This question borders the line between technical and legal but I am posting here because it is not a coding problem in itself. Apologies if this is the wrong forum.
I have set up my mobile app to use Google's own Consent Management Platform called User Messaging Platform / UMP (https://developers.google.com/admob/ump/android/quick-start) via Admob to gather consent to show ads. My Admob account is set to show either personalised or non-personalised ads depending on which settings users select in the consent form.
The consent form shows up fine so long as users do not have personalisation disabled in their phone settings / Google account and so long as I haven't disabled personalised ads completely from within the Admob / UMP interface. In this case, users who use the form are able to disable whichever aspects of data processing they want and Google Admob automatically disables elements of ad personalisation accordingly, and completely disables all ads if users do not select the required elements in the consent form.
However, if a user does have personalised ads disabled on their phone / Google settings or if I have disabled all personalised ads from within the Admob / UMP interface, then the consent form is not able to be displayed to users. In this case, users will simply see non-personalised ads in the app without having been presented with a form beforehand. There is no way at all to present a form to users because the request is always unavailable.
It turns out that this is expected behaviour and exactly how the UMP consent form is apparently supposed to function. To demonstrate this, Google displays this message in the Admob interface about their consent platform messages:
This is the answer that Google gave directly to this question:
If you have disabled personalized ads then there is no need to display the consent form. The forms and all consent are only needed for when you are looking to show personalized ads. So to be compliant with GDPR you just need to have the ability to call the consent and if the person has the phone set to show personalized ads, it will then show them the form.
With the steps that you have mentioned, the behavior looks actually to be correct, if you have chosen to not show personalized ads, then there is no need for the forms.
What if I’m a publisher serving only non-personalised ads to EEA and UK users?
Non-personalised ads (NPA)
Therefore, I'm completely confused by this. Is this a case of Google's team not understanding their own legal obligations? Should I be wary about releasing my app using Google's UMP which I have already integrated? Or is there a technical detail that I'm not aware of which makes Google's approach GDPR compliant?
For reference, here is Google's AdMob & AdSense program policies Publisher integration with the IAB TCF v2.0: