User Consent Flow - cleveradssolutions/CAS-iOS GitHub Wiki

⚡ Before you start
Make sure you have correctly Privacy Regulations.

• Overview flow
• Add User Tracking usage description
• Automatic consent flow
• Manual consent flow
• Privacy options button
• Debug geography
• Custom Consent Logic
  • Request App Tracking Transparency framework
  • Consent in GDPR and Other regions
  • Multi-State Consumer privacy laws

In order for CAS and our ad providers to deliver ads that are more relevant to your users, as a mobile app publisher, you need to collect explicit user consent.

Any businesses established are required to comply with GDPR in Europe, CCPA in California, LGPD in Brazil, PIPEDA in Canada or risk facing heavy fines.

With iOS 14.5 and later, you need to receive the user’s permission through the AppTrackingTransparency framework in order to track them or access their device’s advertising identifier. Read more about Asking Permission to Track and AppTrackingTransparency Framework on Apple developer page

To display the App Tracking Transparency authorization request for accessing the IDFA, update your Info.plist to add the NSUserTrackingUsageDescription key with a custom message describing your usage. Below is an example description text:

<key>NSUserTrackingUsageDescription</key>
<string>Your data will remain confidential and will only be used to provide you a better and personalised ad experience</string>

Some examples include:

• Your data will remain confidential and will only be used to provide you a better and personalised ad experience
• Your data will be used to provide you a better and personalised ad experience
• Your data will be used to create a customized experience tailored to your interests
• Allowing tracking will enable more personalized ads for you
• We try to show ads for apps and products that will be most interesting to you based on the apps you use
• This identifier will be used to deliver personalized ads to you
• This only uses device info for more interesting and relevant ads

To optimize performance and to improve the user experience, you can localize the NSUserTrackingUsageDescription string. Please follow the Documentation > Xcode > Localization instructions to learn how to localize your app.
The table below gives you a variety of localizations that you can use at your discretion.

To get consent for collecting personal data of your users, we suggest you use a built-in Consent Flow, comes with a pre-made consent form that you can easily present to your users. That means you no longer need to create your own consent window.

The user will see the consent flow when your app create CAS Manager. When the user completes the flow, the SDK calls your initialization-completion handler.

let builder = CAS.buildManager()
builder.withCompletionHandler{ initialConfig in
    // The user completes the flow here
    
    // App transparency tracking authorization can be checked via
    // let status = ATTrackingManager.trackingAuthorizationStatus
    
    // Initialize other 3rd-party SDKs
} 

CAS consent flow is enabled by default. You can disable the consent flow by creating CAS Manager withConsentFlow():

builder.withConsentFlow(
    CASConsentFlow(isEnabled: false)
)

Don't forget to apply the configuration by calling the builder.create(...) function.

• Users located in regions that are not covered by information protection
• Users who are subject to COPPA restrictions.

• Users using iOS versions below 14.5
• Users who have indicated that they do not allow apps to ask to track them, by setting Settings > Privacy, Allow Apps to Request to Track
• Users with child accounts, or who are under age 18, who are signed in via their Apple ID
• Users who have already answered so far
• The app does not have a usage tracking description in Info.plist under NSUserTrackingUsageDescription key

Call presentIfRequired() on the CASConsentFlow class. If the consent is required, the SDK loads a form and immediately presents it . The withCompletionHandler is called after the form is dismissed. If consent is not required, the withCompletionHandler is called immediately.

CASConsentFlow()
    .withCompletionHandler { status in
         if status == CASConsentFlowStatus.obtained {
            // User consent obtained.
        }
     }
    .withViewControllerToPresent(controller)
    .presentIfRequired()

Some consent forms require the user to modify their consent at any time. Adhere to the following steps to implement a privacy options button if required.

1. Implement a UI element, such as a button in your app's settings page, that can trigger a privacy options form.
2. When a user interacts with your UI element, call present() to show the form so the user can update their privacy options at any time.

func showPrivacyOptionsForm() {
    CASConsentFlow()
        .withCompletionHandler { status in
             if status == CASConsentFlowStatus.obtained {
                // User consent obtained.
            }
         }
        .withViewControllerToPresent(controller)
        .present()
}

The SDK provides a way to test your app's behavior as though the device was located in the EEA or UK using the WithDebugGeography option.

CASConsentFlow()
    .withDebugGeography(ConsentFlow.DebugGeography.EEA)
#if DEBUG
    .withForceTesting(true)
#endif
    .presentIfRequired();

The CAS does not support your handling of CCPA opt-out values for Meta Audience Network, you must work directly with the network to purposes of your obligations for CCPA compliance.

To learn how to implement Meta Audience Network’s “Limited Data Use” flag, read the Additional Meta AudienceNetwork steps.

The following instructions apply if you are using your own or a third-party party consent mechanism.

To present the authorization request, call requestTrackingAuthorizationWithCompletionHandler:. We recommend waiting for the completion callback prior to initialize ads, so that if the user grants the App Tracking Transparency permission, the CAS mediation can use the IDFA in ad requests.

import AppTrackingTransparency
...
func requestIDFA() {
  ATTrackingManager.requestTrackingAuthorization(completionHandler: { status in
    // Tracking authorization completed. 
    // Start initialize CAS here.
  })
}

For a better user experience, we recommend adding a Pre permission pop-up preceding the call to ATTrackingManager.requestTrackingAuthorization to clarify the permission and data usage to users.

CAS shares these set consent values via adapters to supported mediation partners.

If the user consents to interest-based advertising, set the user consent accepted flag:

CAS.settings.userConsent = CASConsentStatus.accepted

CAS.settings.userConsent = CASConsentStatusAccepted;

If the user does NOT consent to interest-based advertising, set the user consent denied flag:

CAS.settings.userConsent = CASConsentStatus.denied

CAS.settings.userConsent = CASConsentStatusDenied;

Once you set the consent value, CAS will continue to respect that value for the lifetime of your application or until the user consents to interest-based advertising.

California and Virginia laws may require you to display a “Do Not Sell or Share My Personal Information” link or provide other options to users located in those states to opt out of interest-based advertising. You must set a flag that indicates whether users in those states opt out of interest-based advertising or the sale or share of personal information for interest-based advertising.

If a user does NOT opt out of interest-based advertising, set the optInSale flag:

CAS.settings.userCCPAStatus = CASCCPAStatus.optInSale

CAS.settings.userCCPAStatus = CASCCPAStatusOptInSale;

If a user does opt out of interest-based advertising, set the optOutSale flag:

CAS.settings.userCCPAStatus = CASCCPAStatus.optOutSale

CAS.settings.userCCPAStatus = CASCCPAStatusOptOutSale;

You do not need to set this flag for users who are outside California. If you do set this flag for such users, this will not impact how ads are served to them.

🔗 Done! What’s Next?

• Improve ads targeting with Targeting options