Admob automatically disables elements of ad personalisation accordingly, and completely disables all ads if users do not select the required elements in the consent form.

However, if a user does have personalised ads disabled on their phone / Google settings or if I have disabled all personalised ads from within the Admob / UMP interface, then the consent form is not able to be displayed to users. In this case, users will simply see non-personalised ads in the app without having been presented with a form beforehand. There is no way at all to present a form to users because the request is always unavailable.

It turns out that this is expected behaviour and exactly how the UMP consent form is apparently supposed to function. To demonstrate this, Google displays this message in the Admob interface about their consent platform messages:

This is the answer that Google gave directly to this question:

If you have disabled personalized ads then there is no need to display the consent form. The forms and all consent are only needed for when you are looking to show personalized ads. So to be compliant with GDPR you just need to have the ability to call the consent and if the person has the phone set to show personalized ads, it will then show them the form.

With the steps that you have mentioned, the behavior looks actually to be correct, if you have chosen to not show personalized ads, then there is no need for the forms.

This appears to me to be contradictory to the advice that Google themselves display on their site, which states that 'non-personalised' ads still use cookies and therefore require consent to display:

https://www.google.com/intl/en_uk/about/company/user-consent-policy-help/

What if I’m a publisher serving only non-personalised ads to EEA and UK users?

If you do not serve personalised ads to users that visit your site, and visits to your site do not influence the ads served elsewhere, you are still required to obtain consent for the use of cookies or mobile identifiers, where legally required. Consent for cookies or mobile identifiers is still required because non-personalised ads still use cookies or mobile identifiers to combat fraud and abuse, for frequency capping and for aggregated ad reporting.

https://support.google.com/adsense/answer/9007336?hl=en-GB

Non-personalised ads (NPA)

Although non-personalised ads don’t use cookies or mobile ad identifiers for ad targeting, they do still use cookies or mobile ad identifiers for frequency capping, aggregated ad reporting and to combat fraud and abuse. Therefore, you must obtain consent to use cookies or mobile ad identifiers for those purposes where legally required, per the ePrivacy Directive in certain EEA countries.

Therefore, I'm completely confused by this. Is this a case of Google's team not understanding their own legal obligations? Should I be wary about releasing my app using Google's UMP which I have already integrated? Or is there a technical detail that I'm not aware of which makes Google's approach GDPR compliant?

For reference, here is Google's AdMob & AdSense program policies Publisher integration with the IAB TCF v2.0:

https://support.google.com/admob/answer/9760862?hl=en&ref_topic=9756841

Answer 1

Obtaining consent for cookies is not required by the GDPR at all. Instead it is covered by the e-privacy directive, which as a directive rather than a regulation, must be implements by specific legislation in each individual country. The exact requirements vary with the law of each country.

An e-privacy regulation has been proposed, which would have scope similar to the GDPR, would replace the Directive, and would not require national implementing legislation. However it has not yet been adopted. Proposed versions have significantly different requirements than the current Directive.

Nor does the GDPR require consent for advertising that does not involve the processing of personal information, unlike some other privacy laws such as the California CCPA.

However, if the Google package sets cookies without consent that are not strictly necessary for operation of the web site, it might well fail compliance with some of those national laws implementing e-privacy. Also, even necessary cookies must be disclosed to the user, as I understand it, possibly only in general terms.

Several national Data Protection agencies have said that cookie compliance is not a major priority, at least not until an e-privacy regulation is in place. But that does not mean that lack of compliance is legal.

Unfortunately I see no way for a developer using the Google package to correct this issue within the package. One would either have to implement a different solution, or trust that Google will fix this before enforcement becomes a serious issue.

However, the app developer could add a separate general cookie consent banner, and turn off all adds if consent is not given, I believe.

Answer 2

Note that this is for a 'mobile' app, not a website. So cookies are not relevant and instead the 'Advertising Id' is the relevant piece of data. Device Identifiers are considered to be 'personal data' by the GDPR so it falls under the regulation and consent is required to use them.

However if the usage is only for fraud detection, frequency capping and so on, this could potentially be considered a 'Legitimate Interest' and therefore bypass explicit consent.