Leading Consent Management Platform

Compliant with GDPR, CCPA, COPPA, LGPD, PECR, PDPA, PIPEDA, and more.

Theme

How to integrate UniConsent CMP SDK for Android with mobile apps

UniConsent CMP is a package for handling GDPR IAB TCF 2.4 consent management in Android apps. You can find a demo app integrated with UniConsent CMP in the "demo" directory.

Prerequisites

UniConsent CMP plan with Mobile app support
Android API level 21 or higher
UniConsent CMP SDK package (request from support)

Getting started

Add UniConsentSDK-release.aar into your project's libs/ directory and update your build.gradle:

implementation files('libs/UniConsentSDK-release.aar')
implementation 'androidx.appcompat:appcompat:1.7.1'
implementation 'com.google.android.material:material:1.13.0'
implementation 'com.iabtcf:iabtcf-core:2.0.10'
implementation 'com.iabtcf:iabtcf-decoder:2.0.10'

Before integrating the SDK, customize the consent banner appearance in the UniConsent Dashboard to match your brand and optimize consent rates.

Step 1: Brand Styling in Dashboard

Go to Projects → Select your Project → Settings → Step 5: UI & Style Settings to configure:

Main Button Colour — Set the primary action button color to match your brand
Main Button Text Colour — Adjust text color on the primary button for readability
Background Colour — Set the banner background color to blend with your app
Text Colour — Ensure body text has appropriate contrast

Step 2: Advanced Styling with Custom CSS (Optional)

For more precise control, add custom CSS in the CSS Content field under Step 5. This is recommended to make the banner feel native to your app and achieve the best consent rate:

/* Example: Style the accept button to match your brand */
.unic-btn-accept {
  background-color: #4CAF50;
  border-radius: 8px;
  font-weight: 600;
}

/* Example: Adjust banner font */
.unic-banner {
  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
}

/* Example: Make the reject button less prominent */
.unic-btn-reject {
  background-color: transparent;
  border: 1px solid #ccc;
  color: #666;
}

Tip: A well-branded consent UI that feels native to your app typically achieves higher consent rates. Users are more likely to engage positively with a banner that matches the look and feel they expect.

Both ratios are optional — every display mode works without them. Pass a ratio (a fraction of the screen, greater than 0 and at most 1) only to override the default size; invalid values throw IllegalArgumentException:

Parameter	Applies to	Default when omitted
`heightRatio`	`BOTTOM_SHEET`, `DIALOG`	Sheet: 90% of the screen. Dialog: 70%
`widthRatio`	`DIALOG` only	90% of the screen width, up to 500dp

Ratios that don't apply to the chosen display mode are ignored (FULL_SCREEN ignores both).

Automatically check if consent is expired when the vendorList updates:

// Check if consent should be requested (e.g. first visit, or vendor list updated)
// to check yourself instead of enableAutoLaunch(): subscribe before init(), which runs in the background
// and publishes READY when it finishes (import com.uniconsent.sdk.EventType)
UniConsentCMP.subscribe(event -> {
    if (event.getType() == EventType.READY && UniConsentCMP.shouldRequestConsent()) {
        UniConsentCMP.launchCMP();
    }
});
UniConsentCMP.init(this);

Get the tcString if required:

// Get tcString
UniConsent.getInstance().getTCString();

Read the consent status:

// Read consent status
UniConsent.getInstance().hasIABPurposeConsent(1);
UniConsent.getInstance().hasIABVendorConsent(1);

Reset consent status if required:

// Reset consent status
UniConsent.getInstance().clearData();

Custom First Layer (Agree All / Reject All)

Available from SDK version 26.7.0. If you build your own first-layer consent UI instead of showing the CMP webview, you can save consent directly:

// Grant consent for all purposes, special features and vendors
boolean saved = UniConsent.getInstance().agreeAll();

// Reject all purposes, special features and vendors
boolean saved = UniConsent.getInstance().rejectAll();

Both APIs save the same consent values as the CMP UI flow (IAB TCF keys, additional consent and consent mode signals) and fire the same close event to subscribers.

For users in the US and Canada, both APIs also save the CCPA, US State Privacy and IAB TCF Canada choice that applies to them, by the same rules as the CMP UI, and write the IAB GPP and US Privacy keys. Turn on the API-only modes in the project settings of the UniConsent dashboard so the CMP banner is not shown for those regions.

They also save the cookie categories choice where a cookie categories banner applies (every category, or only Strictly Necessary), and the project's custom purposes and custom vendors.

To know which first layer to show, call getPolicy() (from SDK version 26.10.0). It returns the policy that applies to the user, by the same rules as the CMP: gdpr (IAB TCF), tcfca (IAB TCF Canada), uss (US State Privacy), ccpa, categories (see Cookie Categories below) or none.

UniConsent cmp = UniConsent.getInstance();
if (cmp.shouldRequestConsent()) {
    // the user needs to make a choice: show your first layer for this policy
    String policy = cmp.getPolicy(); // gdpr, tcfca or categories
}

Note: Call these APIs only after init() has completed (e.g. after the READY event). They require the vendor list and project config, which are fetched during initialization, and return false if consent could not be saved.

Important: Your custom first layer must still meet IAB TCF requirements (disclose purposes and vendors, and offer accept and reject with equal prominence). Users should still be able to open the full CMP UI (launchCMP()) to make granular choices.

If your app opens a WebView that loads a web page with the UniConsent CMP tag, you can pass the native consent status so the CMP tag recognises existing consent and does not show the banner again.

Inject consent at page start, before the CMP tag runs:

WebView webView = findViewById(R.id.webView);
webView.getSettings().setJavaScriptEnabled(true);

webView.setWebViewClient(new WebViewClient() {
    @Override
    public void onPageStarted(WebView view, String url, android.graphics.Bitmap favicon) {
        UniConsent.getInstance().syncConsent(view);
    }
});

webView.loadUrl("https://example.com");

Example of using AppCompatActivity

import com.uniconsent.sdk.CMPDisplayMode;
import com.uniconsent.sdk.Event;
import com.uniconsent.sdk.EventHandler;
import com.uniconsent.sdk.EventType;
import com.uniconsent.sdk.Stage;
import com.uniconsent.sdk.UniConsent;

public class MainActivity extends AppCompatActivity implements EventHandler {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

        UniConsent UniConsentCMP = UniConsent.getInstance();
        UniConsentCMP.setAppId("YOUR_APP_ID");
        // show the CMP when consent is needed, once the SDK is ready
        UniConsentCMP.enableAutoLaunch();
        UniConsentCMP.init(this);
        // register callback events
        UniConsentCMP.subscribe(this);
    }

    public void openUniConsentUI(View view) {
        // Full screen
        UniConsent.getInstance().launchCMP(Stage.GDPRFirstScreen);
    }

    public void openAsBottomSheet(View view) {
        // Bottom sheet
        UniConsent.getInstance().launchCMP(Stage.GDPRFirstScreen, CMPDisplayMode.BOTTOM_SHEET);
    }

    public void openAsDialog(View view) {
        // Center dialog
        UniConsent.getInstance().launchCMP(Stage.GDPRFirstScreen, CMPDisplayMode.DIALOG);
    }

    @Override
    public void handle(Event event) {
        UniConsent.getInstance().hasIABVendorConsent(1);
    }
}

Example of using ComponentActivity

package com.example.myapplication

import android.os.Bundle
import android.util.Log
import androidx.activity.ComponentActivity
import androidx.activity.compose.setContent
import androidx.compose.foundation.layout.Arrangement
import androidx.compose.foundation.layout.Column
import androidx.compose.foundation.layout.Spacer
import androidx.compose.foundation.layout.fillMaxSize
import androidx.compose.foundation.layout.height
import androidx.compose.foundation.layout.padding
import androidx.compose.material3.Button
import androidx.compose.material3.MaterialTheme
import androidx.compose.material3.Surface
import androidx.compose.material3.Text
import androidx.compose.runtime.Composable
import androidx.compose.ui.Alignment
import androidx.compose.ui.Modifier
import androidx.compose.ui.unit.dp
import com.example.myapplication.ui.theme.MyApplicationTheme
import com.uniconsent.sdk.CMPDisplayMode
import com.uniconsent.sdk.Event
import com.uniconsent.sdk.EventHandler
import com.uniconsent.sdk.Stage
import com.uniconsent.sdk.UniConsent

class MainActivity : ComponentActivity(), EventHandler {
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)

        val cmp = UniConsent.getInstance()
        cmp.setAppId("YOUR_APP_ID")
        // show the CMP when consent is needed, once the SDK is ready
        cmp.enableAutoLaunch()
        cmp.init(this)
        cmp.subscribe(this)

        setContent {
            MyApplicationTheme {
                Surface(
                    modifier = Modifier.fillMaxSize(),
                    color = MaterialTheme.colorScheme.background
                ) {
                    Column(
                        modifier = Modifier
                            .fillMaxSize()
                            .padding(16.dp),
                        verticalArrangement = Arrangement.Center,
                        horizontalAlignment = Alignment.CenterHorizontally
                    ) {
                        Button(onClick = {
                            UniConsent.getInstance().launchCMP(Stage.GDPRFirstScreen)
                        }) {
                            Text("Privacy Settings")
                        }
                        Spacer(modifier = Modifier.height(16.dp))
                        Button(onClick = {
                            UniConsent.getInstance().launchCMP(
                                Stage.GDPRFirstScreen, CMPDisplayMode.BOTTOM_SHEET
                            )
                        }) {
                            Text("Privacy Settings (Bottom Sheet)")
                        }
                        Spacer(modifier = Modifier.height(16.dp))
                        Button(onClick = {
                            UniConsent.getInstance().launchCMP(
                                Stage.GDPRFirstScreen, CMPDisplayMode.DIALOG
                            )
                        }) {
                            Text("Privacy Settings (Dialog)")
                        }
                    }
                }
            }
        }
    }

    override fun handle(event: Event?) {
        Log.d("CMP_EVENT", event.toString())
        UniConsent.getInstance().hasIABVendorConsent(1)
    }
}

Permission

<uses-permission android:name="android.permission.INTERNET" />

Open a Specific Screen and Other Options

Open the CMP at a specific screen, for example from a "Privacy settings" link in your app. The screen you ask for always opens. For US users, the settings screens open the CCPA or US State Privacy settings that apply to them. Users in Canada see the IAB TCF Canada version of the IAB TCF screens.

Screen	Shows
`Stage.GDPRFirstScreen`	First layer (banner)
`Stage.GDPRSecondScreen`	Settings (purposes)
`Stage.GDPRVendorsScreen`	Vendors
`Stage.CCPAFirstScreen`	CCPA first layer
`Stage.CCPASecondScreen`	CCPA settings
`Stage.USStateFirstScreen`	US State Privacy first layer
`Stage.USStateSecondScreen`	US State Privacy settings
`Stage.CategoriesFirstScreen`	Cookie categories first layer (banner)
`Stage.CategoriesSecondScreen`	Cookie categories settings

UniConsent cmp = UniConsent.getInstance();

// open the settings screen
cmp.launchCMP(Stage.GDPRSecondScreen);

// show the CMP in French instead of the device language (two-letter code)
cmp.setLanguage("FR");

// debug logs from the SDK and the CMP page, use LogLevel.ERROR (default) in release builds
cmp.setLogLevel(LogLevel.DEBUG);

// for testing only: show the CMP as for a user in another region, "EU", "CA" (Canada), "CAQC" (Quebec), "US" plus a state code such as "USCA" or "USTX", "BR", "CN", "ZA", "VN" or any other country code, or "N" (outside these regions). It also applies to getPolicy() and shouldRequestConsent(); remove it in release builds
cmp.setTestRegion("CA");

// close the CMP if it is open
cmp.dismissCMP();

// the user has made a choice: IAB TCF, CCPA, US State Privacy or IAB TCF Canada
boolean given = cmp.isConsentGiven();

// days since the IAB TCF consent was created, 0 when there is none
int days = cmp.getConsentAge();

// the user's region and, for the US and Canada, the state or province code (empty when unknown)
String geo = cmp.getGEO();
String state = cmp.getGEOState();

IAB GPP and US Privacy

The CMP stores the IAB GPP keys and the US Privacy key in the app's default SharedPreferences, as the IAB specifications define them. Ad SDKs in your app read them from there; no code changes are needed. The GPP keys are written when GPP, US State Privacy or IAB TCF Canada is enabled in the project settings of the UniConsent dashboard. The US Privacy key is written whenever CCPA is enabled.

Key	Value
`IABGPP_HDR_Version`	GPP version (`1`)
`IABGPP_HDR_Sections`	Section IDs in the GPP string, separated by `_`
`IABGPP_HDR_GppString`	The full GPP string
`IABGPP_GppSID`	Section IDs that apply to the user, separated by `_`, or `-1` when none apply
`IABGPP_2_String`	IAB TCF EU string, when GDPR applies
`IABGPP_5_String`	IAB TCF Canada string, when Canada TCF applies
`IABGPP_6_String`	US Privacy string, when CCPA applies
`IABGPP_7_String`	US National (usnat) string, when US State Privacy or CCPA applies
`IABGPP_8_String` to `IABGPP_27_String`	The section for the user's state (8 California to 27 Rhode Island), when US State Privacy applies, or California under CCPA, following the GPP Sections setting
`IABUSPrivacy_String`	US Privacy string whenever CCPA is enabled: the user's choice in the CCPA region, otherwise `1---`

The keys are updated each time the CMP loads and after every consent choice. When GPP is turned off, the IABGPP_ keys are removed. To read them yourself:

SharedPreferences prefs = PreferenceManager.getDefaultSharedPreferences(context);
String gppString = prefs.getString("IABGPP_HDR_GppString", "");
String gppSid = prefs.getString("IABGPP_GppSID", "");

US and Canada

Apps support the same US and Canada options as websites: CCPA, US State Privacy (with the states list, GPP Sections and MSPA settings) and IAB TCF Canada. shouldRequestConsent() returns true for Canadian users IAB TCF Canada applies to until they make a choice. US privacy is opt-out, so US users are not asked on their own: they see the US banner or settings when your app opens the CMP, for example from a privacy settings link. Until then, when CCPA or US State Privacy is enabled, the SDK writes the default US Privacy and GPP keys for US users without showing anything: not opted out, or opted out when the device ad tracking opt-out is on. US State Privacy starts off for new Mobile App projects; turn it on in the dashboard.

Device ad tracking opt-out

When the user has turned off ad tracking on the device, the CMP treats it as a US opt-out of sale, sharing and targeted advertising, as Global Privacy Control does on websites. On iOS this is tracking not allowed in App Tracking Transparency; on Android it is a deleted advertising ID or limit ad tracking, read through Google Play services when your app includes it. A choice the user then saves in the banner takes precedence.

Read the GPP and US Privacy strings

The SDK also returns the stored strings:

String gppString = UniConsent.getInstance().getGPPString();
String gppSid = UniConsent.getInstance().getGPPSID();
String usPrivacy = UniConsent.getInstance().getUSPrivacyString();

Available from SDK version 26.10.0. Where a region uses cookie categories instead of IAB TCF or the US policies, the CMP shows a banner with four categories: Strictly Necessary, Performance, Functionality, and Targeting or Advertising. This applies to:

LGPD in Brazil, PIPL in China, POPIA in South Africa and PDPD in Vietnam, when turned on in the project settings of the UniConsent dashboard
your rules for other countries: a rule for a country, and a rule for all remaining countries
a Consent Categories project, in its regions

Opt-in categories start with only Strictly Necessary on, and shouldRequestConsent() returns true until the user makes a choice, and again after you change the config version. Opt-out categories start with every category on (Targeting off when the device ad tracking opt-out is on in the US), and the app does not ask on its own: users change them from your privacy settings link. Opt-out applies to an opt-out rule for other countries and, in apps, to a Consent Categories project in the US.

Open the categories screens with Stage.CategoriesFirstScreen (banner) and Stage.CategoriesSecondScreen (settings). setTestRegion() also takes BR, CN, ZA, VN and other country codes, to test these regions.

Custom Purposes and Custom Vendors

Available from SDK version 26.10.0. The custom purposes and the custom vendors you add in the project settings of the UniConsent dashboard show in the CMP screens: the custom purposes in the IAB TCF first layer and settings and in the cookie categories settings, the custom vendors in the IAB TCF vendors list. In the CCPA and US State Privacy settings only sensitive custom purposes are listed. In the cookie categories settings the custom vendors follow the Targeting or Advertising category. Where IAB TCF does not apply (cookie categories and the US), the custom vendors are listed read-only under Vendors List in the menu, and in the cookie categories settings under Targeting or Advertising.

To start or stop your own SDKs by them, ask the SDK whether the app may use a custom purpose or custom vendor now. The answer follows the user's policy, by the same rules the CMP uses for tags:

IAB TCF, IAB TCF Canada and opt-in cookie categories: allowed only after the user agrees
the US and opt-out cookie categories: allowed until the user opts out; sensitive custom purposes need the user's agreement, and the custom vendors are off when the device opts out of ad tracking in the US
no policy: allowed

UniConsent cmp = UniConsent.getInstance();
if (cmp.isCustomPurposeConsented(1)) {
    // start the SDK your custom purpose 1 covers
}
boolean vendorAllowed = cmp.isCustomVendorConsented(2);
Map<String, Map<String, Boolean>> all = cmp.getCustomConsents(); // {"purposes": {"1": true}, "vendors": {"2": false}}

Call them again after the CMP closes or the consent changes. Ids the project does not have, and every id before the SDK is ready, return false.

Third-party SDK Disclosure

The CMP can list the third-party SDKs in your app (ad networks, analytics, attribution and others) with their company, what they are used for and their privacy policy. Users see them under Vendors List, read-only in every region: there are no toggles, and your app keeps turning each SDK on or off from the user's choices for purposes or cookie categories.

To set the list, turn on Enable Third-party SDKs in Step 4: Advanced Features of your app project, pick your SDKs in the Third-party SDKs tab or add your own, then save and publish. No code is needed in your app.

Set up default consent status KV:

<meta-data android:name="firebase_analytics_collection_enabled" android:value="false" />

<meta-data android:name="google_analytics_default_allow_analytics_storage" android:value="false" />
<meta-data android:name="google_analytics_default_allow_ad_storage" android:value="false" />
<meta-data android:name="google_analytics_default_allow_ad_user_data" android:value="false" />
<meta-data android:name="google_analytics_default_allow_ad_personalization_signals" android:value="false" />

Control analytics based on the consent flags:


// <= 25.6.1
@Override
public void handle(Event event) {
    Log.d("CMP_EVENT", event.toString())
    if(UniConsent.getInstance().hasIABPurposeConsent(1)) {
        // Set consent types.
        Map<FirebaseAnalytics.ConsentType, FirebaseAnalytics.ConsentStatus> consentMap = new EnumMap<>(FirebaseAnalytics.ConsentType.class);
        consentMap.put(FirebaseAnalytics.ConsentType.ANALYTICS_STORAGE, FirebaseAnalytics.ConsentStatus.GRANTED);
        consentMap.put(FirebaseAnalytics.ConsentType.AD_STORAGE, FirebaseAnalytics.ConsentStatus.GRANTED);
        consentMap.put(FirebaseAnalytics.ConsentType.AD_USER_DATA, FirebaseAnalytics.ConsentStatus.GRANTED);
        consentMap.put(FirebaseAnalytics.ConsentType.AD_PERSONALIZATION, FirebaseAnalytics.ConsentStatus.GRANTED);

        mFirebaseAnalytics.setConsent(consentMap);
        mFirebaseAnalytics.setAnalyticsCollectionEnabled(true);
    } else {
        // Set consent types.
        Map<FirebaseAnalytics.ConsentType, FirebaseAnalytics.ConsentStatus> consentMap = new EnumMap<>(FirebaseAnalytics.ConsentType.class);
        consentMap.put(FirebaseAnalytics.ConsentType.ANALYTICS_STORAGE, FirebaseAnalytics.ConsentStatus.DENIED);
        consentMap.put(FirebaseAnalytics.ConsentType.AD_STORAGE, FirebaseAnalytics.ConsentStatus.DENIED);
        consentMap.put(FirebaseAnalytics.ConsentType.AD_USER_DATA, FirebaseAnalytics.ConsentStatus.DENIED);
        consentMap.put(FirebaseAnalytics.ConsentType.AD_PERSONALIZATION, FirebaseAnalytics.ConsentStatus.DENIED);

        mFirebaseAnalytics.setConsent(consentMap);
        mFirebaseAnalytics.setAnalyticsCollectionEnabled(false);
    }

    // other logic such as send analytics events
}

// > 25.6.1
@Override
public void handle(Event event) {
    Log.d("CMP_EVENT", event.toString())

    // other logic such as send analytics events

    // Example: send Firebase event or other analytics metrics
    Bundle bundle = new Bundle();
    bundle.putString(FirebaseAnalytics.Param.ITEM_ID, "id");
    bundle.putString(FirebaseAnalytics.Param.ITEM_NAME, "name");
    bundle.putString(FirebaseAnalytics.Param.CONTENT_TYPE, "image");
    mFirebaseAnalytics.logEvent(FirebaseAnalytics.Event.SELECT_CONTENT, bundle);
}

Find more info at Set up consent mode for apps

Display Modes

The SDK supports three display modes for the consent UI, matching the Flutter SDK API:

Mode	Enum	Description
Full Screen	`CMPDisplayMode.FULL_SCREEN`	Opens CMP in a new full-screen activity (default)
Bottom Sheet	`CMPDisplayMode.BOTTOM_SHEET`	Slides up from the bottom as a modal sheet (90% height)
Dialog	`CMPDisplayMode.DIALOG`	Displays as a centered dialog (90% width, 70% height)

Note: Bottom sheet and dialog modes require your Activity to extend AppCompatActivity or FragmentActivity.

Notes

Users should have the ability to access a "Privacy Settings" button or link in the settings section of your application in order to open the CMP UI.
You can utilize the shouldRequestConsent() function to check whether you should request new consent based on the status. Display the CMP UI as needed when a user opens the application.
Starting with SDK version 25.6.1, you no longer need to manually send consent options for FirebaseAnalytics or certain supported AAP SDKs — they are handled automatically by the SDK. For more information, see What is Google AAP and Google MMP for Mobile Apps?.

Changelog

26.10.0

IAB GPP and US Privacy keys for ad SDKs
US State Privacy and IAB TCF Canada in apps, including the custom first layer
Add getGPPString(), getGPPSID() and getUSPrivacyString()
Open the US State Privacy settings with Stage.USStateSecondScreen; add setLanguage(), dismissCMP(), isConsentGiven(), getConsentAge() and getGEOState()
Open the CCPA and US State Privacy first layers with Stage.CCPAFirstScreen and Stage.USStateFirstScreen; add setTestRegion() to test the CMP as a user in another region, such as Canada
Cookie categories in apps: LGPD (Brazil), PIPL (China), POPIA (South Africa), PDPD (Vietnam), your rules for other countries and Consent Categories projects, with Stage.CategoriesFirstScreen and Stage.CategoriesSecondScreen
Add getPolicy(); agreeAll() and rejectAll() also save the cookie categories, custom purposes and custom vendors
setTestRegion() also takes BR, CN, ZA, VN and other country codes, and applies to getPolicy() and shouldRequestConsent()
Add isCustomPurposeConsented(), isCustomVendorConsented() and getCustomConsents(): the custom purposes and custom vendors the app may use now, under the user's policy

26.9.0

IAB TCF 2.4 support

Consent Management for Web

Mobile App CMP

Google Consent Mode

Google Tag Gateway

IAB TCF Certified CMP

Microsoft UET Consent

Amazon Consent Signal

Meta Pixel Consent

TikTok Pixel Consent

Cookie Scanner

For Publishers

For Advertisers

For Shopify

For WordPress