Consent: CMPs, the consent API, states and verification
Applies to TapMind SDK 4.0.0
Consent: CMPs, the consent API, states and verification
What the SDK reads
On every ad request the SDK reads the standard IAB keys from your app's default shared preferences (Android) or standard user defaults (iOS) and forwards them unchanged: IABTCF_CmpSdkID, IABTCF_gdprApplies, IABTCF_TCString, IABTCF_AddtlConsent, IABTCF_PolicyVersion, IABGPP_HDR_GppString, IABGPP_GppSID and IABUSPrivacy_String. The SDK never writes to these keys and never shows a consent prompt. Where GDPR applies, it checks on the device whether Purpose 1 (storage) is consented; if it is not, the SDK stores nothing for that session.
Consent platform setup by region
EEA, United Kingdom, Switzerland. Add TapMind and each advertising partner enabled for your app to your consent platform's vendor list. TapMind has applied to join the IAB Europe Transparency and Consent Framework; our vendor ID will be shown here once issued. Until then TapMind serves contextual ads only in these regions and stores nothing on the device there. TapMind declares Purpose 1 and Purposes 3 and 4 under consent; Purposes 2, 7, 9 and 10 under legitimate interest (or consent if your platform asks for it); and Special Purposes 1, 2 and 3. If you use Google ad platforms, your consent platform must be Google-certified; TapMind reads Google's Additional Consent string where present.
United States. Make sure your consent platform writes the IAB GPP string with the US National and applicable state sections, or the US Privacy string; TapMind reads both. Honour the Global Privacy Control where your state requires it.
Canada. TapMind serves contextual ads only in Canada at present; nothing to configure.
India and other consent-based countries. Present a notice covering TapMind and its purposes (your account manager provides the text) and obtain consent; pass the result through your consent platform or the consent API. Without a signal, TapMind serves contextual ads.
The consent API
If you have no consent platform, or use your own notice, pass the user's choices through the consent API: GDPR consent, US do-not-sell, age-restricted user, and consent per scope (personalised ads, cross-app identity, measurement), with methods to clear the values and to read the current privacy state. The exact method names are in the SDK integration guide supplied by your account manager. Values persist until changed or cleared, are sent with the next ad request, and never touch the IAB keys. If your consent platform writes IAB keys, those take precedence.
The three states
Scroll horizontally to view all columns on smaller screens.
| State | Meaning | Effect |
|---|---|---|
| Absent | No consent platform keys present | TapMind decides from the user's country; contextual where consent is required and none exists |
| Pending | A consent platform is present but has not yet written its result | Treated as no consent: the first ads of a session may be contextual while your platform loads |
| Present | A signal exists | Applied on the device and by TapMind's servers |
Withdrawal is reflected on the next ad request. You never set regions in the SDK.
Verifying your setup
Ask your account manager to raise the inspection level for a test device (it reverts automatically after seven days). At level 1 each ad request writes one log line showing the consent state, CMP ID, GDPR applicability, GPP sections, whether storage is permitted, the identifier tier and, if the advertising identifier was not attached, which check stopped it. At level 2 the privacy-state call returns the same fields and, once TapMind is registered, whether TapMind's vendor consent is present in your platform's string. The log never contains the advertising identifier or consent strings.
Scroll horizontally to view all columns on smaller screens.
| Symptom | Likely cause |
|---|---|
| Ads serve but are never personalised | Feature not enabled for your app, country rules, or no consent signal: read the gate result |
| State is pending on every request | Your consent platform is not resolving before the first ad request |
| Vendor consent absent | TapMind is not in your consent platform's vendor list |
| Storage refused | The user declined Purpose 1; the SDK is running statelessly as intended |
| Age flag set unexpectedly | A child-directed or under-age flag is set in your mediation platform's request configuration or through the consent API |
Network endpoints
The TapMind SDK's own endpoints are on srv.tmcadptr.com, a TapMind domain. Ad requests go to https://srv.tmcadptr.com/sdk/v1/ad, with the SDK's diagnostic telemetry attached to the same request, and configuration is fetched from https://srv.tmcadptr.com/sdk/v1/config. Because telemetry travels with each ad request, it is sent whether or not the user has consented; it is used only for crash and responsiveness diagnostics, abuse prevention and invalid-traffic detection (TCF Special Purpose 1), never to select ads or build a profile. If your app uses a network allow-list, add this domain.