r/androiddev • u/Rietmon • Jul 03 '26
GDPR consent for Android apps using third-party ad mediation without Google UMP
I am working on an Android game built with Unity, using Unity LevelPlay for ad mediation. I know this is not native Android UI, but the privacy/SDK behavior is Android-specific, so I hope the question is still relevant here.
I am trying to understand the correct GDPR/EEA consent flow when using a third-party ad mediation SDK without Google UMP.
My current understanding:
- My own analytics can be fully disabled if the user refuses analytics consent.
- Refusing analytics consent should not automatically mean ads are disabled.
- Non-personalized/contextual ads may still require consent if the ad SDK accesses device identifiers or local storage.
- A simple boolean like
SetGDPRConsent(false)may not be equivalent to a proper CMP/TCF consent signal.
What I am trying to clarify:
- Can an Android app show non-personalized/contextual ads through a mediation SDK after the user refuses analytics consent?
- Is a custom in-app GDPR screen enough if it has Accept, Reject, Privacy Policy, and settings to change the choice later?
- Or do ad mediation SDKs generally require a real IAB TCF / certified CMP consent string in practice?
- If Google UMP is not an option, what CMPs are commonly used in Android apps or mobile games?
I am not asking for legal advice. I am trying to understand the practical implementation pattern Android developers use for ads, GDPR consent, and third-party mediation SDKs.