GDPR consentManagement module

modules/appnexusBidAdapter.js

@@ -73,6 +73,14 @@ export const spec = {
     if (member > 0) {
       payload.member_id = member;
     }
+    if (bidderRequest && bidderRequest.gdprConsent) {
+      // note - objects for impbus use underscore instead of camelCase
+      payload.gdpr_consent = {
+        consent_string: bidderRequest.gdprConsent.consentString,
+        consent_required: bidderRequest.gdprConsent.consentRequired
+      };
+    }
+
     const payloadString = JSON.stringify(payload);
     return {
       method: 'POST',

modules/consentManagement.js

@@ -0,0 +1,164 @@
+/**
+ * This module adds GDPR consentManagement support to prebid.js.  It interacts with
+ * supported CMPs (Consent Management Platforms) to grab the user's consent information
+ * and make it available for any GDPR supported adapters to read/pass this information to
+ * their system.
+ */
+import * as utils from 'src/utils';
+import { config } from 'src/config';
+import { gdprDataHandler } from 'src/adaptermanager';
+
+const DEFAULT_CMP = 'appnexus';
+const DEFAULT_CONSENT_TIMEOUT = 10000;
+const DEFAULT_ALLOW_AUCTION_WO_CONSENT = true;
+
+export let userCMP;
+export let consentTimeout;
+export let allowAuction;
+
+let consentData;
+
+let context;
+let args;
+let nextFn;
+
+let timer;
+let haveExited;
+
+// add new CMPs here, with their dedicated lookup function that passes the consentString to postLookup()
+const cmpCallMap = {
+  'appnexus': lookupAppNexusConsent
+};
+
+/**
+ * This function handles interacting with the AppNexus CMP to obtain the consentString value of the user.
+ * Given the asynch nature of the CMP's API, we pass in acting success/error callback functions to exit this function
+ * based on the appropriate result.
+ * @param {function(string)} cmpSuccess acts as a success callback when CMP returns a value; pass along consentString (string) from CMP
+ * @param {function(string)} cmpError acts as an error callback while interacting with CMP; pass along an error message (string)
+ */
+function lookupAppNexusConsent(cmpSuccess, cmpError) {
+  if (!window.__cmp) {
+    return cmpError('AppNexus CMP not detected.');
+  }
+
+  // first lookup - to determine if new or existing user
+  // if new user, then wait for user to make a choice and then run postLookup method
+  // if existing user, then skip to postLookup method
+  window.__cmp('getConsentData', 'vendorConsents', function(consentString) {
+    if (consentString == null) {
+      window.__cmp('addEventListener', 'onSubmit', function() {
+        // redo lookup to find new string based on user's choices
+        window.__cmp('getConsentData', 'vendorConsents', cmpSuccess);
+      });
+    } else {
+      cmpSuccess(consentString);
+    }
+  });
+}
+
+/**
+ * If consentManagement module is enabled (ie included in setConfig), this hook function will attempt to fetch the
+ * user's encoded consent string from the supported CMP.  Once obtained, the module will store this
+ * data as part of a gdprConsent object and transferred to adaptermanager's gdprDataHandler object.
+ * This information is later added into the bidRequest object for any supported adapters to read/pass along to their system.
+ * @param {object} config This is the same param that's used in pbjs.requestBids.  The config.adunits will be updated.
+ * @param {function} fn The next function in the chain, used by hook.js
+ */
+export function requestBidsHook(config, fn) {
+  context = this;
+  args = arguments;
+  nextFn = fn;
+  haveExited = false;
+
+  // in case we already have consent (eg during bid refresh)
+  if (consentData) {
+    return nextFn.apply(context, args);
+  }
+
+  if (!Object.keys(cmpCallMap).includes(userCMP)) {
+    utils.logWarn(`CMP framework (${userCMP}) is not a supported framework.  Aborting consentManagement module and resuming auction.`);
+    return nextFn.apply(context, args);
+  }
+
+  // lookup times and user interaction with CMP prompts can greatly vary, so enforcing a timeout on the CMP process
+  timer = setTimeout(cmpTimedOut, consentTimeout);
+
+  cmpCallMap[userCMP].call(this, processCmpData, exitFailedCmp);
+}
+
+// after we have grabbed ideal ID from CMP, apply the data to adUnits object and finish up the module
+function processCmpData(consentString) {
+  if (typeof consentString !== 'string' || consentString === '') {
+    exitFailedCmp(`CMP returned unexpected value during lookup process; returned value was (${consentString}).`);
+  }
+  clearTimeout(timer);
+
+  // to stop the auction from running if we chose to cancel and timeout was reached
+  if (haveExited === false) {
+    storeConsentData(consentString);
+    nextFn.apply(context, args);
+  }
+}
+
+// store CMP string in module and invoke gdprDataHandler.setConsentData() to make information available in adaptermanger.js
+function storeConsentData(cmpConsentString) {
+  consentData = {
+    consentString: cmpConsentString,
+    consentRequired: true
+  };
+  gdprDataHandler.setConsentData(consentData);
+}
+
+function cmpTimedOut() {
+  exitFailedCmp('CMP workflow exceeded timeout threshold.');
+}
+
+// controls the exit of the module based on consentManagement config; either we'll resume the auction or cancel the auction
+function exitFailedCmp(message) {
+  clearTimeout(timer);
+  haveExited = true;
+  if (allowAuction) {
+    utils.logWarn(message + ' Resuming auction without consent data as per consentManagement config.');
+    storeConsentData(undefined);
+
+    nextFn.apply(context, args);
+  } else {
+    utils.logError(message + ' Canceling auction as per consentManagement config.');
+  }
+}
+
+/** Simply resets the module's consentData variable back to undefined */
+export function resetConsentData() {
+  consentData = undefined;
+}
+
+/**
+ * A configuration function that initializes some module variables, as well as add a hook into the requestBids function
+ * @param {object} config consentManagement module config settings; cmp (string), timeout (int), allowAuctionWithoutConsent (boolean)
+ */
+export function setConfig(config) {
+  if (typeof config.cmp === 'string') {
+    userCMP = config.cmp;
+  } else {
+    userCMP = DEFAULT_CMP;
+    utils.logInfo(`consentManagement config did not specify cmp.  Using system default setting (${userCMP}).`);
+  }
+
+  if (typeof config.timeout === 'number') {
+    consentTimeout = config.timeout;
+  } else {
+    consentTimeout = DEFAULT_CONSENT_TIMEOUT;
+    utils.logInfo(`consentManagement config did not specify timeout.  Using system default setting (${consentTimeout}).`);
+  }
+
+  if (typeof config.allowAuctionWithoutConsent !== 'undefined') {
+    allowAuction = config.allowAuctionWithoutConsent;
+  } else {
+    allowAuction = DEFAULT_ALLOW_AUCTION_WO_CONSENT;
+    utils.logInfo(`consentManagement config did not specify allowAuctionWithoutConsent.  Using system default setting (${allowAuction}).`);
+  }
+
+  $$PREBID_GLOBAL$$.requestBids.addHook(requestBidsHook, 50);
+}
+config.getConfig('consentManagement', config => setConfig(config.consentManagement));

modules/pre1api.js

@@ -124,7 +124,7 @@ pbjs.requestBids.addHook((config, next = config) => {
   } else {
     logWarn(`${MODULE_NAME} module: concurrency has been disabled and "$$PREBID_GLOBAL$$.requestBids" call was queued`);
   }
-}, 100);
+}, 5);
 
 Object.keys(auctionPropMap).forEach(prop => {
   if (prop === 'allBidsAvailable') {

modules/prebidServerBidAdapter.js

@@ -251,7 +251,7 @@ function _getDigiTrustQueryParams() {
  */
 const LEGACY_PROTOCOL = {
 
-  buildRequest(s2sBidRequest, adUnits) {
+  buildRequest(s2sBidRequest, bidRequests, adUnits) {
     // pbs expects an ad_unit.video attribute if the imp is video
     adUnits.forEach(adUnit => {
       const videoMediaType = utils.deepAccess(adUnit, 'mediaTypes.video');
@@ -381,7 +381,7 @@ const OPEN_RTB_PROTOCOL = {
 
   bidMap: {},
 
-  buildRequest(s2sBidRequest, adUnits) {
+  buildRequest(s2sBidRequest, bidRequests, adUnits) {
     let imps = [];
 
     // transform ad unit into array of OpenRTB impression objects
@@ -456,6 +456,11 @@ const OPEN_RTB_PROTOCOL = {
       request.user = { ext: { digitrust: digiTrust } };
     }
 
+    if (bidRequests && bidRequests[0].gdprConsent) {
+      request.regs = { ext: { gdpr: bidRequests[0].gdprConsent.consentRequired ? 1 : 0 } };
+      request.user = { ext: { consent: bidRequests[0].gdprConsent.consentString } };
+    }
+
     return request;
   },
 
@@ -556,7 +561,7 @@ export function PrebidServer() {
       .reduce(utils.flatten)
       .filter(utils.uniques);
 
-    const request = protocolAdapter().buildRequest(s2sBidRequest, adUnitsWithSizes);
+    const request = protocolAdapter().buildRequest(s2sBidRequest, bidRequests, adUnitsWithSizes);
     const requestJson = JSON.stringify(request);
 
     ajax(

src/adaptermanager.js

@@ -147,6 +147,16 @@ function getAdUnitCopyForClientAdapters(adUnits) {
   return adUnitsClientCopy;
 }
 
+exports.gdprDataHandler = {
+  consentData: null,
+  setConsentData: function(consentInfo) {
+    this.consentData = consentInfo;
+  },
+  getConsentData: function() {
+    return this.consentData;
+  }
+};
+
 exports.makeBidRequests = function(adUnits, auctionStart, auctionId, cbTimeout, labels) {
   let bidRequests = [];
 
@@ -211,6 +221,12 @@ exports.makeBidRequests = function(adUnits, auctionStart, auctionId, cbTimeout,
       bidRequests.push(bidderRequest);
     }
   });
+
+  if (exports.gdprDataHandler.getConsentData()) {
+    bidRequests.forEach(bidRequest => {
+      bidRequest['gdprConsent'] = exports.gdprDataHandler.getConsentData();
+    });
+  }
   return bidRequests;
 };
 

test/spec/modules/appnexusBidAdapter_spec.js

@@ -173,7 +173,7 @@ describe('AppNexusAdapter', () => {
       });
     });
 
-    it('should attache native params to the request', () => {
+    it('should attach native params to the request', () => {
       let bidRequest = Object.assign({},
         bidRequests[0],
         {
@@ -290,7 +290,7 @@ describe('AppNexusAdapter', () => {
       }]);
     });
 
-    it('should should add payment rules to the request', () => {
+    it('should add payment rules to the request', () => {
       let bidRequest = Object.assign({},
         bidRequests[0],
         {
@@ -306,6 +306,28 @@ describe('AppNexusAdapter', () => {
 
       expect(payload.tags[0].use_pmt_rule).to.equal(true);
     });
+
+    it('should add gdpr consent information to the request', () => {
+      let consentString = 'BOJ8RZsOJ8RZsABAB8AAAAAZ+A==';
+      let bidderRequest = {
+        'bidderCode': 'appnexus',
+        'auctionId': '1d1a030790a475',
+        'bidderRequestId': '22edbae2733bf6',
+        'timeout': 3000,
+        'gdprConsent': {
+          consentString: consentString,
+          consentRequired: true
+        }
+      };
+      bidderRequest.bids = bidRequests;
+
+      const request = spec.buildRequests(bidRequests, bidderRequest);
+      const payload = JSON.parse(request.data);
+
+      expect(payload.gdpr_consent).to.exist;
+      expect(payload.gdpr_consent.consent_string).to.exist.and.to.equal(consentString);
+      expect(payload.gdpr_consent.consent_required).to.exist.and.to.be.true;
+    });
   })
 
   describe('interpretResponse', () => {