Prebid Mobile Guide to Privacy Regulation

Prebid Mobile Guide to European Ad Inventory and Providing Notice, Transparency and Choice (GDPR)

Framework APIs

Prebid Mobile provides two APIs for app publishers to use with the Framework. These APIs allow you to:

  • Define whether European privacy regulations should apply
  • Set the IAB Europe (IAB) consent string

This information will be persisted by Prebid Mobile and will be added to each ad call. Publishers/Consent Management Platforms (CMPs) are free to store these values in an NSUserDefaults/SharedPreferences interface (as defined by Mobile In-App CMP API v1.0: Transparency & Consent Framework) instead of passing them via the new APIs, and Prebid Mobile will read the values as a fallback.

Publishers are responsible for providing notice, transparency and choice and collecting consent from their users in accordance with the Framework policies, either using their own CMP or working with a vendor.

All vendor SDKs (including mediation SDKs) are responsible for looking up approved vendor and consent information on their own.

California Consumer Privacy Act (CCPA)

Notice and Opt out signal

Prebid mobile supports the IAB US Privacy signal implementation for CCPA. Publishers will be required perform the following actions:

  • Collect notice and opt out signals from eligible CCPA users
  • Translate notice and opt-out signals into IAB US Privacy String format
  • Store IAB US Privacy signal in NSUserDefaults for iOS or SharedPreferences for Android for persistent storage allowing access for vendors per IAB recommendations

The job of the Prebid SDK will:

  • Read from NSUserDefaults (iOS) or SharedPreferences(Android) for US Privacy signal
    • Prebid SDK will look for the key “IABUSPrivacy_String”, all other key names or spellings will be ignored
    • If the “IABUSPrivacy_String” key is present with a non-empty string value, the Prebid SDK will relay the privacy string to Prebid Server in the regs.ext.us_privacy extention
  • Not perform or make any attempt to validate or ensure correctness of the US Privacy string
  • Not strip any user data or signaling of the request regardless of Notice and Opt out signal

It is worth noting Prebid Server will be a passthrough as well and will not validate format or correctness of US Privacy signal nor strip any user data from the request either, even if the presence of an opt out.