Adapters that may not handle GDPR-Applies correctly

bretg commented 2 years ago

Description

As uncovered in #7156 , there are are several bid adapters that may not be properly handling the gdprApplies flag.

Background: the Consent Management Platform (CMP) is responsible for knowing whether the current user is "in-scope" for GDPR, i.e. they reside in the European Economic Area (EEA). It signals this information to Prebid along with the consent string. Bid adapters must be able to handle all of these scenarios:

1) CMP provides gdprApplies:true and a valid consent string - normal GDPR processing 2) CMP provides gdprApplies:false and a valid consent string - bidder endpoints may choose to verify the user's GDPR scope or to trust the CMP. 3) CMP provides gdprApplies:true but no consent string - processing depends on vendor's Legitimate Interest claims and legal advice from the bidder's lawyers. 4) CMP provides gdprApplies:false and no consent string - bidder endpoints may choose to verify the user's GDPR scope or to trust the CMP. 5) CMP provides only a valid consent string - if the CMP declines to define the GDPR scope, bidder processing depends on whether the endpoint can detect the user's location and legal advice from their lawyers. 6) CMP provides neither value - if the CMP doesn't define the scope or the consent, bidder processing depends on whether the endpoint can detect the user's location and legal advice from their lawyers.

Bid adapters that need to be reviewed

These bidders don't look for gdprApplies. Please confirm your implementation with your legal team. Prebid recommends passing the gdprApplies flag along with the consent string.

[x] addefend - @addefend
[ ] apstream - @frstua
[x] glimpse - @samueldobbie , @tim-hm
[x] improveDigital - @jbartek25 , @agregorio-improve "there's no plan to add support for gdprApplies param in the current adapter generation as our server does IP lookups. The next generation adapter launching in Q1 will include gdprApplies"

These bidders currently only consider gdprApplies if a consent string is available. Please confirm your implementation with your legal team. Prebid recommends using the gdprApplies flag even if it's available even if there's no consent string.

[ ] cleanmedianet - @sa1omon
[ ] engageya - @mikomgk
[x] gamoshi - @sa1omon
[x] stroeer - @PavlaKanova , @lukashavrlant
[x] bliink - @Kola-Kola
[ ] logan - @WlsLogan
[ ] mathildeads - @mathilde-ads
[x] mediasquare - @matthieularere-msq
[x] onetag - @onetag-dev
[x] richaudience - @richaudience
[x] rubicon - @robertrmartinez
[ ] smilewanted - @MaxSmileWanted
[x] triplelift - @nllerandi - "We fallback to the determination of applicability based on geo IP resolution if our params are not present."
[ ] videoreach - @VideoReach

These modules don't send gdprApplies to their endpoints. There's a possible problem in these scenarios where gdprApplies:true and there's no consent string. If endpoints are doing IP-address lookups, then they may be ok, but if not, the adapter should be passing gdprApplies so the endpoint has all the info it needs to process correctly.

[x] adnuntius - @mikael-lundin
[ ] beop - @bloodyowl , @sebrobert
[x] criteoIdSystem - @allanjun

dgirardi commented 2 years ago

@samueldobbie that does not look like it handles case 3 correctly (gdprApplies: true, consentString: undefined would fall down to the last return which says gdprApplies: false).

https://github.com/prebid/Prebid.js/blob/a5b0d6416215e0d28f035a47341e718da770239b/modules/glimpseBidAdapter.js#L138-L154

samueldobbie commented 2 years ago

Good catch @dgirardi, thanks! Should be fixed here.

matthieularere-msq commented 2 years ago

I guess this is related with user sync for mediasquare bidder, if that's so it should be fixed by PR #7780

mikael-lundin commented 2 years ago

We do IP-address lookups but we can add a gdpr applies true as well. :)

On Tue, Nov 30, 2021 at 6:52 PM bretg @.***> wrote:

Description

As uncovered in #7156 https://github.com/prebid/Prebid.js/issues/7156 , there are are several bid adapters that may not be properly handling the gdprApplies flag.

Background: the Consent Management Platform (CMP) is responsible for knowing whether the current user is "in-scope" for GDPR, i.e. they reside in the European Economic Area (EEA). It signals this information to Prebid along with the consent string. Bid adapters must be able to handle all of these scenarios:

CMP provides gdprApplies:true and a valid consent string - normal GDPR processing

CMP provides gdprApplies:false and a valid consent string - bidder endpoints may choose to verify the user's GDPR scope or to trust the CMP.

CMP provides gdprApplies:true but no consent string - processing depends on vendor's Legitimate Interest claims and legal advice from the bidder's lawyers.

CMP provides gdprApplies:false and no consent string - bidder endpoints may choose to verify the user's GDPR scope or to trust the CMP.

CMP provides only a valid consent string - if the CMP declines to define the GDPR scope, bidder processing depends on whether the endpoint can detect the user's location and legal advice from their lawyers.

CMP provides neither value - if the CMP doesn't define the scope or the consent, bidder processing depends on whether the endpoint can detect the user's location and legal advice from their lawyers.

Bid adapters that need to be reviewed

These bidders don't look for gdprApplies. Please confirm your implementation with your legal team. Prebid recommends passing the gdprApplies flag along with the consent string.

addefend - @addefend https://github.com/addefend

apstream - @frstua https://github.com/frstua

glimpse - @samueldobbie https://github.com/samueldobbie , @tim-hm https://github.com/tim-hm

improveDigital - @jbartek25 https://github.com/jbartek25 , @agregorio-improve https://github.com/agregorio-improve

These bidders currently only consider gdprApplies if a consent string is available. Please confirm your implementation with your legal team. Prebid recommends using the gdprApplies flag even if it's available even if there's no consent string.

cleanmedianet - @sa1omon https://github.com/sa1omon

engageya - @mikomgk https://github.com/mikomgk

gamoshi - @sa1omon https://github.com/sa1omon

stroeer - @PavlaKanova https://github.com/PavlaKanova , @lukashavrlant https://github.com/lukashavrlant

bliink - @Kola-Kola https://github.com/Kola-Kola

districtmDMX - @steve-a-districtm https://github.com/steve-a-districtm , @MenelikTucker-districtm https://github.com/MenelikTucker-districtm

logan - @WlsLogan https://github.com/WlsLogan

mathildeads - @mathilde-ads https://github.com/mathilde-ads

mediasquare - @matthieularere-msq https://github.com/matthieularere-msq

onetag - @onetag-dev https://github.com/onetag-dev

richaudience - @richaudience https://github.com/richaudience

rubicon - @robertrmartinez https://github.com/robertrmartinez

smilewanted - @MaxSmileWanted https://github.com/MaxSmileWanted

triplelift - @nllerandi https://github.com/nllerandi

trustx - @PWyrembak https://github.com/PWyrembak

videoreach - @VideoReach https://github.com/VideoReach

These modules don't send gdprApplies to their endpoints. There's a possible problem in these scenarios where gdprApplies:true and there's no consent string. If endpoints are doing IP-address lookups, then they may be ok, but if not, the adapter should be passing gdprApplies so the endpoint has all the info it needs to process correctly.

adnuntius - @mikael-lundin https://github.com/mikael-lundin

beop - @bloodyowl https://github.com/bloodyowl , @sebrobert https://github.com/sebrobert

criteoIdSystem - @allanjun https://github.com/allanjun

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/prebid/Prebid.js/issues/7775, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAH64BLITODJP275TJOH2GTUOUFPNANCNFSM5JCFYVJA .

richaudience commented 2 years ago

Hi,

The change to use "gdprApplies" has been completed. Please check the pull request: #7788

Cheers

Kola-Kola commented 2 years ago

Hi,

We change the support of "gdprApplies", please you can check the PR here : #7860 .

Thanks.

nllerandi3lift commented 2 years ago

We fallback to the determination of applicability based on geo IP resolution if our params are not present.

jbartek25 commented 2 years ago

Improve Digital adapter: there's no plan to add support for gdprApplies param in the current adapter generation as our server does IP lookups. The next generation adapter launching in Q1 will include gdprApplies.

stale[bot] commented 2 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.