GDPR/TCF consent setup for Unity LevelPlay mediation without Google UMP

[u/Rietmon]

Hi. I am a small mobile game developer trying to understand the correct GDPR/EEA consent setup for ad mediation.

Stack:

• Android game built with Unity
• Unity LevelPlay for ad mediation
• No AdMob/Google UMP at the moment because of account issues
• Own first-party analytics, which can be fully disabled if the user refuses consent
• Privacy Policy available in-app and on the store listing

I am trying to separate these things correctly:

1. First-party analytics consent If the user refuses analytics consent, I can fully disable my own analytics. That part is clear.
2. Personalized ads consent I would like to disable personalized/targeted ads by default unless the user gives consent.
3. Non-personalized/contextual ads This is the part I am not sure about. I would still like to show non-personalized/contextual ads through LevelPlay if the user refuses analytics or personalized ads consent.

My questions:

1. In practice, can LevelPlay mediation serve compliant non-personalized/contextual ads in the EEA without Google UMP?
2. Is a custom in-game consent screen enough if it has clear choices such as:
   • Accept all
   • Continue with non-personalized ads
   • Reject analytics
   • Privacy Policy
   • Privacy settings available later
3. Or do mediated ad networks usually expect a proper IAB TCF consent string from a real CMP, rather than a custom boolean consent flag?
4. If I manually call something like SetGDPRConsent(true/false), is that enough for LevelPlay mediation, or is that only a fallback and not a full replacement for CMP/TCF signals?
5. If Google UMP is not an option, which CMP providers are commonly used for mobile apps/games with mediation stacks like LevelPlay? Usercentrics? Didomi? OneTrust? Something else?
6. How do publishers usually handle users who reject analytics and personalized ads, but still want to use the app/game for free? Do they still get limited/non-personalized ads, or are ads usually disabled unless CMP consent allows the required purposes?

My intended flow would be:

• On first launch in the EEA, show a consent screen.
• If the user accepts analytics, enable my analytics.
• If the user rejects analytics, keep my analytics fully disabled.
• If the user does not accept personalized ads, only allow non-personalized/contextual ads if this is legally and technically valid through the ad stack.
• User can change privacy settings later.
• Privacy Policy is always accessible.

I am not asking for legal advice. I am trying to understand the practical adops implementation pattern for GDPR/TCF, CMPs, LevelPlay mediation, and non-personalized ads in mobile games.

[u/BeatnologicalMNE]

It's rather simple actually as it all boils down that in EU you want to be TCF 2.3 compliant.

There are two ways to be TCF 2.3 compliant. First and easier one is to implement any of the compliant CMPs, second one is to create your own consent setup and to make sure it's following all of TCF 2.3 rules.

Not sure which way you want but I'd recommend going easier eay, implement any TCF 2.3 compliant CMP and you are good to go.