What AdMob means for your app's privacy disclosures

AdMob is an ad network from Google. What it involves, whether it needs the tracking prompt, what goes on the App Store labels and the Play Data safety form, and the rejection it is usually behind.

Updated 2026-09-18 · Written from the same rules terms.gg uses to generate documents

What AdMob actually does

Google's ad network for mobile apps, and the one most indie apps reach for first because it pays out on small volumes.

What its job necessarily involves

These follow from what the thing is for, so they are true whichever version you installed:

• A device or advertising identifier, so the same person is not shown the same ad forty times.
• Coarse location or IP derived location, because ad inventory and pricing are sold by market.
• What the app is and what screen the ad appeared on, which is what the advertiser is buying.

What to open and check in AdMob

The settings below decide what the honest answer on the forms is, and they are specific to this SDK rather than to its category:

• Whether the Google UMP consent form runs before the first ad request, not after it.
• Whether the child-directed and under-age-of-consent tags are set, because getting those wrong is a policy violation rather than a labelling one.
• What the mediation list contains, since every network in it is another recipient.

AdMob needs the tracking prompt

AdMob is ad network, so App Tracking Transparency applies. It reads the advertising identifier and measures across apps that other companies own. Ship without the prompt and the app is rejected; ship with the prompt and ignore the answer, which some SDKs still do by default, and you have a problem larger than a rejection.

AdMob in Europe: nothing may run before consent

This is the part that gets missed, because the natural place to initialise an SDK is the moment the app launches, and the natural place to ask for consent is a screen that appears after it. Reading or writing anything on the device for ad network needs agreement first, and that comes from the ePrivacy rules rather than the GDPR, so picking a different legal basis does not get you past it.

AdMob in California: this counts as selling or sharing

California reads "sell or share" far more widely than money changing hands. Handing an identifier to ad network so someone can be advertised to elsewhere is caught, and no payment has to occur for it to count.

AdMob on the App Store privacy labels

Apple asks what your app collects, and your app collects whatever its SDKs collect. AdMob is generally declared under Third-Party Advertising, alongside whatever the rest of your app does for its own reasons.

AdMob on the Google Play Data safety form

The form asks two things the labels do not: whether data is shared with anyone else, and whether it is encrypted in transit. For this SDK the sharing answer is yes, and answering no is a false declaration rather than an oversight.

Check Google's own privacy manifest for AdMob

Since 2024 Apple has required third-party SDKs on its list to ship a signed privacy manifest declaring what they collect and which sensitive APIs they use, and your app's combined manifest is built from them. That file is the authoritative answer for AdMob, it comes from Google, and it changes when they ship.

The rejection AdMob is usually behind

The policy never mentions advertising, the App Store privacy labels say no data is collected, and the app shows ads on first launch.

What to put in the privacy policy about AdMob

• Google named as a processor or a recipient, not hidden behind "our partners".
• What it is for, in a sentence someone would understand without knowing what an SDK is.
• Where it runs, and what makes a transfer outside your region lawful.
• How long the data is kept, which is a question the vendor documents and most policies skip.
• That data goes to advertising, said plainly, with the California opt-out route.

Keeping it true after launch

A legal page stops being true the moment the product moves past it, usually by adding a payment provider, an analytics SDK or a sign-in. No store re-checks your pages against your build, so the drift is yours to notice.

• Re-read it whenever you add a dependency that sees user data.
• Re-check what loads on the page after any change: the cookie notice and the policy have to agree.
• Keep the URL stable. Changing where a policy lives breaks every listing that points at it.