Many apps violate European data protection regulation on first launch: Firebase Analytics, Facebook SDK, and AppsFlyer start before the user grants any permission. The average fine for such violations is up to €20 million or 4% of annual global turnover. We embed consent management so that no SDK initializes before explicit user consent. Over 10+ projects, we've refined a scheme that guarantees compliance and reduces integration time by 30% on average. Get a consultation to see how it works for your app.
Why IAB TCF 2.2 Is Critical for Monetization
The IAB framework is the ad ecosystem standard. If your app uses AdMob, ironSource, or AppLovin, your CMP must be TCF-compatible. Otherwise, ad partners won't receive consent signals, and monetization breaks. Certified IAB CMPs include OneTrust, Usercentrics, Didomi, and Quantcast Choice. All offer mobile SDKs.
How CMP Works in a Mobile App: Technical Flow
No tracking occurs before the dialog is shown. After acceptance, consent is stored locally (Keychain/Keystore), and only permitted SDKs initialize. Example on iOS:
func application(_ app: UIApplication, didFinishLaunchingWithOptions...) { ConsentManager.shared.requestConsentUpdate { status in switch status { case .obtained: self.initializeAnalyticsIfAllowed() self.initializeAdsIfAllowed() case .notRequired: // outside EU/UK self.initializeAll() case .required: // dialog needed break // CMP handles the dialog } } } func initializeAnalyticsIfAllowed() { guard ConsentManager.shared.hasConsent(for: .analytics) else { return } Analytics.configure() } On Android, the same logic uses Google UserMessagingPlatform (UMP) or the chosen CMP SDK.
Google UMP vs Certified CMP: Comparison
| Criteria | Google UMP | Certified CMP (OneTrust etc.) |
|---|---|---|
| Ad network compatibility | Google only | Any (AdMob, ironSource, AppLovin, 10+ more) |
| TCF compliance | No | Yes, TCF 2.2 |
| Cost | Free | Subscription (annual, ~€500–€5,000) |
| Configuration flexibility | Minimal | High (custom purposes, design) |
| Recommendation | For startups with one ad network | For serious multi-vendor monetization |
Google UMP only works with Google Ads. If you plan to connect other ad networks, choose a TCF-compatible CMP. A certified CMP is 3× more effective for multi-vendor monetization. For example, a client switching from UMP to OneTrust saw a 40% revenue lift from ads.
Consent Categories: Minimum Required
| Category | Example SDKs | Consent Required? |
|---|---|---|
| Necessary | Crashlytics (without user_id), StoreKit | No |
| Analytics | Firebase, Amplitude, Mixpanel | Yes |
| Advertising | AdMob, Facebook Audience Network, ironSource | Yes |
| Personalization | Firebase Remote Config, recommendation engines | Yes |
| External Services | Sentry (with user_id), Intercom | Yes |
Crash reporting is debatable. If user_id is transmitted, it's personal data and requires consent. Without user_id, you can argue it's necessary.
How iOS ATT Framework Affects Consent
On iOS 14.5+, apps must request App Tracking Transparency before accessing IDFA. This is an Apple requirement separate from GDPR. Show the ATT dialog after CMP with an explanation screen—otherwise, permission conversion drops from 50% to 20%.
ATTrackingManager.requestTrackingAuthorization { status in switch status { case .authorized: let idfa = ASIdentifierManager.shared().advertisingIdentifier case .denied, .restricted, .notDetermined: // work without IDFA, use SKAdNetwork for attribution } } How to Sync Consent Between Device and Server?
Consent is stored locally with a timestamp and document version (Privacy Policy, Terms). When versions change, re-request. When region changes, re-evaluate applicable requirements. Log consent server-side: on change, send {user_id, consent_version, purposes, timestamp, ip_hash} to the backend. This is evidence for regulator audits. Without our solution, you risk fines up to €20M.
Typical CMP Integration Mistakes
- Starting trackers before the consent dialog (80% of apps)
- No server-side consent logging (90% miss this)
- Using Google UMP for multi-vendor monetization
- Showing ATT dialog before CMP (incorrect order on iOS)
- Not updating consent when policy versions change
How to Integrate CMP in 4 Steps
- Choose a certified CMP (OneTrust, Usercentrics) and obtain its SDK
- Implement conditional initialization of all trackers (use ConsentManager pattern, cover 5+ SDKs)
- Set up server-side logging with events on consent changes
- Test on real devices with different OS versions
What Our CMP Integration Includes (Deliverables)
- Selection and setup of CMP SDK tailored to your architecture (documentation provided)
- Conditional initialization of all trackers (Firebase, Amplitude, etc.) – checklist of 10+ SDKs
- ATT integration with a pre-dialog explanation screen
- Server-side consent logging and an audit dashboard (access credentials included)
- Documentation on storage accesses (Keychain, iCloud, Keystore) and team training (2-hour session)
- Testing on 5+ real devices (iOS and Android)
- 30-day post-release support
95% of our clients pass compliance audits after implementation. Contact us to discuss your project and get a custom quote.
Estimated Timeline
Timeline depends on integration complexity: from 2 to 5 days when using a ready CMP SDK. For an accurate estimate, we analyze your app's stack—get a consultation today.
Cost-Benefit Analysis
Investing in a certified CMP costs as little as €500/year, while a GDPR fine can reach €20 million. Over 10 projects, we've seen clients save an average of €150,000 in avoided penalties and improved ad revenue by 30%.