Tracking enabled and user consent

[pyby]

Issue type

Help / documentation

New feature

Description of the problem

The library provides analytics tool for SGRSSR applications. In Switzerland, new data projection rules are exposed to be available in September 2023.

• DE: https://www.admin.ch/gov/de/start/dokumentation/medienmitteilungen.msg-id-90134.html
• FR: https://www.admin.ch/gov/fr/accueil/documentation/communiques.msg-id-90134.html
• IT: https://www.admin.ch/gov/it/pagina-iniziale/documentazione/comunicati-stampa.msg-id-90134.html

The library has two SDKs:

• ComScore
• TagCommander

TagCommander is a tagging tool, which mean that it can send data to other products.

SRF needs: https://jira.srg.beecollaboration.com/browse/SRFAPP-8414.

To be done in API

• [x] ~Allow application to share user consent for Comscore: comscoreCollectionEnabled (boolean). Apply on the Comscore SDK.~ Consent is shared with the new global labels feature. See SRGAnalyticsTrackerDataSource.
• [x] ~Allow application to share user consent for TagCommander/CommandersAct: tagCommanderCollectionEnabled (boolean). Apply on the TagCommander SDK.~ Consent is shared with the new global labels feature. See SRGAnalyticsTrackerDataSource.
• [x] ~Allow application to share list of consentedServices: Array of string (service ids). No need to integrate Usercentrics SDK. List of service ids (template ids from Usercentrics) are joined by , as a string to consented_services property (inspired from this TC doc). Sent this property in every events (permanent data). If empty array, an empty string is set. nil if no array? SRGSSR has no contract with TrustCommander product. So the library should follow this manual setup.~
  • [x] ~With TagCommander SDK V5, the TCUser can also set a list of consented services (named consent categories). See tests in comment. It's an internal implementation of the libraries, no public API changes expected.~ Task is done with TagCommander SDK V4.
• [x] Create documentation page for integration in applications when API design is implemented: https://github.com/SRGSSR/srganalytics-apple/wiki/User-consent

To be clarify

• [x] Format of the accepted services consents. Strings separated by comma? TC SDK and TC server communications. Play GVA -> Yes, comma is not used in Usercentrics template ids.
• [x] Clarification if the SDK has to implement a "wait consent" status before sending events. Play GVA -> Not needed for now. But if ComScore SDK and TagCommander SDK proposes it, with feature like "store events before getting consents", it could be done.
• [x] If "wait consent" status, does the app or the SDK has to store events (link first page view, or first events tracked by the app? Play GVA -> No needed for iteration one. And applications don't expect to store events locally.
• [x] Clarification if the SDK has to implement enable/disable analytics API for all or per services (ComScore, Commander acts). Play GVA -> Yes, SRGSSR implementation rules is an opt-in for Comscore in EU/WW (Analytics). MAPP, UDP SRF are opt-in in EU/WW. RTS Pipe.JS (personalisation) is opt-in in CH and EU/WW.
• [x] Analyse user consent solution SDK chosen by the SRGSSR: https://docs.usercentrics.com/cmp_in_app_sdk Consent shared asynchronously: categories (with categorySlug) and services (with template id with are unique and share in every Usercentrics configurations). Play GVA -> Only services have unique template ids (ID of the DPS, data processing service). Categories can be different in any configuration used by applications.

Environment information

• Library version: 7.10.0
• iOS / tvOS version: Any
• Device: any

[pyby]

If values have to be transmitted, two properties already exist: https://community.commandersact.com/tagcommander/getting-started/setup-guides/ios Tag Commander Apple SDK seems to have two default properties:

• TC_IS_TRACKING_ENABLED: indicates whether tracking is accepted on the device (YES/NO)
• TC_LIMIT_USER_TRACKING_ENABLED: limited tracking on the device (YES/NO)

It can be changed at any time, and next hit will have the updated value:

[TCCoreVariables.sharedInstance addData:kTCPredefinedVariable_LimitUserTrackingEnabled withValue:@"YES"];
[TCCoreVariables.sharedInstance addData:kTCPredefinedVariable_isTrackingEnabled withValue:@"YES"];

Locally, the SDK could be deactivated.

[self.tagCommander deactivateSDK];
[self.tagCommander enableSDK];

Deactivated, the SDK does not send any hits. ⚠️Enable it again seems to not send hits again.

[pyby]

ComScore SDK has similar methods to deactivate it:

[comScoreConfiguration disable];

How to enable it again?

[pyby]

Documentations from Commander Act V5:

TCSerSide:

• https://github.com/CommandersAct/iOSV5/blob/master/TCServerSide/README.md#consent
• https://github.com/CommandersAct/iOSV5/blob/master/TCServerSide/README.md#deactivating-the-serversides-module

TCConsent: (not sure the project can use it)

• https://github.com/CommandersAct/iOSV5/blob/master/TCConsent/README.md

In TCUser, properties:

• TC Vendors -> Usercentrics templates id (services)
• TC Categories -> Usercentrics categories slug

On server side, the consent seems to be on the categories, to filter accepted consent or not.

[pyby]

Update after some investigations regarding Usercentrics and CommanderActs:

UC answers:

1. if we switch from 1 company to 5 or 6, will we be able to share custom services and their DPS across companies and keep same template ids?
Yes.

2. if we switch from 1 company to 5 or 6, will we be able to have same SRGSSR “validated” categories and their category Slug (which seem to be their ids)?
I don't know if I get your question right. Categories are not shared or held in sync – neither with 1 nor with 5 companies. Categories are unique per configuration. Do I miss something?

Like in apps code base (RSI, RTS, SRF and Play SRG), trusts only consent at services level and their unique template id.

In Commander Acts server v2: Destinations have consent categories filters, but after a try when sending Usercentrics categories slug in the TCUser category, nothing can be get server side. It seems that TrustCommander product is needed. SRG don't have this product in the contract.

Following those documentations: https://community.commandersact.com/tagcommander/getting-started/setup-guides/consent-management https://community.commandersact.com/tagcommander/user-manual/serverside/consents

The advice is to use a custom property (or many other), like consent_services or accepted_consent_services, string: template ids separated by comma. And use filter server side on Destinations.

[pyby]

Update after some investigations regarding Usercentrics and CommanderActs:

A public acceptedUserConsentServices array property added to collect template ids of accepted consents.

• Option 1: use a custom property, and custom filter server side: consent_services string: template ids separated by comma.
• Option 2: use the TCUser.consentCategories array and the destination filter named "User consent category": template ids has to be map in a dictionary. Documentation as to be confirmed. The value expected are:
  • 1 means accepting this category or vendor.
  • 2 is for mandatory vendors or categories.
  • 0 is refusing.

Option 1 in a page view payload:

"consent_services" : "service1,service3,sKiYj0vEg5bgqv"

Option 2 in a page view payload:

"user" : {
    "refused_vendors" : "ALL",
    "consent_categories" : [
      "service3",
      "sKiYj0vEg5bgqv",
      "service1"
    ]
}

page_view_srganalytics_apple_demo.txt

Previous test failed. Unable to save something in the "User consent category" server side. Now, it's possible tested with SRGAnalytics demo, it seems to work.

ℹ️ TCUser.consentCategories only exist in the TagCommander V5 SDK. The screenshot is from server V2 (connected with TC V5 SDK). The custom property filter can be done on both versions (current or next one #62).

After some tests, one option should be selected and the other one, remove.

[pyby]

Requirement meetings done with SRF apps team, Pillarbox player team and Play SRG apps team. https://github.com/SRGSSR/pillarbox-documentation/issues/46

[defagos]

We have implemented a first API PoC on the feature/global-label-poc branch. Some remarks:

• It is yet unclear why we should introduce a new custom formalism while the is a standard, TFC, which addresses this need and is supported by Usercentrics, comScore and Commanders Act. SDKs should be able to communicate user consent with user preferences. Our efforts were not successful at the moment so the implementations might not be mature yet, but in the long term this is likely the best solution.
• In the meantime and since this API would still be useful anyway we have added the possibility of customizing global labels at any time. This provides the flexibility we need without hardcoding into the API something that is still largely unspecified.

Integration in Play was easy, see feature/user-consent-global-label-poc branch.

The only thing that is missing is the ability to send empty strings in labels. According to the comScore SDK implementation guide, section 2.5.2, we may pass an empty screen when user consent is possible but not provided yet. Not sure this requires us to support empty strings but this is something we can discuss and then apply consistently in Pillarbox as well.

[defagos]

Based on these requirements and with the uncertainties which remain we implemented a flexible approach. We can now reliably provide global labels in SRG Analytics events, a mechanism which is well-suited for user consent transmission.

See #75 for the corresponding PR. This issue will not be linked directly since it has more requirements we could eventually fulfill in the future (e.g. a more expressive API for user consent management). Associated branches have been left open as well.

[defagos]

I guess that TCF might not have been considered for various reasons.

[pyby]

Done with https://github.com/SRGSSR/srganalytics-apple/pull/75 and library release 8.2.0.