TCF Control Module: Clarification Needed on Consent Path Logic

[jonalu]

I have encountered an issue in the TCF Control Module where the consent path for the purpose is hardcoded to false. This is defined as:

const CONSENT_PATHS = { purpose: false, feature: 'specialFeatureOptins' };

Problem:

Due to this hardcoding, the logic currently bypasses checking vendorData.purpose.consents. Instead, it is checking vendorData.publisher.consents. Consequently, the expected behavior for including the publisher-provided ID in bid requests does not function as intended under normal configurations.

Workaround:

To address this, I temporarily configured a vendor exception specifically for the 'storage' purpose in the Prebid configuration. The setup is as follows:

consentManagement: {
      strictStorageEnforcement: true,
      gdpr: {
        cmpApi: 'iab',
        defaultGdprScope: true,
        timeout: 10000,
        rules: [
          {
            purpose: 'storage',
            enforcePurpose: true,
            enforceVendor: true,
            vendorExceptions: ['pubProvidedId'], // <-- workaround
          }
     ]
}

As I am not 100% sure of what is the correct logic here, I am marking this issue as a question.

[dgirardi]

Related: #10622; same issue in #12373 and #11967

This is intended behavior, according to the IAB consent for the first party should be retrieved from publisher rather than vendor / purpose. My understanding is that the CMP should have some option to ask for publisher consent.

[dgirardi]

Keeping this open to track documentation improvements.

[patmmccann]

Due to this hardcoding, the logic currently bypasses checking vendorData.purpose.consents. Instead, it is checking vendorData.publisher.consents. Consequently, the expected behavior for including the publisher-provided ID in bid requests does not function as intended under normal configurations.

If the publisher does not have consent; it seems you are without any valid legal bases for processing publisher provided ids and the ids should be suppressed according to the TCF spec. Your workaround appears to put you and other implementors outside of IABE directives.

[patmmccann]

Potentially fixed by prebid/prebid.github.io#5833

[jonalu]

Thanks for the feedback. I see now that you have informed of this change in the v9 release notes.

Of particular importance, “vendorless” modules such as the sharedid module no longer rely on vendor consent in the TCF object, but instead rely on publisher purpose consent. Publishers should check their __tcfapi consent data object to confirm publisher purpose consents are requested by their CMP.