What a CMP Does
A consent management platform sits between your users and every system that wants to use their data. It shows a prompt that explains how data is used, records the user's choices, stores them on the device and on a server, and passes them to the SDKs and partners in your app so each one knows what it may do.
That sounds simple, but the details matter. A good CMP has to present the right prompt in the right region, describe purposes and vendors accurately, make rejecting as easy as accepting where the law requires it, log every choice as evidence, and let users change their minds later from a settings screen.
Why Mobile Apps Use CMPs
Several rules push apps toward CMPs. In the EEA, the UK and Switzerland, the ePrivacy rules generally require consent to store or read information on a device unless strictly necessary, and GDPR requires a lawful basis for processing personal data. India's DPDPA puts consent at the centre of its framework. US state laws such as the CCPA require opt-out options for selling or sharing personal information.
The ad industry adds its own requirements. Google requires publishers and developers that use its ad products to serve users in the EEA, the UK and Switzerland to use a Google-certified CMP integrated with the IAB Transparency and Consent Framework. Without valid consent signals, ad serving and measurement for those users is limited.
How a CMP Works in an App
The CMP's SDK runs early in the app lifecycle, usually on first launch. It decides whether the user is in a region that needs a prompt, shows the prompt, and saves the result. With the IAB TCF, the result is a TC string plus individual values, written to NSUserDefaults on iOS or SharedPreferences on Android under standard IABTCF_ keys. Any SDK that supports TCF can read those keys and adjust its behavior.
CMPs also integrate with specific consent systems. For Google, the CMP sets Google Consent Mode values such as ad_storage, analytics_storage, ad_user_data and ad_personalization. On iOS, the CMP flow is usually coordinated with Apple's App Tracking Transparency prompt, which controls access to the IDFA.
The order of operations matters. SDKs that collect data before consent is resolved can create compliance risk, so many apps delay initialising measurement and ad SDKs until the CMP has finished, or initialise them in a restricted mode first.
CMPs and Attribution
Attribution depends on consent signals in two ways. First, the MMP SDK itself may need to respect consent, for example by not collecting certain identifiers when a user declines. Second, the MMP passes consent to ad networks with postbacks, so networks such as Google know whether they may use the conversion for measurement or personalisation.
Linkrunner's iOS SDK reads TCF consent values set by your CMP, and Linkrunner supports Google consent signals for the Digital Markets Act. The IDFA is collected only with ATT consent, and PII hashing is an opt-in SDK setting. See the Trust Center for Linkrunner's privacy and security posture.
Designing a Consent Prompt
Consent rates depend heavily on design, within what the law allows. Explain the value in plain words, keep the first layer short, give equal weight to accept and reject options where required, and avoid pre-ticked boxes. Test variations, measure the consent rate by region and platform, and remember that a higher consent rate achieved through misleading design can create regulatory risk that outweighs the data gained.
Choosing and Rolling Out a CMP
Start with your regions. If you have users in the EEA, the UK or Switzerland and use Google's ad products, you need a Google-certified CMP with TCF support. If most of your users are elsewhere, check which local laws apply and whether your CMP can show region-specific prompts, such as a full consent prompt in Europe and an opt-out link in California.
Then check integration depth. A CMP should have native iOS and Android SDKs, write TCF keys correctly, set Google Consent Mode values, and expose callbacks so your app knows when consent is resolved and when it changes. Check how it handles app updates, reinstalls and users who change their minds in settings.
Roll out in stages. Ship the CMP with measurement SDKs waiting on its result, verify on test devices that each SDK reads consent correctly, then watch consent rates and attribution coverage by region in the first weeks. A sudden drop in attributed installs from one region after launch usually means an SDK is waiting for a signal it never receives.