How Did Top 100 Grossing Games Respond to Google CMP?

As I wrote in my previous articles (here and here), in May 2023. Google announced that they will stop showing ads to users in the EEA and UK regions unless the publishers implement a Google-certified CMP that would enable them to collect TCF 2.2 compliant consent. The deadline for implementation was 16th January 2024, which has recently passed but even though Google didn’t make any official statements, it seems that Google will only start to gradually enforce this policy from 1st February and will fully enforce it by the end of that month.

In this article, we’ll cover how the top 100 grossing games responded to Google’s CMP requirements but will also include other games that we consider important to reflect on and try to highlight some best practices and other important aspects on this topic.

Apart from that, we will share actual CMP stats (opt-in rate and others) from GameBiz Consulting clients.

What games were covered?

Together with my team, I analyzed more than 120 games to get a better understanding of how the mobile video games industry is responding to Google’s requirements. We covered the top 100 grossing free-to-play mobile games, according to data from App Magic for December 2023. and we added the top 10 most downloaded games as well as some games from the kids category.

We analyzed all the games after 18th January – so a couple of days after the official deadline.

Out of the top 100 grossing games, 63 of them didn’t have a “Contains ads” tag on their Google Play Store page, which was the indication we used to categorize them as games that don’t use ads as part of their monetization strategy. Also, out of the top 100 grossing games, 34 of them were focused on the Asian market (which we defined as making more than half of their revenue from one of, or a combination of two of the following countries: Japan, China, South Korea, India).

When we excluded the games mentioned above and added games outside of the top 100 grossing list, we manually checked 61 games for their CMP implementation and this will be the total pool of games we will be referring to in this article, moving forward.

Read on if you want to find out what we discovered. 😉

#1 How many games have CMP implemented?

Only 28% of the games we checked had a CMP implemented (17 games in absolute numbers). That means that almost three-quarters of the games that are relying on ads to monetize their users didn’t have a CMP implemented. Why haven’t more games implemented a CMP? We can think of several potential reasons:

1. Google’s policy only impacts the ad monetization of users coming from the EEA and UK regions. Games that don’t have a significant ad revenue stream coming from these countries simply don’t have the motivation to implement the CMP. Among GameBiz clients, these regions represented on average 27.4% of revenue (but ranging from 0.2% to 95.1%).
2. Right now, CMP is a requirement only for Google ad network. Other networks such as Meta Audience Network, UnityAds, ironSource, AppLovin, Mintegral, and others don’t have this requirement. According to data from GameBiz clients, around one-third of ad revenue from these regions is coming from Google. That means that some developers might have taken a calculated choice not to implement a CMP and prioritized other tasks instead. Other ad networks requiring TCF 2.2 ar Amazon Publisher Services, Verve, and Oguryso it will be interesting to see how the big networks will move forward and if that has any impact on the CMP adoption rates among publishers.
3. Some publishers might be waiting to see the industry’s best practices before they actually go live with their own implementation.

Lastly, as a comparison, CMP adaptation is significantly lower than ATT adaptation, which, as we found out in our research almost three years ago, just days after the ATT came into force, was at 42%.

#2 Which CMP providers are used the most?

Out of 17 games with the CMP implemented, we were surprised to discover that 13 have chosen Google as their CMP provider. The remaining games used Sourcepoint or OneTrust. OUTFIT7 was the only company that was using its own CMP. Interestingly, other big-name providers that were mentioned by quite a few publishers that we talked to – namely Didomi and Usercentrics, were completely absent.

According to a thorough analysis we conducted, Google CMP has two key advantages over other solutions in the market:

1. It’s free.
2. Major ad mediation platforms have made updates to their own SDKs making it much easier to integrate Google’s CMP from the development perspective and most of how the CMP works is quite automated from the technical perspective. For more details, make sure to check the documentation of the mediation provider you are using.

On the other hand, Google comes with several disadvantages compared to the paid solutions:

1. Extremely limited customization options.
2. Not possible to merge the CMP pop-up with the Terms of Service and Privacy Policy pop-up (with the aim of reducing the number of pop-ups for users and potential friction points).
3. Impossible to have different settings between different countries (for example, to have a “Reject all” button in some countries, and use the “Manage options” button in other countries). Since there are no country-specific settings, this means that with Google, publishers need to choose whether they will go with a legally safer approach (but likely with a lower opt-in rate) or with a somewhat more risky approach (likely to result in a higher opt-in rate).
4. No AB testing is available (which, by the adoption rate of CMPs in the first place might not be a crucial feature publishers are missing).
5. No customer support.

#3 Do the games show the option to reject consent on the first UI layer?

All of the games we checked are showing “Manage options” and not “Reject all” buttons. We were using VPN to check the implementation in the UK/Germany and France.

Clearly, publishers that have already implemented the CMP message have done so in a way that is aimed at achieving the highest possible opt–in rate. However, this strategy bears some legal risks keeping in mind that certain countries have demonstrated a tendency to be more strict when it comes to personal data processing. For example:

1. France: information banners are still not compliant because they do not allow the user to refuse the deposit of cookies as easily as to accept it [source]; CNIL (Commission Nationale Informatique & Libertés) has been quite active in enforcing GDPR and particular requirements and has issued quite a few fines on the subject: Google fined 150 million EUR and Facebook 60 million EUR [source]. Google followed up by updating their cookie notice [source]TikTok fined 5 million EUR [source]
2. United Kingdom: One clear example of often harmful design are cookie consent banners. A website’s cookie banner should make it as easy to reject non-essential cookies as it is to accept them. [source and source]
3. Spain: La Agencia incorpora a la nueva versión de la Guía el criterio del Comité Europeo, que recoge que las acciones de aceptar o rechazar cookies tienen que presentarse en un lugar y formato destacados, y ambas acciones deben estar al mismo nivel, sin que sea más complicado rechazarlas que aceptarlas. [source]

It will be interesting to see how the regulators from these and other countries will treat mobile games and their CMP implementation practices in the coming period.

#4 How many partners are featured in the consent message?

Virtually all of the CMP pop-ups we’ve seen have listed around 200 vendors in their list. The only exception was Outfit7 which featured around 800 vendors. As a reminder, as one of the novelties that the latest version of the TCF brings (2.2), the number of vendors has to be featured in the first UI layer of the CMP flow.

For reference, right now, there are more than 800 IAB-registered vendors and of course, game developers are also working with some vendors that are not registered with IAB.

The fact that all implementations we checked had around 200 of them, coincides with something that can be found within Google’s CMP settings – a default list of vendors that Google calls “Commonly Used Ad Partners” and it includes 190 vendors. So it seems as if publishers were simply accepting this default list and adding a few vendors from their own list.

Games that we handpicked had significantly fewer vendors listed – less than 20 but they are not really representative of what the majority of the games are doing.

#5 How are games handling Terms of Service and Privacy Policy in the new onboarding flow?

This is an interesting one! Out of 17 implementations:

• 8 were not showing the Terms of Service/Privacy Policy at all.
• 8 were showing the Terms of Service/Privacy Policy pop-up separately from the CMP pop-up. This can, of course, be a consequence of the feature set that Google CMP has – which doesn’t include the option to add a notice about Terms of Service and Privacy Policy within the CMP message. It would be interesting to see if these games had any impact on their D1 retention due to an additional pop-up.
• 1 was showing Terms of Service/Privacy Policy together with the CMP and this one exception was Voodoo (which was previously fined by France’s privacy authority CNIL with 3 million EUR back in December 2022 “for using an essentially technical identifier for advertising without the user’s consent”)

Let’s take a look at Voodoo‘s implementation in their game Snake vs. Block since this is the most interesting case from the above.

The user can only proceed if they state that they are above 16 years of age and if they accept the Privacy Policy. However, they can proceed even if they don’t agree to personalized ads. We also want to highlight that Voodoo has only 24 vendors on their list.

#6 Is the ATT pop-up shown before or after the CMP pop-up on iOS devices?

Interestingly, even though the guidelines from Google itself are clear – the ATT pop-up should be shown AFTER the CMP pop-up, we’ve seen the implementations of the reverse order as well, and more than once. You can check out here how Google’s representative addresses the topic (forward to the 8th question which is at 8:14 of the video). One of the benefits of showing the ATT pop-up after the CMP pop-up is this, in Google’s words: – If the user declines Purpose 1 on the CMP pop-up, then there is no need to show the ATT, since the developer cannot use the IDFA.

While we are talking about games that show ATT before the CMP pop-up, we want to mention the implementation in the game Outlets Rush by Supercent. They have a very interesting implementation in which they renamed the “Consent” button into the “Play game” button. It would be very interesting to know if they actually managed to improve their opt-in rate thanks to this.

#7 Have publishers that are not using ads to monetize their users implemented the CMP?

No. We checked a dozen games on the top-grossing chart from the biggest publishers in the market and not a single one of them has implemented the CMP.

Why would those publishers implement the CMP?

According to previous Google communication, coinciding with the Digital Markets Act (DMA) coming into effect for the gatekeepers, starting 6th March 2024. If consent is missing for EEA users, then the consent value is determined as not consented. Data from unconsented EEA users won’t be processed and cannot be used for ad personalization using Customer Match. To adhere to the EU user consent policy and continue using Customer Match for users in the European Economic Area (EEA), advertisers must integrate with the Google Ads API v15. In communication with Google’s representatives, they confirmed this also applies to the UK even though it’s not mentioned in the above. Also, in their words: campaigns targeting EEA/UK users will die down over the course of a maximum few weeks if the Google-certified CMP is not implemented.

So the CMP requirements are not only important for publishers using ad monetization but for any publisher doing significant UA on Google in the EEA and the UK.

This also brings us to the question if the CMP pop-up can be postponed and shown only just before the ads are about to show. The idea is that this would prevent publishers from disturbing users early on since some of them will never get ads or will leave before the ads are unlocked. However, with the UA aspect taken into consideration, it seems that this is not a valid tactic because data wouldn’t be available until the ads are triggered.

With that in mind,  we wanted to share what we’ve observed in the case of King‘s games.

On app start, we didn’t see any CMP pop-up, however, from their Settings menu we were able to trigger the CMP flow. We were opening the app from the UK (real location) and also from a few EEA countries (via VPN) and the result was always the same – no pop-up but the flow can be triggered from the settings.

It takes a few steps to find it too. To trigger the CMP flow, go to Settings >> My Account >> Privacy and Security >> Personalized Ads. Their CMP implementation doesn’t seem even TCF 2.2 compliant, since the number of vendors is not clearly stated on the first UI screen of the CMP flow.

By the way: does anyone remember how King came up with a very creative way to explain its Privacy Policy to its users when they launched something called Privacy Saga back in 2022? It won them several awards and it is probably, to date, the most engaging way in which one mobile game explains its Privacy Policy to its users.

#8 Give me some data! What are the CMP stats that we see?

Now, we don’t know the opt-in rates for any of the examples we listed above. However, we have data from our clients and their games that we are ready to share.

Below is the data for some of the games we are managing.

We can see that opt-in rates differ quite a lot depending on the game, even among very similar games that have exactly the same CMP implementation.

Overall, the opt-in rate is anywhere between 64% and 90%. In our case minimum numbers are similar between the platforms and so are the average ones, but the maximum opt-in rate achieved was higher on iOS than it was on Android.

Also, the opt-in rates we achieved with other CMP solutions were higher on average than on Google’s CMP (82.6% vs. 72.9%) but we want to stress that high opt-in rates can be achieved with Google’s CMP solution too.

That’s a wrap!

That pretty much sums it up!

By the looks of it, it seems that the mobile games industry wasn’t too keen on complying with Google’s TCF requirements or even concerned about its performance. Even the top-performing mobile games have a lot to improve or yet to implement the CMP.

Would love to hear your thoughts and experiences on this topic!