Google To Require TCF Consent Collection: What This Means For Publishers

[9 minutes read]

On 16th May 2023 Google announced that “later this year” they will require everyone using Google AdMob, Google AdManager, or Google AdSense to start collecting consent from users via CMP that has been Google certified.

Apart from this blog post and its extension for CMPs, there has been no official communication from Google. We also obtained some additional information but our knowledge is still very limited. AdMob team is currently internally clarifying questions that we have and we expect more information to be available in the coming weeks.

This article is aimed to cover the most important aspects of these announcements in the context of ad monetization including:

• What does this announcement mean in practice
• Explaining the most important terms
• What does Google CMP consent screen look like
• How are the biggest mobile video game companies handling consent
• What is the potential impact of these changes
• Timeline
• Action items

Let's start!

What does this announcement mean in practice

This announcement means that publishers that have so far had simple implementation (Terms of Service and Privacy Policy pop-ups) will not be sufficient anymore. Instead, publishers will have to collect consent from users in a manner that is TCF compliant via CMP that is approved by Google. This is announced as a new requirement by Google to be enforced later this year but we can expect other networks to follow so there’s no really an option to avoid this. Previously, ad providers such as Amazon Publisher Services, Yahoo, Smaato were already requiring TCF implementation.

Practically speaking, publishers will have to collect consent from users in a more detailed way - giving them more information and options.?

Explaining the most important terms

TCF stands for Transparency and Consent Framework and it was created by the International Advertising Bureau (IAB). It was developed in order to create a standardized way to collect consent from users for using their personal data in a manner that would be compliant with GDPR (General Data Protection Regulation) which applies since 25th May 2018. As per GDPR, the consent collected has to be freely given, specific, informed, and unambiguous. The latest version of this framework is TCF 2.2.

Currently, there are 32 mobile-specific CMPs (Consent Management Platform) that are certified by IAB but Google is yet to announce which CMPs they approve. Unofficially, they expect 3-5 CMPs to be approved by June as a starting point. Google has their own CMP and until they certify more, they are the only CMP officially allowed. Publishers can also create their own CMP but they would need to get it approved by Google and potentially fulfill other requirements. How widespread TCF is currently in mobile games and how interested publishers were so far to create their own CMP can probably be described based on the fact that out of 32 CMPs currently certified by IAB, only two come from mobile games - one by Outfit7 and the other by EasyBrain. Apart from that, there are two non-gaming app publishers creating coloring books apps.

The CMP acts as an intermediary between the publisher, end user, and vendors. The CMP specifically performs the following:

• Provides users with transparency into the vendors that a publisher has chosen to work with;
• Provides transparency into the purposes and legal basis that a vendor wishes to leverage – the names and descriptions of purposes and features can be found here?
• Store user’s consent signals, for example, a third-party cookie, in the user’s browser and make consent information available to vendors in the TCF v2.0 TC String
• Ensure that consent for a purpose applies only to the vendors that have declared, via the GVL, that they use data for that purpose

What does Google CMP consent screen look like

The user can click the Consent or Manage options. If they click on Manage options then there is a lot of information and many options available.?

From this interaction, a more complicated consent signal, a string, is created.?

How are the biggest mobile video game companies handling consent

We checked out 25 big mobile video game companies and how they are handling first-time user experiences in terms of pop-ups that are surfaced to the user. Out of 25 of them 20%, exactly 5, had TCF implemented. The companies that, according to our understanding and what've seen in their games, are using TCF are Outfit7, EasyBrain, Rovio, Gameloft, and Supersonic Studios.

The sample is not very big but includes a wide range of developers, including hyper-casual, casual to more core games, from games relying on purchases only to those relying almost solely on ads and those in between.

Based on the games we checked (one for each company) most of the big companies haven't implemented TCF yet. This includes the likes of Supercell, Electronic Arts, Ubisoft, Zynga, King, Playrix, Wildlife Studios, Miniclip, Peak Games, Dream Games, Glu Mobile, Moon Active, Sanqi Interactive Entertainment (13th on top grossing charts with their game Puzzles & Survival), Top War Studios, as well as all hyper-casual publishers we checked, except Supersonic Studios (Lion Studios, CrazyLabs, Rollic Games, SayGames, Amanotes).

You can find here screen recordings of the TCF implementations we found. Just below are the screenshots but the videos are definitely more descriptive.

What is the potential impact of these changes

This can have a negative impact on publisher ad revenue from users coming from EEA countries and the UK.?

Right now, it is not clear what happens in the following scenarios:

• Scenario I - Publishers ignore Google’s requirements
• Scenario II - Publishers implement TCF via Google-certified CMP but the user doesn’t give us consent

A reasonable expectation would be that in both scenarios Google would show non-personalized ads (NPA) instead of personalized ads (PA).

However, from the documentation that was previously available about Google’s CMP, there are certain criteria to be met in order to serve personalized ads and some other criteria to serve any kind of ads.

Google will serve personalized ads when all of the following criteria are met:

The end user grants Google consent to:

• Store and/or access information on a device (Purpose 1)
• Create a personalized ads profile (Purposes 3)
• Select personalized ads (Purposes 4)

Legitimate interest (or consent, where a publisher configures their CMP to request it) is established for Google to:

• Select basic ads (Purpose 2)
• Measure ad performance (Purpose 7)
• Apply market research to generate audience insights (Purpose 9)
• Develop and improve products (Purpose 10)

If the consent requirements for personalized ads are not met, Google will serve non-personalized ads when all of the following criteria are met:

The end user grants Google consent to:

• Store and/or access information on a device (Purpose 1)

Legitimate interest (or consent, where a publisher configures their CMP to request it) is established for Google to:

• Select basic ads (Purpose 2)
• Measure ad performance (Purpose 7)
• Apply market research to generate audience insights (Purpose 9)
• Develop and improve products (Purpose 10)

Here at GameBiz, our clients are currently generating 20% of their ad revenues from EEA and UK countries on iOS and 30% on Android. These two combined, our clients are generating 28% of their ad revenue in these regions.?

Speaking more broadly, according to NewZoo, 13% of global video game players come from Europe, or 428M of them. In terms of revenues, NewZoo reports that in 2022, 50% of global revenue was generated on mobile devices. It is estimated that around 12% of that comes from Europe. As for ad revenues alone, we don't have reliable data but it's reasonable to assume that the share coming from Europe could be somewhat similar to IAP. It remains to be seen how publishers will prioritize all the effort around this and how fast they will align themselves with the new requirements, especially in the context of how much of their revenue is being generated in the impacted region. Furthermore, Google and others might expand these requirements worldwide if they estimate this is in their best interest.

Timeline

As of now, we only have “later this year”. It would be really surprising to see Google enforce this before Q4 given how big of a change this is for most developers and how big of an impact it can have, especially if they are not given enough time to prepare.

Action items

There are many uncertainties at the moment so for now, it’s best not to make any decisions and instead gather information and explore options.?

Ultimately, publishers will have to change how they collect consent from users both on iOS and Android.

As with previous industry changes, for example, the introduction of ATT pop-ups, the industry will adapt, and the users will get used to it but nevertheless, the fact remains that players are getting another pop-up and it is arguable whether or not their experience and privacy are being improved. One can probably find more arguments for just the opposite - user experience gets worse while the user doesn’t get more informed and their privacy remains on the same level.

If there are publishers who are reading this and who have already implemented TCF, it would be great to hear about your experience, impact, etc. Happy to speak with publishers who have questions, concerns, or any thoughts in general around this subject!