GPP Control Module: usnat string

[dgirardi]

Type of change

• Feature

Description of change

• extract CMP client logic into shared library code
• update GPP logic to fetch all availlable section data
• make gppConsent available as an activity parameter. this, unfortunately, broke a lot of tests that were doing their setup outside of a setup block - not all of them could be fixed cleanly (see TODO notes)
• introduce new gppControl_usnat module that provides a default interpretation for the usnat GPP section (defined in this doc)

More info

• the gppControl_usnat module is activated together with the consentManagementGpp module, for now. (It has no config of its own, but it needs GPP config to exist before doing anything)
• at least with the CMP that I am using as reference (from this test page), it appears that there is no clean equivalent of the TCF "useractioncomplete" flow. On the first load consent starts out always denied (rather than pending). In that test page, settings are not persisted so there's no good way to test the "consent granted" flow.

[dgirardi]

In code the first element has index 0. In the doc it starts from 1 (I think - the spec enumerates them from 1 at least).

…

On Thu, Jun 22, 2023, 5:38 PM Patrick McCann ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In libraries/mspa/activityControls.js <#10117 (comment)>: > +} + +function isSensitiveConsentDenied(cd) { + return ['SensitiveDataProcessingOptOutNotice', 'SensitiveDataLimitUseNotice'].some(prop => cd[prop] === 2) +} + +function isConsentDenied(cd) { + return isBasicConsentDenied(cd) || + ['SaleOptOut', 'SharingOptOut', 'TargetedAdvertisingOptOut'].some(prop => cd[prop] === 1) || + ['SaleOptOutNotice', 'SharingNotice', 'SharingOptOutNotice', 'TargetedAdvertisingOptOutNotice'].some(prop => cd[prop] === 2); +} + +function isTransmitUfpdConsentDenied(cd) { + return isConsentDenied(cd) || + isSensitiveConsentDenied(cd) || + cd.SensitiveDataProcessing.some((val, i) => (i < 6 || i > 7) && val === 1) || or should this just be i !== 8? — Reply to this email directly, view it on GitHub <#10117 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACNOLVLTVNBUTOPFYVQTEB3XMRRILANCNFSM6AAAAAAZMFKZTY> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[patmmccann]

Hopefully re-ready for review with all changes to the object parsing in @bretg !

[jsnellbaker]

I'm not sure if I'm missing something with the greater logic here, but why are we subtracting 1 from the values of the arrays that indicate the SesnsitiveDataProcessing property? From the in-line comments, it'd seem we would want to check property number 6 is not equal to 0 - but this logic (from what I gather) would reduce the property number to 5. Can someone clarify?

[patmmccann]

SensitiveDataProcessing is a 12 item array where each element can have value 0,1, or 2. Items [6, 7, 9, 10, 12] starting at array index 1 must be zero according to the design doc. I subtract 1 from each of them on this line to get [5,6,8,9,11] and then in the following line subset the javascript array to all the positions that must be zero. Then finally, we return consent denied if any of these are non-zero

The two lines above could be consolidated to mustBeZero=[5,6,8,9,11] but I was hoping to start with a constant in the design doc and manipulate from there.

[patmmccann]

The unit test for this mustBeZero function is here btw

Prebid.js/test/spec/libraries/mspa/activityControls_spec.js

Line 148 in 67dc9f5

it('should be true (consent denied to add ufpd) with consent to process biometric data, as this should not be on openrtb', () => {

The idea is,when it comes to sensitive biometric data, prebid default is to not append to user first party data unless that consent field is N/A

[jsnellbaker]

Though I can't test everything here, it seems like it's okay from what I can tell.

[patmmccann]

docs prebid/prebid.github.io#4683