Mobile & OTT/CTV App Consent Overview

Introduction to Mobile & OTT/CTV App Consent

Consumers are turning to their devices to consume content on the go. With over 6.3 billion smartphone users across the world, it’s no surprise that the mobile app industry is thriving. App usage and smartphone penetration are still growing at a steady rate, without any signs of slowing down in the foreseeable future. As app usage grows, global privacy regulations like the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR) are putting a brighter spotlight on mobile app technologies and how apps collect data and share it with third parties.

Additionally, tech giants such as Apple and Google have tightened privacy policy standards for iOS and Android applications. Companies developing mobile solutions and delivering upon mobile-first strategies are seeking solutions to build intelligent, data-driven applications that respect users' privacy, build trust and fuel brand loyalty.

OneTrust Mobile App Consent gives organizations an understanding of the tracking technologies that may exist on their app as well as provides a mechanism to properly capture user consent and preferences. This solution scans an organization’s mobile app for privacy permissions, frameworks and SDKs and generates a report to help business units and developers understand the app’s privacy health. In addition, the platform provides organizations flexible methods to collect user consent within their applications.

Mobile & OTT/CTV App Consent is part of the Privacy & Data Governance cloud with OneTrust. To learn more, see the Mobile App Consent knowledge base.

Module Benefits

  • Scan your mobile app to identify third-party tracking technologies

  • Know the third parties it's sharing data with

  • Collect valid consent from your users

  • Give users greater control over preferences

  • Maintain records of consent for compliance

Regulatory Compliance

Assists enabling compliance of data privacy with global laws and new device policies

Collect valid consent

Capture across various devices who consented, when it occurred and what they were told upon consenting

Deploy and sync across your technology systems

Deploy on multiple devices and frameworks (iOS, Android, React, Native, Flutter, Cordova, and Ionic)

Maximize Consent Rates with Advanced Configuration

Experiment with templates and A/B testing, and measure success with detailed dashboards and analytics

Typical Users

Admins or key users of Mobile App Consent would report to or have the following titles:

  • Head of Digital Marketing

  • Data Privacy Officer

  • Data Compliance Officer

  • Product Manager

  • Software Developer

Mobile App Consent Module Terminology

Mobile App Consent Terminology

Terminology Context/Description

Mobile App Scanning

OneTrust application can perform scans of your uploaded .ipa or .apk files to retrieve the list of available permissions and SDKs in your app. Our mobile app scanner can assess what's present in the application, check against our permissions database and SDK Library to match and compare those findings, and then post those results back to the OneTrust application for review.

Customizing Mobile Templates

You can customize the layout, styling, content, and behavior of your banner template. This allows you to create a look and feel that matches your organization's branding style and behavior preferences. You can also select which frameworks to comply with.

OneTrust SDKs (Software Development Kit) - Implementing SDKs

Differences between CMP SDKs, Preference SDKs, and CTV SDKs with their respective use cases when implementing Mobile App Consent for apps.

CMP SDKs

CMP SDKs allow Publishers to display a consent Banner and Preference Center to collect users consent for various SDK categories and take action on that consent with their downstream third-party advertising and analytic SDK vendors. All three CMP SDKs support the same or similar features for mobile app compliance on different technology platforms.

Web SDK

This SDK displays a Banner and Preference Center in a mobile web view. The Banner and Preference Center user interface is pre-built by OneTrust in HTML and CSS web languages. Customers can update the content, branding, and customize the CSS to deliver a CMP experience that aligns with the mobile application it's used on.

Native SDK

This SDK is for customers who want greater control over their mobile application CMP user experience. This SDK is designed for customers who wish to design and build their own in-house Banner and Preference Center user interface with native iOS/Android components. Alternatively, customers may also choose to use the pre-built Banner and Preference Center user interface from the demo application upon download.

MAUI SDK

This SDK provides programming support for .NET application projects for customers who wish to design and build their own in-house banner and preference center user interface with native iOS/Android components from a shared code base. Alternatively, customers may also choose to use the pre-built Banner and Preference Center user interface from the demo application upon download.

Unity SDK

This SDK provides programming functions that facilitate the storage and transmission of user consent preferences to and from the OneTrust platform. The SDK also includes programming functions that return data helpful for the creation of user interfaces that display and collect consent preferences. The OneTrust Unity Package consists of the OneTrust CMP SDK (.dll file) and a sample user interface (Scenes, Prefabs, and C# scripts) that demonstrate how to use the SDK. The SDK supports offline mode, and you can customize the sample user interface for your specific needs.

Geolocation Rules

You can assign a Geolocation Rule Group that defines how the consent SDK will behave and appear for users in different locations.

Vendors

Using Cookie Consent, you can add General Vendors outside of the IAB Global Vendor Lists. General vendors enable you to add any vendor you wish to disclose to your OneTrust CMP.

Multi-profile Consent Mobile and CTV

Many Mobile and CTV applications provide the option to host multiple user profiles for a single login. OneTrust can get consent for each of the user profiles and store it locally. When a user switches to a different profile, their consent settings are restored and the consent notifications and broadcasts are sent. If they switch to a profile that does not have consent stored already, the user is automatically prompted for consent.

Framework Examples

OneTrust Mobile App Consent provides a solution that can help organizations fulfill the requirements to comply with many frameworks and certifications.  Below is a list of some of the popular privacy frameworks that Mobile App Consent can help with.

Framework

Framework Description

GDPR

The GDPR is the strongest global privacy law in effect today. Created by the European Union (EU) to regulate how organizations collect, handle, and protect personal data of EU residents. It also defines eight data subject rights that guarantee specific entitlements for individual’s personal data. Ultimately giving individuals more autonomy over their personal information and how it is used. 

CCPA

CCPA compliance means that covered businesses – for-profit entities that fall under the scope of the CCPA – can demonstrably meet obligations set out under the CCPA, including a range of new consumer rights, a new definition of personal information, and new concepts of businesses and service providers in relation to the roles of controller and processor.

IAB TCF

The IAB Transparency and Consent Framework (TCF) is a set of technical specifications and policies that help publishers and advertisers comply with the General Data Protection Regulation (GDPR) and the ePrivacy Directive.

NOYB

In 2021, the privacy activist organization noyb sent out draft complaints to 500+ website owners regarding their cookie banner implementations. These complaints contained specific issues the organization identified and recommended updates. Since then, noyb has continued to communicate with organizations and regulators regarding their cookie banner implementations.

It’s important to remember that EU regulatory authorities and industry frameworks, such as IAB Europe's Transparency and Consent Framework, may have different guidance and interpretations than those recommended by noyb. You should work with your legal advisors to make final decisions regarding if and how you should adjust any cookie settings.

Note:

To review our NOYB Best Practices Guide, read the article here.

LGPD

Brazil passed its General Personal Data Protection Law (LGPD) in 2018. The legislation establishes and protects the rights and freedoms of individuals and provides increased transparency to covered data subjects. The law contains unique definitions of personal data and their authorized uses that count on enforcement by the Brazilian Data Protection Authority (ANPD).

Similar to the GDPR, the LGPD, or Lei Geral de Proteção de Dados, applies to the processing of data by organizations within Brazil, but also to organizations outside Brazil under certain circumstances. LGPD compliance provides significant benefits to data subjects who will be afforded new rights.