Last May, Google announced that later in the year, it would require everything using Google AdMob, Google AdManager and Google AdSense to collect consent from users through a Google-certified CMP. However, the deadline was pushed back to January 16 2024. So now that deadline has passed, how has the industry reacted?

In this guest post, GameBiz Consulting’s Božo Janković, along with his team, take a deep dive into how the top 100 grossing games (in addition to other influential games) responded to Google’s CMP requirements. Here he shares actual CMP stats from GameBiz Consulting clients in order to highlight best practices and some interesting insights… 

---

As I wrote in my previous articles and on my LinkedIn. Google announced that they would stop showing ads to users in the EEA and UK regions unless the publishers implement a Google-certified CMP that would enable them to collect TCF 2.2 compliant consent. The deadline for implementation was January 16 2024, which has recently passed, but even though Google hasn’t made any official statements, it seems that Google has only started to gradually enforce this policy from February 1 and will fully enforce it by the end of the month.

What games were covered?

Together with my team, I analysed more than 120 games to better understand how the mobile video games industry responded to Google’s requirements. We covered the top 100 grossing free-to-play mobile games, according to data from App Magic for December 2023. and we added the top 10 most downloaded games as well as some games from the kids category.

We analysed all the games after January 18, a couple of days after the official deadline.

Of the top 100 grossing games, 63 didn’t have a “Contains Ads” tag on their Google Play Store page, which was the indication we used to categorise them as games that don’t use ads as part of their monetisation strategy. Also, out of the top 100 grossing games, 34 of them were focused on the Asian market (which we defined as making more than half of their revenue from one of, or a combination of, two of the following countries: Japan, China, South Korea, and India).

When we excluded the games mentioned above and added games outside of the top 100 grossing list, we manually checked 61 games for their CMP implementation, and this will be the total pool of games we will be referring to in this article moving forward.

How many games have CMP implemented?

Only 28% of the games we checked had a CMP implemented (17 games in absolute numbers). That means almost three-quarters of the games relying on ads to monetise their users didn’t have a CMP implemented.

So why haven’t more games implemented a CMP? We can think of several potential reasons:

1. Google’s policy only impacts the ad monetisation of users coming from the EEA and UK regions. Games that don’t have a significant ad revenue stream coming from these countries simply don’t have the motivation to implement the CMP. Among GameBiz clients, these regions represented on average 27.4% of revenue (but ranging from 0.2% to 95.1%).
   
   
2. Right now, CMP is a requirement only for Google ad network. Other networks such as Meta Audience Network, UnityAds, ironSource, AppLovin, Mintegral, and others don’t have this requirement. According to data from GameBiz clients, around one-third of ad revenue from these regions is coming from Google. That means that some developers might have taken a calculated choice not to implement a CMP and prioritised other tasks instead. Other ad networks requiring TCF 2.2 are Amazon Publisher Services, Verve Group, and Ogury, so it will be interesting to see how the big networks will move forward and if that has any impact on the CMP adoption rates among publishers.
   
   
3. Some publishers might be waiting to see the industry's best practices before they actually go live with their own implementation.

Lastly, as a comparison, CMP adaptation is significantly lower than ATT adaptation, which, as we found out in our research almost three years ago, just days after the ATT came into force, was at 42%.

Which CMP providers are used the most?

Out of 17 games with the CMP implemented, we were surprised to discover that 13 have chosen Google as their CMP provider. The remaining games used Sourcepoint or OneTrust. OUTFIT7 was the only company that was using its own CMP. Interestingly, other big-name providers that were mentioned by quite a few publishers we talked to - namely Didomi and Usercentrics, were completely absent.

According to a thorough analysis we conducted, Google CMP has two key advantages over other solutions in the market:

1. It’s free.
   
   
2. Major ad mediation platforms have made updates to their own SDKs, making it much easier to integrate Google’s CMP from the development perspective, and most of how the CMP works is quite automated from the technical perspective. For more details, make sure to check the documentation of the mediation provider you are using.

    On the other hand, Google comes with several disadvantages compared to the paid solutions:

1. Extremely limited customisation options.
   
   
2. Not possible to merge the CMP pop-up with the Terms of Service and Privacy Policy pop-up (with the aim of reducing the number of pop-ups for users and potential friction points).
   
   
3. Impossible to have different settings between different countries (for example, to have a “Reject all” button in some countries, and use the “Manage options" button in other countries). Since there are no country-specific settings, this means that with Google, publishers need to choose whether they will go with a legally safer approach (but likely with a lower opt-in rate) or with a somewhat more risky approach (likely to result in a higher opt-in rate).
   
   
4. No AB testing is available (which, by the adoption rate of CMPs in the first place might not be a crucial feature publishers are missing).
   
   
5. No customer support.

Do the games show the option to reject consent on the first UI layer?

All of the games we checked are showing “Manage Options” and not “Reject All” buttons. We used VPN to check the implementation in the UK/Germany and France.

Clearly, publishers that have already implemented the CMP message have done so in a way that is aimed at achieving the highest possible opt–in rate. However, this strategy bears some legal risks, keeping in mind that certain countries have tended to be more strict regarding personal data processing. For example:

1. France: information banners are still not compliant because they do not allow the user to refuse the deposit of cookies as easily as to accept it; CNIL (Commission Nationale Informatique & Libertés) has been quite active in enforcing GDPR and particular requirements and has issued quite a few fines on the subject: Google fined 150 million EUR and Facebook 60 million EUR. Google followed up by updating their cookie notice. TikTok fined 5 million EUR.
   
   
2. United Kingdom: One clear example of often harmful design are cookie consent banners. A website’s cookie banner should make it as easy to reject non-essential cookies as it is to accept them.
   
   
3. Spain: The Agency incorporates into the new version of the Guide the criteria of the European Committee, which states that the actions of accepting or rejecting cookies must be presented in a prominent place and format, and both actions must be at the same level, without making it more complicated.

It will be interesting to see how the regulators from these and other countries will treat mobile games and their CMP implementation practices in the coming period.

How many partners are featured in the consent message?

Virtually all of the CMP pop-ups we’ve seen have listed around 200 vendors in their list. The only exception was Outfit7, which featured around 800 vendors. As a reminder, as one of the novelties that the latest version of the TCF brings (2.2), the number of vendors has to be featured in the first UI layer of the CMP flow.

For reference, right now, there are more than 800 IAB-registered vendors, and of course, game developers are also working with some vendors that are not registered with IAB.

The fact that all implementations we checked had around 200 of them coincides with something that can be found within Google’s CMP settings - a default list of vendors that Google calls “Commonly Used Ad Partners”, and it includes 190 vendors. So, it seems as if publishers were simply accepting this default list and adding a few vendors from their own list.

Games that we handpicked had significantly fewer vendors listed - less than 20, but they are not really representative of what the majority of the games are doing.

How are games handling Terms of Service and Privacy Policy in the new onboarding flow?
This is an interesting one! Out of 17 implementations:

• Eight were not showing the Terms of Service/Privacy Policy at all.
• Eight were showing the Terms of Service/Privacy Policy pop-up separately from the CMP pop-up. This can, of course, be a consequence of the feature set that Google CMP has - which doesn’t include the option to add a notice about Terms of Service and Privacy Policy within the CMP message. It would be interesting to see if these games had any impact on their D1 retention due to an additional pop-up.
• One was showing Terms of Service/Privacy Policy together with the CMP, and this one exception was Voodoo (which was previously fined by France’s privacy authority CNIL with 3 million EUR back in December 2022 “for using an essentially technical identifier for advertising without the user's consent”)

Let’s take a look at Voodoo's implementation in their game Snake vs. Block since this is the most interesting case from the above.

The user can only proceed if they state that they are above 16 years of age and if they accept the Privacy Policy. However, they can proceed even if they don’t agree to personalised ads. We also want to highlight that Voodoo has only 24 vendors on their list. 

Is the ATT pop-up shown before or after the CMP pop-up on iOS devices?

Interestingly, even though the guidelines from Google itself are clear - the ATT pop-up should be shown AFTER the CMP pop-up, we’ve seen the implementations of the reverse order as well, more than once. You can check out the video below for how Google’s representative addresses the topic (forward to the 8th question, which is at 8:14 of the video). One of the benefits of showing the ATT pop-up after the CMP pop-up is this, in Google’s words: - If the user declines Purpose 1 on the CMP pop-up, then there is no need to show the ATT, since the developer cannot use the IDFA.

While discussing games that show ATT before the CMP pop-up, we want to mention the implementation in the game Outlets Rush by Supercent. They have a very interesting implementation in which they renamed the “Consent” button into the “Play game” button. It would be intriguing to know if they actually managed to improve their opt-in rate thanks to this.

Have publishers that are not using ads to monetise their users implemented the CMP?

No. We checked a dozen games on the top-grossing chart from the biggest publishers in the market, and not a single one of them has implemented the CMP.

Why would those publishers implement the CMP?

According to previous Google communication, coinciding with the Digital Markets Act (DMA) coming into effect for the gatekeepers, starting 6th March 2024. If consent is missing for EEA users, then the consent value is determined as not consented. Data from unconsented EEA users won't be processed and cannot be used for ad personalisation using Customer Match. To adhere to the EU user consent policy and continue using Customer Match for users in the European Economic Area (EEA), advertisers must integrate with the Google Ads API v15. In communication with Google’s representatives, they confirmed this also applies to the UK, even though it’s not mentioned above. Also, in their words, campaigns targeting EEA/UK users will die down over the course of a maximum of a few weeks if the Google-certified CMP is not implemented.

So the CMP requirements are important not only for publishers using ad monetisation but also for any publisher doing significant UA on Google in the EEA and the UK.

This also brings us to whether the CMP pop-up can be postponed and shown only just before the ads are about to show. The idea is that this would prevent publishers from disturbing users early on since some of them will never get ads or will leave before the ads are unlocked. However, considering the UA aspect, it seems that this is not a valid tactic because data wouldn’t be available until the ads are triggered.

With that in mind, we wanted to share what we’ve observed in the case of King's games.

On app start, we didn’t see any CMP pop-up; however, from their Settings menu, we could trigger the CMP flow. We were opening the app from the UK (real location) and also from a few EEA countries (via VPN), and the result was always the same - no pop-up, but the flow can be triggered from the settings.

It takes a few steps to find it too. To trigger the CMP flow, go to Settings >> My Account >> Privacy and Security >> Personalised Ads. Their CMP implementation doesn’t seem even TCF 2.2 compliant since the number of vendors is not clearly stated on the first UI screen of the CMP flow.

By the way, does anyone remember how King came up with a creative way to explain its Privacy Policy to its users when it launched something called Privacy Saga in 2022? It won them several awards, and it is probably, to date, the most engaging way in which one mobile game explains its Privacy Policy to its users.

Give me some data! What are the CMP stats that we see?

Now, we don’t know the opt-in rates for any of the examples we listed above. However, we have data from our clients and their games that we are ready to share.

Below is the data for some of the games we are managing.

We can see that opt-in rates differ quite a lot depending on the game, even among similar games with exactly the same CMP implementation.

Overall, the opt-in rate is anywhere between 64% and 90%. In our case, minimum numbers are similar between the platforms, and so are the average ones, but the maximum opt-in rate achieved was higher on iOS than it was on Android.

Also, the opt-in rates we achieved with other CMP solutions were higher on average than on Google’s CMP (82.6% vs. 72.9%), but we want to stress that high opt-in rates can be achieved with Google’s CMP solution too.

That’s a wrap!

That pretty much sums it up!

By the looks of it, it seems that the mobile games industry wasn't too keen on complying with Google's TCF requirements or even concerned about its performance. Even the top-performing mobile games have a lot to improve upon or are yet to implement the CMP.

Edited by Paige Cook