Pitfall 1: No consent, or consent misconfigured
The mistake: Deploying Google Ads / AdSense without a cookie consent banner, or bundling marketing consent with functional/essential consent in a single toggle.
Why it happens: Google's setup guides prioritize installation speed over compliance detail; small teams assume cookie banners are "nice to have." Google Ads / AdSense deliberately obscures that _gcl_au and IDE are marketing cookies that require independent consent.
Consequence: GDPR/ePrivacy violations (Articles 6, 5(3)). DPAs treat unconsented cookie tracking as a high-severity breach. Fines up to €20M or 4% of global revenue (GDPR). Users also have grounds for class-action privacy tort claims.
Pitfall 2: Forgetting to name Google as a processor and omitting the Data Processing Agreement
The mistake: Privacy policies mention "advertising partners" generically but don't name Google LLC or link to Google's Ads Data Processing Terms.
Why it happens: Google's standard documentation doesn't explicitly require you to list it by name in your Privacy Policy; compliance teams assume a boilerplate clause covers all vendors.
Consequence: GDPR Article 13(1)(c) and Article 14(1)(d) non-compliance (failure to disclose processor identity and standard contractual clauses). Audits will flag this. No Data Processing Agreement (DPA) in place means no lawful transfer mechanism for EU users' data to the US.
Pitfall 3: AdMob deployed without ATT prompt on iOS
The mistake: Using Google's AdMob SDK in an iOS app without showing Apple's App Tracking Transparency prompt before collecting IDFA or device identifiers for ad targeting.
Why it happens: AdMob integration guides don't emphasize the ATT requirement; developers assume Google handles it automatically (it doesn't).
Consequence: App Store rejection and removal. Apple enforces ATT via technical enforcement; non-compliance means app delisting within 30 days.
