AzerionEdge RTD Module: Compatibility with GDPR/USP Privacy Modules

modules/azerionedgeRtdProvider.js

@@ -19,6 +19,9 @@ const REAL_TIME_MODULE = 'realTimeData';
 const SUBREAL_TIME_MODULE = 'azerionedge';
 export const STORAGE_KEY = 'ht-pa-v1-a';
 
+const IMPROVEDIGITAL_GVLID = '253';
+const PURPOSES = ['1', '3', '5', '7', '9'];
+
 export const storage = getStorageManager({
   moduleType: MODULE_TYPE_RTD,
   moduleName: SUBREAL_TIME_MODULE,
@@ -106,10 +109,79 @@ export function setAudiencesToBidders(reqBidsConfigObj, config, audiences) {
  * @return {boolean}
  */
 function init(config, userConsent) {
-  attachScript(config);
+  if (hasUserConsented(userConsent)) {
+    attachScript(config);
+  }
   return true;
 }
 
+/**
+ * List the vendors consented coming from userConsent object.
+ *
+ * @param {Object} userConsent
+ *
+ * @return {Array}
+ */
+function getVendorsConsented(userConsent) {
+  const consents = userConsent?.gdpr?.vendorData?.vendor?.consents || {};
+  return Object.entries(consents).reduce((acc, [vendorId, consented]) => {
+    return consented ? [...acc, vendorId] : acc;
+  }, []);
+}
+
+/**
+ * List the purposes consented coming from userConsent object.
+ *
+ * @param {Object} userConsent
+ *
+ * @return {Array}
+ */
+export function getPurposesConsented(userConsent) {
+  const consents = userConsent?.gdpr?.vendorData?.purpose?.consents || {};
+  return Object.entries(consents).reduce((acc, [purposeId, consented]) => {
+    return consented ? [...acc, purposeId] : acc;
+  }, []);
+}
+
+/**
+ * Checks if GDPR gives us access through the userConsent object.
+ *
+ * @param {Object} userConsent
+ *
+ * @return {boolean}
+ */
+export function hasGDPRAccess(userConsent) {
+  const gdprApplies = userConsent?.gdpr?.gdprApplies;
+  const isVendorAllowed = getVendorsConsented(userConsent).includes(IMPROVEDIGITAL_GVLID);
+  const arePurposesAllowed = PURPOSES.every((purpose) => getPurposesConsented(userConsent).includes(purpose));
+  return !gdprApplies || (isVendorAllowed && arePurposesAllowed);
+}
+
+/**
+ * Checks if USP gives us access through the userConsent object.
+ *
+ * @param {Object} userConsent
+ *
+ * @return {boolean}
+ */
+export function hasUSPAccess(userConsent) {
+  const uspProvided = userConsent?.usp;
+  const hasProvidedUserNotice = uspProvided?.[1] !== 'N';
+  const hasNotOptedOut = uspProvided?.[2] !== 'Y';
+  return !uspProvided || (hasProvidedUserNotice && hasNotOptedOut);
+}
+
+/**
+ * Checks if GDPR/USP gives us access through the userConsent object.
+ *
+ * @param {Object} userConsent
+ *
+ * @return {boolean}
+ */
+export function hasUserConsented(userConsent) {
+  return hasGDPRAccess(userConsent) && hasUSPAccess(userConsent);
+}
+
 /**
  * Real-time user audiences retrieval
  *
@@ -126,9 +198,11 @@ export function getBidRequestData(
   config,
   userConsent
 ) {
-  const audiences = getAudiences();
-  if (audiences.length > 0) {
-    setAudiencesToBidders(reqBidsConfigObj, config, audiences);
+  if (hasUserConsented(userConsent)) {
+    const audiences = getAudiences();
+    if (audiences.length > 0) {
+      setAudiencesToBidders(reqBidsConfigObj, config, audiences);
+    }
   }
   callback();
 }

modules/azerionedgeRtdProvider.md

@@ -79,23 +79,6 @@ provided to the module when the user gives the relevant permissions on the publi
 As Prebid.js utilizes TCF vendor consent for the RTD module to load, the module needs to be labeled
 within the Vendor Exceptions.
 
-### Instructions
-
-If the Prebid GDPR enforcement is enabled, the module should be labeled
-as exception, as shown below:
-
-```js
-[
-  {
-    purpose: 'storage',
-    enforcePurpose: true,
-    enforceVendor: true,
-    vendorExceptions: ["azerionedge"]
-  },
-  ...
-]
-```
-
 ## Testing
 
 To view an example:

test/spec/modules/azerionedgeRtdProvider_spec.js

@@ -13,6 +13,9 @@ describe('Azerion Edge RTD submodule', function () {
   const bidders = ['appnexus', 'improvedigital'];
   const process = { key: 'value' };
   const dataProvider = { name: 'azerionedge', waitForIt: true };
+  const tcfGDPRNotApplicable = { gdprApplies: false };
+  const uspNotProvided = { usp: undefined };
+  const ignoreConsent = {gdpr: tcfGDPRNotApplicable, usp: uspNotProvided};
 
   let reqBidsConfigObj;
   let storageStub;
@@ -33,7 +36,7 @@ describe('Azerion Edge RTD submodule', function () {
     let returned;
 
     beforeEach(function () {
-      returned = azerionedgeRTD.azerionedgeSubmodule.init(dataProvider);
+      returned = azerionedgeRTD.azerionedgeSubmodule.init(dataProvider, ignoreConsent);
     });
 
     it('should return true', function () {
@@ -60,7 +63,7 @@ describe('Azerion Edge RTD submodule', function () {
         returned = azerionedgeRTD.azerionedgeSubmodule.init({
           ...dataProvider,
           params: { key },
-        });
+        }, ignoreConsent);
       });
 
       it('should return true', function () {
@@ -80,7 +83,7 @@ describe('Azerion Edge RTD submodule', function () {
         returned = azerionedgeRTD.azerionedgeSubmodule.init({
           ...dataProvider,
           params: { process },
-        });
+        }, ignoreConsent);
       });
 
       it('should return true', function () {
@@ -95,6 +98,105 @@ describe('Azerion Edge RTD submodule', function () {
     });
   });
 
+  describe('GDPR access', () => {
+    const vendorConsented = { '253': true }
+    const purposesConsented = {'1': true, '3': true, '5': true, '7': true, '9': true};
+    const partialPurposesConsented = {'1': true, '3': true, '5': true, '7': true};
+    const tcfConsented = { gdprApplies: true, vendorData: { vendor: { consents: vendorConsented }, purpose: { consents: purposesConsented } } };
+    const tcfVendorNotConsented = { gdprApplies: true, vendorData: { purpose: {consents: purposesConsented} } };
+    const tcfPurposesNotConsented = { gdprApplies: true, vendorData: { vendor: { consents: vendorConsented } } };
+    const tcfPartialPurposesNotConsented = { gdprApplies: true, vendorData: { vendor: { consents: vendorConsented }, purpose: { consents: partialPurposesConsented } } };
+
+    [
+      ['not applicable', tcfGDPRNotApplicable, true],
+      ['tcf consented', tcfConsented, true],
+      ['tcf vendor not consented', tcfVendorNotConsented, false],
+      ['tcf purposes not consented', tcfPurposesNotConsented, false],
+      ['tcp partial purposes not consented', tcfPartialPurposesNotConsented, false],
+    ].forEach(([info, gdpr, expected]) => {
+      it(`for ${info} should return ${expected}`, () => {
+        expect(azerionedgeRTD.hasGDPRAccess({gdpr})).to.equal(expected);
+      });
+
+      it(`for ${info} should load=${expected} the external script`, () => {
+        azerionedgeRTD.azerionedgeSubmodule.init(dataProvider, {gdpr, usp: uspNotProvided});
+        expect(loadExternalScript.called).to.equal(expected);
+      });
+
+      describe('for bid request data', function () {
+        let callbackStub;
+
+        beforeEach(function () {
+          callbackStub = sinon.mock();
+          azerionedgeRTD.azerionedgeSubmodule.getBidRequestData(reqBidsConfigObj, callbackStub, dataProvider, {gdpr, usp: uspNotProvided});
+        });
+
+        it(`does call=${expected} the local storage looking for audiences`, function () {
+          expect(storageStub.called).to.equal(expected);
+        });
+
+        it('calls callback always', function () {
+          expect(callbackStub.called).to.be.true;
+        });
+      });
+    });
+  });
+
+  describe('USP acccess', () => {
+    const uspMalformed = -1;
+    const uspNotApplicable = '1---';
+    const uspUserNotifiedOptedOut = '1YY-';
+    const uspUserNotifiedNotOptedOut = '1YN-';
+    const uspUserNotifiedUnknownOptedOut = '1Y--';
+    const uspUserNotNotifiedOptedOut = '1NY-';
+    const uspUserNotNotifiedNotOptedOut = '1NN-';
+    const uspUserNotNotifiedUnknownOptedOut = '1N--';
+    const uspUserUnknownNotifiedOptedOut = '1-Y-';
+    const uspUserUnknownNotifiedNotOptedOut = '1-N-';
+    const uspUserUnknownNotifiedUnknownOptedOut = '1---';
+
+    [
+      ['malformed', uspMalformed, true],
+      ['not applicable', uspNotApplicable, true],
+      ['not provided', uspNotProvided, true],
+      ['user notified and opted out', uspUserNotifiedOptedOut, false],
+      ['user notified and not opted out', uspUserNotifiedNotOptedOut, true],
+      ['user notified and unknown opted out', uspUserNotifiedUnknownOptedOut, true],
+      ['user not notified and opted out', uspUserNotNotifiedOptedOut, false],
+      ['user not notified and not opted out', uspUserNotNotifiedNotOptedOut, false],
+      ['user not notified and unknown opted out', uspUserNotNotifiedUnknownOptedOut, false],
+      ['user unknown notified and opted out', uspUserUnknownNotifiedOptedOut, false],
+      ['user unknown notified and not opted out', uspUserUnknownNotifiedNotOptedOut, true],
+      ['user unknown notified and unknown opted out', uspUserUnknownNotifiedUnknownOptedOut, true],
+    ].forEach(([info, usp, expected]) => {
+      it(`for ${info} should return ${expected}`, () => {
+        expect(azerionedgeRTD.hasUSPAccess({usp})).to.equal(expected);
+      });
+
+      it(`for ${info} should load=${expected} the external script`, () => {
+        azerionedgeRTD.azerionedgeSubmodule.init(dataProvider, {gdpr: tcfGDPRNotApplicable, usp});
+        expect(loadExternalScript.called).to.equal(expected);
+      });
+
+      describe('for bid request data', function () {
+        let callbackStub;
+
+        beforeEach(function () {
+          callbackStub = sinon.mock();
+          azerionedgeRTD.azerionedgeSubmodule.getBidRequestData(reqBidsConfigObj, callbackStub, dataProvider, {gdpr: tcfGDPRNotApplicable, usp});
+        });
+
+        it(`does call=${expected} the local storage looking for audiences`, function () {
+          expect(storageStub.called).to.equal(expected);
+        });
+
+        it('calls callback always', function () {
+          expect(callbackStub.called).to.be.true;
+        });
+      });
+    });
+  });
+
   describe('gets audiences', function () {
     let callbackStub;
 
@@ -111,7 +213,7 @@ describe('Azerion Edge RTD submodule', function () {
         );
       });
 
-      it('does not run apply audiences to bidders', function () {
+      it('does not apply audiences to bidders', function () {
         expect(reqBidsConfigObj.ortb2Fragments.bidder).to.deep.equal({});
       });