SDK privacy for Android

The Android SDK includes client support for Global Privacy Platform (GPP), the General Data Protection Regulations (GDPR), and the California Consumer Protection Act (CCPA) and Digital Services Act (DSA).

The Global Privacy Platform (GPP) enables advertisers, publishers and technology vendors to adapt to regulatory demands across markets. GDPR provides regulations for the processing, movement, and protection of personal data within the European Union. CCPA creates new consumer rights relating to the access to, deletion of, and sharing of personal information that is collected by organizations. The DSA is a key legislative measure by the European Union aimed at enhancing transparency in digital advertising, with a core objective of promoting transparency, accountability, and user protection in online services.

General Data Protection Regulations (GDPR)

In order for our clients to meet their transparency, notice and choice/consent requirements under the GDPR and the existing ePrivacy Directive, Microsoft Monetize supports the IAB Europe Transparency & Consent Framework (the "Framework").

This is a reference for mobile app publishers using the Android SDK to surface notice, transparency and choice to end users located in the EEA and signal approved vendors and, where necessary, pass consent, to Microsoft Monetize and demand sources and their vendors through the Monetize platform.

The Android SDK provides three APIs for mobile app publishers to use the Framework. These APIs allow you to:

• Define whether the user is located in the European Economic Area (the "EEA") and that European privacy regulations should apply
• Set the IAB Europe (IAB) consent string
• Set the IAB Europe (IAB) purpose consents

This information will be persisted by the SDK and will be added to each ad call for applying platform controls.

Publishers/Consent Management Platforms (CMPs) are free to store these values in a SharedPreferences interface (as defined by Mobile In-App CMP API v2.0: Transparency & Consent Framework) instead of passing them via the new APIs, and the SDK will read the values as a fallback.

Use the following methods on ANGDPRSettings:

// Set whether the user is subject to GDPR regulations
ANGDPRSettings.setConsentRequired(context, true)

// Set the IAB Base64-encoded consent string
ANGDPRSettings.setConsentString(context, "BOMyQRvOMyQRvABABBAAABAAAAAAEA")

// Set the IAB purpose consents (binary string; '1' at index n = consent for purpose ID n+1)
ANGDPRSettings.setPurposeConsents(context, "101010001")

// Set whether the user is subject to GDPR regulations
ANGDPRSettings.setConsentRequired(context, true);

// Set the IAB Base64-encoded consent string
ANGDPRSettings.setConsentString(context, "BOMyQRvOMyQRvABABBAAABAAAAAAEA");

// Set the IAB purpose consents (binary string; '1' at index n = consent for purpose ID n+1)
ANGDPRSettings.setPurposeConsents(context, "101010001");

Consent and device information logic

The following table describes the SDK behavior based on different purposeConsents values in combination with consentRequired values:

California Consumer Privacy Act (CCPA)

The Android SDK provides three APIs that enable SDK users to set, retrieve and clear U.S. Privacy User Signal Mechanism controls. The IAB Tech Lab has formalized and adopted the "us_privacy" string as the mechanism to encode data about the information disclosed to the user and user elections under various US privacy laws, starting with the CCPA.

This information will be persisted by the SDK and will be added to each ad call for applying platform controls.  

Publishers/Consent Management Platforms (CMPs) are free to store these values in a SharedPreferences interface (as defined by IAB's CCPA Compliance Mechanism) instead of passing them via the new APIs, and the SDK will read the values as a fallback.

Use the following methods on ANUSPrivacySettings:

// Set the IAB US Privacy String in the SDK
ANUSPrivacySettings.setUSPrivacyString(context, "1YNN")

// Get the IAB US Privacy String that will be sent in the request
val privacyString: String? = ANUSPrivacySettings.getUSPrivacyString(context)

// Clear the previously set IAB US Privacy String
ANUSPrivacySettings.reset(context)

// Set the IAB US Privacy String in the SDK
ANUSPrivacySettings.setUSPrivacyString(context, "1YNN");

// Get the IAB US Privacy String that will be sent in the request
String privacyString = ANUSPrivacySettings.getUSPrivacyString(context);

// Clear the previously set IAB US Privacy String
ANUSPrivacySettings.reset(context);

Children's Online Privacy Protection Act (COPPA)

The U.S. Children's Online Privacy Protection Act (COPPA) applies when your app's ad requests are directed to children under the age of 13. When COPPA is enabled, the SDK sends user.coppa = true in the ad request so downstream systems can restrict the collection of personal information for those users.

Use the SDKSettings.setCOPPA(boolean) API to signal that the current session is subject to COPPA. The value is applied to every subsequent ad request until it is changed. Default value is false.

Use the following methods on SDKSettings:

// Enable or disable COPPA for the current session
SDKSettings.setCOPPA(true)

// Check whether COPPA is currently enabled
val coppa: Boolean = SDKSettings.getCOPPA()

// Enable or disable COPPA for the current session
SDKSettings.setCOPPA(true);

// Check whether COPPA is currently enabled
boolean coppa = SDKSettings.getCOPPA();

Global Privacy Platform (GPP)

Global Privacy Platform is a single protocol designed to streamline transmitting privacy, consent, and consumer choice signals from websites and apps to ad tech providers. These signals are packaged in a standardized, easily communicated payload called a GPP String. The pre-parsed GPP data as well as the GPP string shall be stored under SharedPreferences (Android). This will allow the following:

• Vendors to easily access GPP data.
• GPP data to persist across app sessions.
• GPP data to be portable between Consent Management Platforms (CMPs) to provide flexibility for a publisher to exchange one CMP SDK for another.
• Vendors within an app to avoid code duplication, by not requiring to include a GPP string decoder while still enabling all typical use cases.

The Android SDK will then read the values from SharedPreferences which is then passed to the ad call. Following are the strings SDK will query from:

Digital Services Act (DSA)

The Digital Services Act (DSA) oversees online intermediaries and platforms, where its primary objective is to curb illegal and harmful activities on the internet and to mitigate the dissemination of disinformation. The DSA is a key legislative measure by the European Union aimed at enhancing transparency in digital advertising, with a core objective of promoting transparency, accountability, and user protection in online services.

Set and retrieve DSA values in the SDK

The SDK passes these values to the ad call.

Use the following methods on ANDSASettings:

// Set DSA information requirement (0=Not required, 1=Supported, 2=Required, 3=Required + Online Platform)
ANDSASettings.setDSARequired(1)

// Set publisher render behavior (0=Can't render, 1=Depends on adrender, 2=Will render)
ANDSASettings.setPubRender(0)

// Set the transparency list
ANDSASettings.setTransparencyList(arrayListOf(
    ANDSATransparencyInfo("example.com", arrayListOf(1, 2, 3)),
    ANDSATransparencyInfo("example.net", arrayListOf(4, 5, 6))
))

// Set DSA information requirement (0=Not required, 1=Supported, 2=Required, 3=Required + Online Platform)
ANDSASettings.setDSARequired(1);

// Set publisher render behavior (0=Can't render, 1=Depends on adrender, 2=Will render)
ANDSASettings.setPubRender(0);

// Set the transparency list
ArrayList<ANDSATransparencyInfo> transparencyList = new ArrayList<>();
transparencyList.add(new ANDSATransparencyInfo("example.com", new ArrayList<>(Arrays.asList(1, 2, 3))));
transparencyList.add(new ANDSATransparencyInfo("example.net", new ArrayList<>(Arrays.asList(4, 5, 6))));
ANDSASettings.setTransparencyList(transparencyList);

Retrieve DSA Response values

Use the following methods on ANDSAResponseInfo:

val banner = BannerAdView(this)
banner.placementID = "1"
banner.setAdSize(300, 250)
banner.adListener = this
banner.loadAd()

override fun onAdLoaded(ad: AdView?) {
    //   The example uses `banner`. For other ad units, use:
    //   videoAd.adResponseInfo.dsaResponseInfo
    //   nativeAdResponse.adResponseInfo.dsaResponseInfo  (in NativeAdRequestListener.onAdLoaded)
    //   interstitial.adResponseInfo.dsaResponseInfo
    banner.adResponseInfo.dsaResponseInfo?.let { info ->
        val behalf: String? = info.behalf          // Advertised on behalf of
        val paid: String? = info.paid              // Paid by
        val adRender: Int = info.adRender          // 0 = won't render, 1 = will render
        for (t in info.transparencyList) {
            val domain: String = t.domain
            val params: ArrayList<Int> = t.getDSAParams()
        }
    }
}

BannerAdView banner = new BannerAdView(this);
banner.setPlacementID("1");
banner.setAdSize(300, 250);
banner.setAdListener(this);
banner.loadAd();

@Override
public void onAdLoaded(AdView bav) {
    //   The example uses `bav`. For other ad units, use:
    //   videoAd.getAdResponseInfo().getDSAResponseInfo()
    //   nativeAdResponse.getAdResponseInfo().getDSAResponseInfo()  (in NativeAdRequestListener.onAdLoaded)
    //   interstitial.getAdResponseInfo().getDSAResponseInfo()
    ANDSAResponseInfo info = bav.getAdResponseInfo().getDSAResponseInfo();
    if (info != null) {
        String behalf = info.getBehalf();          // Advertised on behalf of
        String paid = info.getPaid();              // Paid by
        int adRender = info.getAdRender();         // 0 = won't render, 1 = will render
        for (ANDSATransparencyInfo t : info.getTransparencyList()) {
            String domain = t.getDomain();
            ArrayList<Integer> params = t.getDSAParams();
        }
    }
}

Related

• Publisher-side user opt-out (Do Not Track) for Android