Proposal: Standardizing COPPA

[bretg]

Type of Issue

Feature

Description

Several bidders have ways for prebid users to pass the COPPA flag, but Prebid.js hasn't specified a standard way to specify it such that all bid adapters can access it.

Proposal

This doesn't fit into the First Party Data context framework because the COPPA flag is always public and should be known to all adapters, while other first party data might be limited to a certain set of bidders.

So the proposal is

1. Declare a configuration convention for the publisher to signal PBJS about COPPA content:

pbjs.setConfig({coppa: true});

2. Each adapter supporting COPPA would then be updated to call getConfig({coppa})

3. The Prebid Server Bid Adapter will be updated to pass this value to PBS as regs.coppa=1 when true.

4. Prebid Server will pass regs.coppa to adapters and will always (not configurable) cause the PBS core to enforce COPPA rounding of IP address and removal of ID as suggested in the OpenRTB standard:

• device.ifa, device.macsha1, device.macmd5, device.dpidsha1, device.dpidmd5, device.didsha1, device.didmd5
• Truncate ip field - remove lowest 8 bits.
• Truncate ipv6 field - remove lowest 32 bits.
• Remove geo.lat, geo.lon. geo.metro, geo.city, and geo.zip
• Remove user.id, user.buyeruid, user.yob, and user.gender

5. Update prebid.org with a page that dynamically lists the COPPA-supporting adapters based on the .md file similar to what we do for GDPR.

6. Define how COPPA flag gets sent in the SDK

[bretg]

This was discussed in the Prebid.js committee meeting today. Rubicon will put it into our next sprint.

[bretg]

Reviewed with Eve. We're planning on moving forward with this.

[bretg]

Based on feedback from code inspection, we've changed the design back to having the bid adapters each call getConfig instead of having core put it on the bidrequest object.

[bretg]

Released