How Top 100 Grossing Games Responded to Google’s CMP Requirements

How Top 100 Grossing Games Responded to Google’s CMP Requirements

Google’s recent policy shift, which I previously discussed in more detail, mandates that publishers must implement a Google-certified Consent Management Platform (CMP) to continue displaying ads to users in the EEA and UK, ensuring compliance with TCF 2.2 consent standards.

The deadline for this requirement was January 16, 2024. Although there hasn’t been an official statement from Google, it appears that the enforcement of this new policy is set to start gradually from February 1st, aiming for full enforcement by the end of the same month.

In this article, my team and I examined the reaction of the top 100 grossing games to Google’s CMP mandate, alongside other notable games, to shed light on effective practices and critical insights within this realm. We will also present actual CMP statistics, including opt-in rates, from our clients at GameBiz Consulting.

Which Games Did We Examine?

For a better understanding of how the mobile video game industry responds to Google’s requirements, we analyzed more than 120 games based on App Magic data from December 2023. In addition to the top ten most downloaded games, we also included some games from the kids category. We analyzed all the games after 18th January — a couple of days after the official deadline.

Out of the top 100 grossing games, 63 of them didn’t have a “Contains ads” tag on their Google Play Store page. We used this as an indication to categorize them as games that don’t use ads as part of their monetization strategy. Also, out of the top 100 grossing games, 34 were focused on the Asian market (defined as making more than half of their revenue from one or more of the following countries: Japan, China, South Korea, and India).

When we excluded the games mentioned above and added games outside of the top 100 grossing list, we manually checked 61 games for their CMP implementation and this will be the total pool of games we will be referring to in this article, moving forward.

How Many Top 100 Games Have CMP Implemented?

In our analysis, only 28% of games (which equals 17 games) had a Consent Management Platform (CMP) in place. This reveals that more than three-quarters of games, that use ads as a revenue source, do not use a CMP. There are a few reasons why CMPs might not be more widely adopted:

1. Google’s policy, which requires the use of CMPs, only affects the monetization of users from the EEA and UK. If a game doesn’t earn much from ads in these regions, there’s less motivation to implement a CMP. Based on the data from GameBiz clients, these regions, on average, contribute 27.4% to their revenue, although this varies widely from 0.2% to 95.1%.
2. Currently, only Google’s ad network requires a CMP. Other ad networks like Meta Audience Network, UnityAds, ironSource, Applovin, and Mintegral haven’t made this a requirement. With around one-third of ad revenue in these regions coming from Google, some developers might decide it’s not worth the effort to add a CMP, choosing to focus on other tasks instead. Yet, with ad networks such as Amazon Publisher Services, Verve Group, and Ogury starting to require TCF 2.2, it’ll be interesting to see if this influences more developers to adopt CMPs.
3. Some game publishers may be waiting to see how the industry standardizes the implementation of CMPs before they make their move.

What Are The Most Commonly Used CMP Providers?

In our review of 17 games that included a Consent Management Platform (CMP), it was notable that 13 chose Google as their CMP provider. The rest opted for SourcePoint or OneTrust, with Outfit7 being the unique case of developing their own CMP. Surprisingly, despite being frequently mentioned by many publishers we spoke with, popular providers like Didomi and Usercentrics were not found in any of the games we looked at.

Our in-depth analysis highlighted two major benefits of using Google’s CMP over others:

• It’s free.
• It’s easier for developers to integrate with major ad mediation platforms’ SDK updates, and Google’s CMP operates mostly automatically, simplifying the technical process. For additional information, it’s beneficial to refer to your mediation provider’s documentation.

However, Google’s CMP also has its downsides when compared to paid options:

1. The customization possibilities are very limited.
2. It doesn’t allow for combining the CMP notice with Terms of Service or Privacy Policy notices, which could help reduce the number of interruptions for users.
3. You can’t tailor settings for different countries, such as offering a “Reject all” option in some places and a “Manage options” choice in others. This lack of customization forces publishers to decide between being more legally cautious or aiming for higher user opt-in rates.
4. There’s no capability for A/B testing, which might not be a deal-breaker for publishers given the overall slow adoption of CMPs.
5. Google provides no direct customer support for its CMP service.

Do The Games Show The Option To Reject Consent On The First UI Layer?

All of the games we checked are showing “Manage options” and not “Reject all” buttons. We used VPN to check the implementation in the UK, Germany, and France.

Publishers implementing CMP messages are strategizing to maximize opt-in rates from users. This approach, while potentially increasing user consent rates, carries legal implications, especially considering that some countries adopt stricter regulations regarding personal data processing.

For example:

1. France: information banners are still not compliant because they do not allow the user to refuse the deposit of cookies as easily as to accept it [source]; CNIL (Commission Nationale Informatique & Libertés) has been quite active in enforcing GDPR and particular requirements and has issued quite a few fines on the subject:
2. Google fined 150 million EUR and Facebook 60 million EUR [source]. Google followed up by updating their cookie notice [source]
3. TikTok fined 5 million EUR [source]
4. United Kingdom: One clear example of often harmful design are cookie consent banners. A website’s cookie banner should make it as easy to reject non-essential cookies as it is to accept them. [source and source]
5. Spain: La Agencia incorpora a la nueva versión de la Guía el criterio del Comité Europeo, que recoge que las acciones de aceptar o rechazar cookies tienen que presentarse en un lugar y formato destacados, y ambas acciones deben estar al mismo nivel, sin que sea más complicado rechazarlas que aceptarlas. [source]

As we move forward, it will be interesting to see how regulators from these and other countries treat mobile games and their CMP implementation practices.

How Many Partners Are Featured In The Consent Message?

While checking the consent pop-ups in different games, we found that almost all of them showed a list of about 200 vendors. Only Outfit7 stood out, with a list showing around 800 vendors. This is an important point because the latest rules from the TCF (version 2.2) say that games need to show how many vendors they work with right at the start of the consent process.

It’s also worth noting that there are over 800 vendors that games can choose from, listed by the IAB. Plus, some games work with additional vendors not listed by the IAB.

The fact that we saw about 200 vendors in most games suggests that many are using a default list provided by Google’s CMP. This list, called “Commonly Used Ad Partners,” includes 190 vendors. It looks like many games start with this list and then add a few of their own choices.

On the other hand, the few games we looked at more closely had far fewer vendors on their lists, fewer than 20. However, this practice isn’t representative of the broader trend we observed in the majority of games.

How Are Terms Of Service And Privacy Policy Represented In The New Onboarding Flow?

Looking at 17 games that included Consent Management Platforms (CMP), we found a mixed approach to handling Terms of Service and Privacy Policies:

• Eight of the games didn’t display their Terms of Service or Privacy Policy at all.
• Another eight had a separate pop-up for the Terms of Service/Privacy Policy, distinct from the CMP pop-up. This likely stems from the limitations of Google’s CMP, which doesn’t offer the functionality to incorporate Terms of Service and Privacy Policy notices within the CMP notification itself. It would be interesting to analyze whether having an extra pop-up affects the games’ Day 1 retention rates.
• Only one game managed to combine the Terms of Service/Privacy Policy with the CMP in a single pop-up. This exception was Voodoo, a company that had been fined 3 million EUR by France’s privacy authority, CNIL, in December 2022. The fine was for using a technical identifier for advertising purposes without obtaining user consent.

Let’s take a look at Voodoo’s implementation in their game Snake vs. Block, since this is the most interesting case from the above.

The user can only proceed if they state that they are above 16 years of age and if they accept the Privacy Policy. However, they can proceed even if they don’t agree to personalized ads. We also want to highlight that Voodoo has only 24 vendors on their list.

Is The ATT Pop-Up Shown Before Or After The Cmp Pop-Up on iOS Devices?

Interestingly, despite clear guidelines from Google suggesting that the App Tracking Transparency (ATT) pop-up should appear after the Consent Management Platform (CMP) pop-up, we’ve observed several instances where the order was reversed. For further insight, you can refer to a discussion by a Google representative about this topic in this video, specifically at the question located at the 8:14 timestamp. Google highlights one advantage of this sequence: if a user declines “Purpose 1” in the CMP pop-up, then displaying the ATT becomes unnecessary, as the developer won’t be able to use the Identifier for Advertisers (IDFA).

When discussing games that present the ATT before the CMP pop-up, it’s worth mentioning Supercent’s game, Outlets Rush. They’ve taken an innovative approach by renaming the “Consent” button to “Play game.” This creative strategy raises curiosity about whether it has helped enhance their opt-in rates. You can check out the implementation below.

Have Publishers Who Do Not Show Ads Implemented CMPs?

We examined numerous top-grossing games from leading publishers and found that none had implemented a Consent Management Platform (CMP).

The question arises: why would these publishers need to implement CMP? According to previous Google communication, which aligns with the Digital Markets Act (DMA) becoming effective for gatekeepers from 6th March 2024, “If consent is missing for EEA users, then the consent value is determined as not consented. Data from unconsented EEA users won’t be processed and cannot be used for ad personalization using Customer Match. To adhere to the EU user consent policy and continue using Customer Match for users in the European Economic Area (EEA), advertisers must integrate with the Google Ads API v15.” Google’s representatives further clarified that this requirement extends to the UK, despite it not being explicitly mentioned. They also noted that “campaigns targeting EEA/UK users will die down over the course of a maximum few weeks if the Google-certified CMP is not implemented.”

Therefore, CMP compliance is crucial not only for publishers relying on ad revenue but also for those undertaking significant User Acquisition (UA) activities on Google in the EEA and UK.

This raises the possibility of delaying the CMP pop-up until just before ads are shown, to minimize disruption for users who may not encounter ads or might exit before ads are presented. However, considering UA activities, delaying CMP activation until ad display is impractical, as data for UA wouldn’t be available until the ads are activated.

Regarding King’s games, our direct observation revealed no CMP pop-up at the app’s start. However, we could initiate the CMP process from the Settings menu, both from the UK (our actual location) and several EEA countries (via VPN). The process was consistent across locations: no initial pop-up, but the CMP could be activated from the settings.

Accessing the CMP flow requires navigating through Settings >> My Account >> Privacy and Security >> Personalized Ads. It’s worth noting that King’s CMP implementation appears not to comply with TCF 2.2 standards, as it does not display the number of vendors on the CMP flow’s initial screen.

What are the CMP Opt-In Rates as of Now?

While we don’t have access to opt-in rates for the examples previously discussed, we do have insights from the games managed by our clients that we’re eager to share.

The data reveals significant variations in opt-in rates across different games, even among those with identical Consent Management Platform (CMP) setups. The rates range broadly from 64% to 90%, indicating that player engagement with consent mechanisms can vary widely.

Interestingly, we observed that the minimum and average opt-in rates are consistent across platforms. However, the highest opt-in rate recorded was on iOS, surpassing that on Android.

Moreover, when comparing the performance of various CMP solutions, it’s noteworthy that non-Google CMPs have yielded an average opt-in rate of 82.6%, which is noticeably higher than the 72.9% average rate achieved with Google’s CMP. Despite this difference, it’s important to highlight that it’s entirely possible to attain high opt-in rates using Google’s CMP as well.

What Did We Learn?

Our investigation into the adoption and implementation of Consent Management Platforms (CMP) across top-grossing games reveals a landscape of varied compliance and strategic choices.

While a significant portion of games have yet to adopt CMPs, likely due to the perceived complexity, limited geographical necessity, or the challenges posed by Google’s policy requirements, those that have implemented CMPs show a wide range of opt-in rates, suggesting that the approach to consent can significantly impact player engagement.

The data indicates that, despite the hurdles, achieving high opt-in rates is feasible with careful implementation. This underscores the importance of publishers not only adhering to regulatory requirements but also strategically optimizing their consent mechanisms to balance legal compliance with user experience and retention.