SDK Privacy for iOS

The iOS SDK includes client support for Global Privacy Platform (GPP), the General Data Protection Regulations (GDPR), and the California Consumer Protection Act (CCPA) and Digital Services Act (DSA).

The Global Privacy Platform (GPP) enables advertisers, publishers and technology vendors to adapt to regulatory demands across markets. GDPR provides regulations for the processing, movement, and protection of personal data within the European Union. CCPA creates new consumer rights relating to the access to, deletion of, and sharing of personal information that is collected by organizations. The DSA is a key legislative measure by the European Union aimed at enhancing transparency in digital advertising, with a core objective of promoting transparency, accountability, and user protection in online services.

General data protection regulations (GDPR)

In order for our clients to meet their transparency, notice and choice/consent requirements under the GDPR and the existing ePrivacy Directive, Microsoft Monetize supports the IAB Europe Transparency & Consent Framework(the "Framework").

This is a reference for mobile app publishers using the iOS SDK to surface notice, transparency and choice to end users located in the EEA and signal approved vendors and, where necessary, pass consent, to Microsoft Monetize and demand sources and their vendors through the Monetize platform.

The iOS SDK provides three APIs for mobile app publishers to use the Framework. These APIs allow you to:

• define whether the user is located in the European Economic Area (the "EEA") and that European privacy regulations should apply
• set the IAB Europe(IAB) consent string

This information will be persisted by the SDK and will be added to each ad call for applying platform controls.

Publishers/Consent Management Platforms (CMPs) are free to store these values in a SharedPreferences interface (as defined by Mobile In-App CMP API v2.0: Transparency & Consent Framework) instead of passing them via the new APIs, and the SDK will read the values as a fallback.

Use the following methods on ANGDPRSettings:

// Set whether the user is subject to GDPR regulations
ANGDPRSettings.setConsentRequired(true)

// Set the IAB Base64-encoded consent string
ANGDPRSettings.setConsentString("BOMyQRvOMyQRvABABBAAABAAAAAAEA")

// Set the IAB purpose consents (binary string; '1' at index n = consent for purpose ID n+1)
ANGDPRSettings.setPurposeConsents("10101001")

// Set whether the user is subject to GDPR regulations
[ANGDPRSettings setConsentRequired:1];

// Set the IAB Base64-encoded consent string
[ANGDPRSettings setConsentString:@"BOMyQRvOMyQRvABABBAAABAAAAAAEA"];

// Set the IAB purpose consents (binary string; '1' at index n = consent for purpose ID n+1)
[ANGDPRSettings setPurposeConsents:@"10101001"];

Consent and device information logic

The table below describes the actions taken for the different purposeConsents values in combination with consentRequired values.

The iOS SDK provides three APIs that enable SDK users to set, retrieve and clear U.S. Privacy User Signal Mechanism controls. The IAB Tech Lab has formalized and adopted the "us_privacy" string as the mechanism to encode data about the information disclosed to the user and user elections under various US privacy laws, starting with the CCPA.

California Consumer Privacy Act (CCPA)

This information will be persisted by the SDK and will be added to each ad call for applying platform controls.  

Publishers/Consent Management Platforms (CMPs) are free to store these values in a SharedPreferences interface (as defined by IAB's CCPA Compliance Mechanism) instead of passing them via the new APIs, and the SDK will read the values as a fallback.

Use the following methods on ANUSPrivacySettings:

// Set the IAB US Privacy String in the SDK
ANUSPrivacySettings.setUSPrivacyString("1YNN")

// Get the IAB US Privacy String currently in the SDK
let privacyString: String? = ANUSPrivacySettings.getUSPrivacyString()

// Reset the previously set IAB US Privacy String
ANUSPrivacySettings.reset()

// Set the IAB US Privacy String in the SDK
[ANUSPrivacySettings setUSPrivacyString:@"1YNN"];

// Get the IAB US Privacy String currently in the SDK
NSString *privacyString = [ANUSPrivacySettings getUSPrivacyString];

// Reset the previously set IAB US Privacy String
[ANUSPrivacySettings reset];

Children's Online Privacy Protection Act (COPPA)

The U.S. Children's Online Privacy Protection Act (COPPA) applies when your app's ad requests are directed to children under the age of 13. When COPPA is enabled, the SDK sends user.coppa = true in the ad request so downstream systems can restrict the collection of personal information for those users.

Set the coppa property on [ANSDKSettings sharedInstance] to signal that the current session is subject to COPPA. The value is applied to every subsequent ad request until it is changed. Default value is NO.

Use the following property on ANSDKSettings:

// Enable or disable COPPA for the current session
ANSDKSettings.sharedInstance().coppa = true

// Check whether COPPA is currently enabled
let coppa: Bool = ANSDKSettings.sharedInstance().coppa

// Enable or disable COPPA for the current session
[ANSDKSettings sharedInstance].coppa = YES;

// Check whether COPPA is currently enabled
BOOL coppa = [ANSDKSettings sharedInstance].coppa;

Global Privacy Platform (GPP)

Global Privacy Platform is a single protocol designed to streamline transmitting privacy, consent, and consumer choice signals from websites and apps to ad tech providers. These signals are packaged in a standardized, easily communicated payload called a GPP String. The pre-parsed GPP data as well as the GPP string shall be stored under [NSUserDefaults](https:/ developer.apple.com/documentation/foundation/nsuserdefaults#1664798?language=objc) (iOS). This will allow the following:

• Vendors to easily access GPP data.

• GPP data to persist across app sessions.

• GPP data to be portable between CMPs to provide flexibility for a publisher to exchange one CMP SDK for another.

• Vendors within an app to avoid code duplication, by not requiring to include a GPP string decoder while still enabling all typical use cases.

  Note

  If a Publisher chooses to remove a CMP SDK from their app they are responsible for clearing all IABGPP_* vestigial values for users so that vendors do not continue to use the GPP data therein.

  The iOS SDK will then read the values from NSUserDefault which is then passed to the ad call. Following are the strings SDK will query from :

  Key Name	Data type	Description
  IABGPP_HDR_GppString	string	Full consent string in its encoded form. e.g "DBACNYA~CPXxRfAPXxRfAAfKABENB-CgAAAAAAAAAAYgAAAAAAAA~1YNN"
  IABGPP_GppSID	string	Section ID(s) considered to be in force. Multiple IDs are separated by underscore, e.g. “2_3”

Digital Services Act (DSA)

The Digital Services Act (DSA) oversees online intermediaries and platforms, where its primary objective is to curb illegal and harmful activities on the internet and to mitigate the dissemination of disinformation. The DSA is a key legislative measure by the European Union aimed at enhancing transparency in digital advertising, with a core objective of promoting transparency, accountability, and user protection in online services.

Set and retrieve DSA values in the SDK

The SDK passes these values to the ad call.

Use the following properties on ANDSASettings:

// Set DSA information requirement (0=Not required, 1=Supported, 2=Required, 3=Required + Online Platform)
ANDSASettings.sharedInstance().dsaRequired = 1

// Set publisher render behavior (0=Can't render, 1=Depends on adrender, 2=Will render)
ANDSASettings.sharedInstance().pubRender = 0

// Set the transparency list
ANDSASettings.sharedInstance().transparencyList = [
    ANDSATransparencyInfo(domain: "example.com", andDSAParams: [1, 2, 3]),
    ANDSATransparencyInfo(domain: "example.net", andDSAParams: [4, 5, 6])
]

// Set DSA information requirement (0=Not required, 1=Supported, 2=Required, 3=Required + Online Platform)
[ANDSASettings.sharedInstance setDsaRequired:1];

// Set publisher render behavior (0=Can't render, 1=Depends on adrender, 2=Will render)
[ANDSASettings.sharedInstance setPubRender:0];

// Set the transparency list
ANDSASettings.sharedInstance.transparencyList = @[
    [[ANDSATransparencyInfo alloc] initWithDomain:@"example.com" andDSAParams:@[@1, @2, @3]],
    [[ANDSATransparencyInfo alloc] initWithDomain:@"example.net" andDSAParams:@[@4, @5, @6]]
];

Retrieve DSA Response values

Use the following properties on ANDSAResponseInfo:

banner = ANBannerAdView(frame: CGRect(x: 0, y: 0, width: 300, height: 250), placementId: "1")
banner?.delegate = self
banner?.loadAd()

func adDidReceiveAd(_ ad: Any) {
    //   The example uses `banner`. For other ad units, use:
    //   interstitialAd?.adResponseInfo?.dsaResponseInfo
    //   videoAd?.adResponseInfo?.dsaResponseInfo
    //   nativeAdResponse.adResponseInfo?.dsaResponseInfo  (in ANNativeAdRequestDelegate.adRequest(_:didReceiveResponse:))
    if let info = banner?.adResponseInfo?.dsaResponseInfo {
        let behalf = info.behalf                   // Advertised on behalf of
        let paid = info.paid                       // Paid by
        let adRender = info.adRender               // 0 = won't render, 1 = will render
        for t in info.transparencyList ?? [] {
            let domain = t.domain
            let params = t.dsaparams as? [NSNumber]
        }
    }
}

ANBannerAdView *banner = [ANBannerAdView adViewWithFrame:CGRectMake(0, 0, 300, 250) placementId:@"1"];
banner.delegate = self;
[banner loadAd];
self.banner = banner;

- (void)adDidReceiveAd:(id)ad {
    ANBannerAdView *banner = self.banner;
    //   The example uses `banner`. For other ad units, use:
    //   interstitialAd.adResponseInfo.dsaResponseInfo
    //   videoAd.adResponseInfo.dsaResponseInfo
    //   nativeAdResponse.adResponseInfo.dsaResponseInfo  (in [ANNativeAdRequestDelegate adRequest:didReceiveResponse:])
    ANDSAResponseInfo *info = banner.adResponseInfo.dsaResponseInfo;
    if (info) {
        NSString *behalf = info.behalf;            // Advertised on behalf of
        NSString *paid = info.paid;                // Paid by
        NSInteger adRender = info.adRender;        // 0 = won't render, 1 = will render
        for (ANDSATransparencyInfo *t in info.transparencyList) {
            NSString *domain = t.domain;
            NSArray<NSNumber *> *params = t.dsaparams;
        }
    }
}

Apple privacy manifest

The Apple Privacy Manifest describes the data your app or third-party SDK collects. The iOS SDK includes support for the Apple Privacy Manifest file requirement for third-party SDKs, and the Privacy Manifest file is delivered automatically with the SDK. For more information, see Apple privacy manifest.

Related

• Publisher-side user opt-out (Do Not Track) for iOS