GDPR compliance in ads SDK for iOS/Android
<p>I have opened <a href="https://stackoverflow.com/questions/58644088/gdpr-compliance-in-ads-sdk-for-ios-android">this question in SO</a>, but was suggested to ask here, as the solution might come from a lawyer, rather than developer. </p>

<p>I work on a native ads SDK for iOS/Android (banner, interstitial, video ads etc.).<br>
We want to comply with GDPR regulations (and others, like COPPA, later).</p>

<p>So I have few questions here:  </p>

<ol>
<li>Should the SDK provide a way (set of get/set functions) for publisher to read/write the GDPR data? I talk here about the values of <code>IABConsent_SubjectToGDPR</code>, <code>IABConsent_ConsentString</code>, <code>IABConsent_ParsedPurposeConsents</code> and <code>IABConsent_ParsedVendorConsents</code> in user defaults or shared preferences...</li>
<li>If yes then should the SDK parse the <code>IABConsent_ConsentString</code> and store the parsed data to <code>IABConsent_ParsedPurposeConsents</code> and <code>IABConsent_ParsedVendorConsents</code>?</li>
<li>Or, maybe the SDK should ask the user by itself for the consent data? </li>
<li>Even if none of the above has to be implemented in the SDK, it still has to read the GDPR related data from <code>NSUserDefaults</code>/<code>SharedPreferences</code>. So should it read the <code>IABConsent_ConsentString</code> and parse it by itself? Or can I just rely on the parsed values (<code>IABConsent_ParsedPurposeConsents</code> and <code>IABConsent_ParsedVendorConsents</code>)?</li>
<li>And, in general, who is responsible to collect this data from the user, build consent string and parse it to vendors and purposes lists? Is it the publisher (app developer) or each one who touches this data (e.g. SDKs in use)?</li>
</ol>

<p>Thank you.</p>

<p>Generally if an app is using a third party add service, the app handles the GDPR rules. </p>

<p>That could change with future court rulings, but ,for now, the app should tell the user what info is being shared with the third party advertisers and let the users consent.</p>

<blockquote>
  <p>Additionally, if you are using a 3rd-party to show ads (aka using an ad network/exchange), it's possible you'll need to mention all those involved (the ad server, exchange, DMPs, DSPs, etc), which makes getting consent for programmatic ads infeasible. That said, it may be that a broader statement of "we'll be sharing with various advertising partners" would be enough. <a href="https://adzerk.com/blog/gdpr-ad-tech/" rel="nofollow noreferrer">https://adzerk.com/blog/gdpr-ad-tech/</a></p>
</blockquote>

<p>The app may use other ad networks in addition to the one you work for, so it is best left up to the app so you don't force the user to go through multiple GDPR notices. </p>

<p><em>Disclaimer: I am not a lawyer, this is not legal advice, always obtain proper advice from a qualified practitioner in the relevant field. I make no warranties in relation to this information.</em></p>

<p>I would suggest that it is always the publishers responsibility to collect the necessary consents and display the required notices in relation to the third parties it works with, to the user's of its app / website.</p>

<p>That includes any notices necessary to describe what your SDK is doing in relation to personal data.</p>

<p>It is also necessary for any SDK that may pass personal data on to downstream parties / vendors to have a mechanism to obtain / be provided with the consent state for the user. It then needs to ensure it passes it on in a way that the downstream vender can understand.</p>

<p>So an API would be desirable in your SDK which can be used to give you the consent state for the user. It is even better if you can use an API spec that's well understood. It will be easier for people to integrate your sdk.</p>

<p>I do not think you want to get into the business of providing the UI experience for consent collection into your product, as thats hugely complex and really needs to be expertly aligned with the obligations for transparency, and meet the standard for consent, and still be flexible enough for different apps to want to use it. </p>

<p>Having said that, if you are interested in capturing consent perhaps you might be interested in building a consent management SDK. You might want to look at being a CMP provider for the IABs Transparency &amp; Consent Framework Version 2.0, which does include specifications for mobile app implementations. Find out more here: <a href="https://iabtechlab.com/standards/gdpr-transparency-and-consent-framework/" rel="nofollow noreferrer">https://iabtechlab.com/standards/gdpr-transparency-and-consent-framework/</a></p>

gdpr