Implement method to provide visibility into actual consent status

[moritz-br]

Is your feature request related to a problem? Please describe.

Using requestConsentInfo() is not enough to determine if a user may be shown ads, not even limited ads. It returns OBTAINED if the user has made choices in the consent form in general and submitted their preferences but isn't indicative of specific consent granted. While AdMob does automatically read consent choices from shared preferences and handles ad serving decisions internally, it's not reliable, serving limited ads - absolutely not legally so - to EEA users even without any consent granted at all. Unfortunately the responsibility of consent management is fully on the developers, no matter what Admob does internally and whether it correctly respects consent choices (it does not)

Describe the solution you'd like

Add a new method that provides clear visibility into consent status. The current situation is a bit complicated. In the past, the native SDKs canRequestAds() would work fine for this, but even that has become unreliable due to Limited Ads 2.0 changes, often returning true even when users declined all consent, making it impossible to determine actual consent status.

Nevertheless, even simply implementing something like this native canRequestAds() method would be a huge upgrade to not having any insight at all and serving ads illegally. Even if it's incorrect in some cases now. That can be mitigated by turning off Limited Ads 2.0 in Admob, making it mostly reliable and correct until Google gets their crap together.

As such I propose implementing the native SDKs canRequestAds() method and adding a disclaimer about usage with Limited Ads 2.0.

Describe alternatives you've considered

Abandoning UMP entirely, but this loses integration benefits and isn't possible with this plugin anyway.

Additional context

This affects EU/EEA developers who need GDPR compliance and developers that need to conform to US state privacy regulations (approx 20 states by end of 2025)

[distante]

I did not understand from where people should get the "consent status" that you mean.

[moritz-br]

Hi,

requestConsentInfo() only tells us if a user has interacted with the consent form - it returns OBTAINED when the user has made any choices and submitted the form. However, this doesn't tell us

• Whether the user actually consented to data storage (TCF Purpose 1)
• Whether personalized or non-personalized ads can be shown
• Whether ANY ads can legally be served to this user

According to Google's docs,

• Purpose 1 consent (Store/access information on a device) is required to serve any ads through AdMob
• Without Purpose 1 consent, "you should not call Google's ad tag" (per Google's Publisher TCF integration docs)
• BUT AdMob's Limited Ads 2.0 will still attempt to serve ads even without Purpose 1 consent

This creates a legal liability where

1. AdMob might serve "limited ads" to users who haven't consented to ANY data processing
2. Developers remain fully legally responsible for GDPR violations (upheld in multiple court cases)
3. We have no programmatic way to know if we're about to violate GDPR

The native Android SDK has a canRequestAds() method that's supposed to indicate whether ads can be requested based on consent status.

ConsentInformation.getInstance(context).canRequestAds()

Consent data is stored in SharedPreferences (Android) / NSUserDefaults (iOS) as TCF strings:

• IABTCF_PurposeConsents - consent for each purpose (Purpose 1 at index 0)
• IABTCF_gdprApplies - whether GDPR applies to this user
• Additional vendor-specific consent strings (but those shouldnt be of relevance as Admob does handle them)

To serve ads legally, Google requires if i'm correct:

• Personalized ads: Consent for Purposes 1, 3, 4 + Legitimate Interest for 2, 7, 9, 10
• Non-personalized ads: Consent for Purpose 1 + Legitimate Interest for 2, 7, 9, 10
• No ads should be served without Purpose 1 consent

Currently, we have no reliable way to make this determination.

There is some documentation about this here: https://support.google.com/admob/answer/9760862

[distante]

So I did some research and I think I will close this as Not Planned.

#canRequestAds() is just a boolean that reads what we are already returning.

Indicates whether the SDK has gathered consent aligned with the app's configured messages.

This method returns false until requestConsentInfoUpdate is called.

Once requestConsentInfoUpdate is called, this method returns true when getConsentStatus returns NOT_REQUIRED or OBTAINED

As I understand we already comply by using the ConsentInformation class. the information in https://support.google.com/admob/answer/9760862 just applies (AFAIK) when you use a custom consent popup. So there is nothing to do. I will pin this topic for future reference..

If you find information that contradicts this please post it.