Consent
TapMind trust and compliance information for publishers' engineers.
Consent: CMPs, the consent API, and states
What the SDK reads
On every ad request (once consent forwarding is enabled for your app) the SDK reads the standard IAB keys from the app's default shared preferences (Android) or standard user defaults (iOS) and forwards them unchanged: IABTCF_CmpSdkID, IABTCF_gdprApplies, IABTCF_TCString, IABTCF_AddtlConsent, IABTCF_PolicyVersion, IABGPP_HDR_GppString, IABGPP_GppSID, and IABUSPrivacy_String. The SDK never writes to any of these keys, never parses the TC string beyond two on-device checks (TCF purpose 1 and TapMind's vendor bit, where GDPR applies), and never shows a consent prompt.
CMP setup by region
EEA, UK, Switzerland, Canada. Add TapMind and each advertising partner enabled for your app to your CMP's vendor list. TapMind will register with the IAB Europe TCF before serving personalised advertising in these regions; our vendor ID will be listed here once issued. Until then TapMind serves contextual ads only in these regions. Required purposes for TapMind's identifier features once registered: Purpose 1 (store and/or access information on a device) and Purposes 2, 3 and 4 under consent; Purposes 7, 9 and 10 under legitimate interest with a right to object. If you use Google ad platforms, your CMP must be Google-certified; TapMind reads Google's Additional Consent string where present. Partner vendor IDs: see Partners & vendor IDs.
United States. Ensure your CMP writes the IAB GPP string with the applicable US National and state sections, or the legacy US Privacy string; TapMind reads both. Honour the Global Privacy Control where your state requires it and pass it through the GPP signal or the consent API.
India and other consent-based countries. Present a notice covering TapMind and its purposes (use the disclosure text from your account manager) and obtain consent; pass the result through your CMP or the consent API. If no signal is available, TapMind serves contextual ads.
The consent API (no CMP, or your own notice)
TapMindPrivacy.setGdprConsent(Boolean) // null clearsTapMindPrivacy.setDoNotSell(Boolean) // US opt-outTapMindPrivacy.setAgeRestrictedUser(Boolean) // child / under age of consent — suppresses the advertising identifierTapMindPrivacy.setConsent(ConsentScope, Boolean) // ADS_PERSONALISATION · CROSS_APP_IDENTITY · MEASUREMENTTapMindPrivacy.clear()TapMindPrivacy.getPrivacyState() // see Verifying your setupCall the setters whenever the user decides or changes their choice; values persist across app restarts until changed or cleared, are sent with the next ad request, and never touch the IAB keys. Precedence: if your CMP writes IAB keys, those take precedence; your API values are still forwarded for the record.
The three states
Scroll horizontally to view all columns on smaller screens.
| State | Meaning | Effect |
|---|---|---|
| Absent | No CMP keys present | TapMind decides server-side from the user's country; contextual where consent is required and none exists |
| Pending | A CMP is present but has not yet written applicability or a consent string (for example, still loading) | Treated as no consent — the first ads of a session may be contextual while your CMP resolves. This is deliberate. |
| Present | A decoded signal exists | Applied on device (two checks) and server-side |
Withdrawal
When a user withdraws consent — in your CMP, through the API, or in device settings — the next ad request reflects it and the advertising identifier is no longer attached. TapMind applies regional rules server-side; you never set regions in the SDK.