GDPR without CMP?

[polapi]

I was there's GDPR ConsentManagement Module. But what if I wish to manage the consents on my own? Are there are ways to do this?

I would expect there would be a global (or per bidder) option to set if user has given a consent. But somehow I can't find it in docs. Is there such thing?

[polapi]

So to be more precise, my question is can I somehow "manually" provide the consentString to Prebid?

Also maybe somebody knows a tool which would allow to generate consentStrings?

[veranevera]

Hi @polapi! You can get test CMP tags here https://sandbox.didomi.io/cmp.html

[ghost]

I second this question. While IAB-compliant tool would be my best choice, right now there are lots of vendors - including OneThatShouldNotBeNamed - not appearing on the vendor list, making it useless for a time being. So, using another CMP, I just want to have some kind of basic switch, something like setRequestNonPersonalizedAds(), so that there is an easy way to disable or enable ads personalization for all the bidders.

[YOzaz]

A second this request. We'll be gathering consents manually as well - not on per-bidder basis, so having ability to carry over general flag would be ideal.

[polapi]

I don't think it is possible to do a simple yes/no flag for that. I think many DSPs (to which you can connect using Prebid.js) provide access to multiple SSPs. Each of those SSPs theoretically requires separate consent - you can't just say to DSP: "my user consents to everything". I assume that's why probably the consent string is propagated around.

Still, it does not mean you need to create this string using specialized CMP. I think it should be legal to gather consent on your own, prepare the consent string on your own and manually provide it to Prebid.js.

[mkendall07]

Currently the only way to do this is the implement the IAB window.__cmp methods on page that the consent module uses.

We just added a section here that explains the approach: http://prebid.org/dev-docs/modules/consentManagement.html#publishers-not-using-an-iab-compliant-cmp

[YOzaz]

@polapi, @mkendall07 - that's the problem, you can't generate consent string on your own as far as I understand. Consent String SDK (btw, correct link in docs should be: https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/tree/master/Consent%20String%20SDK) requires CmpId and CmpVersion passed through - and if you're not using specialized CMP, there's nothing to input there...

[YOzaz]

@mkendall07, docs are missing mandatory function ping and iframe __cmpLocator injection process as well.

[YOzaz]

Created pull request for updated example: prebid/prebid.github.io#792. Still unclear how consentString should be generated.

[YOzaz]

So, if I'll save somebody some nerves today - feel free to copy, distribute, amend, etc.: https://gist.github.com/YOzaz/8847d0dc9fed83172a58fcfba972643c.
Bundle solution for non-IAB-compliant CMP.

[polapi]

@mkendall07 - thanks for providing the example and guide. I am sorry to tell that for me (someone with average knowledge of Prebid.js, CMPs and JS) it's still quite unclear how to go through with this. Especially given YOzaz says the example is missing some things (is it?). Probably, as you might expect, people like me would prefer to just provide the string while configuring Prebid. Do you think such approach might be soon implemented?

@YOzaz - as for generating consents on your own - I believe you can in fact generate those. I'm quite certain the versioning parameters are not for telling which exact implementation of CMP you've used, but for example to inform with which vendor lists the string is compatible (so the exchanges could decode it). So basically you would be generating one with some version of iab's lists.

[YOzaz]

@polapi Prebid.js ConsentManagement module does not generate consent strings, neither implements any vendor-specific allowences. It's a proxy, which looks for standard __cmp() function, gets encoded data, and passes it over for adapters.
What I see as a possibility for Prebid.js is instead of querying __cmp() function, it can accept config value (let's say, pbjs.setConfig(consentString:'XXXXX') and carry it through.

[ptomasroos]

I think that would be a great idea @YOzaz, will try to send a PR on setConfig consentString if someone isn't quicker

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.