Clarification on event status

[janwinkler]

Under TCF EU the event status tcloaded / useractioncomplete were used to determine when the end of the user activity is reached. With the current GPP events, there seems to be no similar thing. Can one assume that the following is correct?

TCF "tcloaded" equals to GPP's:
cmpStatus = "loaded" + cmpDisplayStatus = "disabled"

TCF "cmpuishown" equals to GPP's:
cmpStatus = "loaded" + cmpDisplayStatus = "visible"

TCF "useractioncomplete" equals to GPP's:
cmpStatus = "loaded" + cmpDisplayStatus = "hidden"

Especially the last case seems not to be 100% accurate since there are case when the CMP is loaded but the interface is not yet loaded (but will load in a few moments).

In order to make it more clear, I'd propose to update the Ping Status Codes and separate the codes of cmpDIsplayStatus into:

• visible - Interface is currently shown (vendor shall wait for next events)
• hidden - Interface is not yet displayed, CMP has not yet decided to show the interface (vendors shall wait for next event)
• disabled - Interface was shown and is now closed or will not show (no sections apply or data is already current and does not need a renewal, vendors can query the gpp data)

[patmmccann]

At prebid we're struggling with this as well; we're assuming, as many of our publishers are implementing this way, that cmp display status will always be visible in the United States, as the opt out button will always be available on the page. Since useractioncomplete doesn't really have an equivalent; we're simply using status loaded and proceeding with an auction. I think your assumptions make sense in an opt in regime, but not in the US

I think display status should have a new indicator that distinguishes visible and should wait from visible don't wait

[janwinkler]

@patmmccann
Thats interesting, so you would say that the "Do not sell my ...."-Link on the page is equivalent to the CMP being visible. How would a publisher than be able to tell the vendor that the website does not incliude the link (but instead the notification layer is open/visible)? Or in case when there is a link and a notice/banner - wouldnt a vendor want to wait until the user decided (closed that banner) before starting with advertising? (e.g. the visitor could use the banner to opt-out ...)

Does it mean we need a forth and/or independent status? Something like cmpOutOutLinkStatus = "unknown/notApplicable/visible/notVisible"?

[patmmccann]

so you would say that the "Do not sell my ...."-Link on the page is equivalent to the CMP being visible.

exactly

How would a publisher than be able to tell the vendor that the website does not incliude the link (but instead the notification layer is open/visible)?

there is no way :(

I'm not sure at all the best way forward, I look forward to the discussion

[dgirardi]

I think it'd be wise to separate the idea of "cmp is visible" from "user is being prompted" - or be explicit that "visible" means the latter, as the implementation examples seem to suggest.

[patmmccann]

cmpDisplayStatus = 'onpage' could be a new display status?

[janwinkler]

"onpage" woulnt be sufficient or? e.g. if you have both (opt out link and notice layer), would it then be cmpDisplayStatus = "onpage+visible" or would there be two events right after each other?

[dgirardi]

My preference, as a Prebid developer, would be a separate flag that indicates whether the user needs to take action (which was the useractioncomplete event in TCF). Maybe userActionComplete = true/false. It's possible that this is what 'visible' is supposed to mean, if so, it should be stated explicitly IMO.

I am not interested at all in the visibility of the CMP - all I need to know is, is the user likely to change consent in the next few seconds?

[patmmccann]

. if you have both (opt out link and notice layer)

I am having trouble finding the code section, but I thought this was illegal, that opt out and notice most be adjacent and in the same layer.

[janwinkler]

@patmmccann What do you mean with "illegal"? unwanted by the gpp spec or unwanted by CCPA/PEPIDA/GDPR/whatever?

[patmmccann]

unwanted by California law

[janwinkler]

just re-read your comment. i think we mean two different thinks: with "opt out link" i meant the "do not sell my personal data" link (the link that opens/shows the opt-out page), not the link that performs the actual opt out.

basically the question is whether we want to separate between the four states:

a) the "potential" to see the notice (by having the do-not-sell-link on the page, some websites seem to see this as sufficient and do not show any overlay/notice unless you click that link)
b) actually showing the notice (e.g. layer opens or user navigates to opt-out-page)
c) actual opt out (e.g. user clicked some opt-out button)
d) none of the above (no opt out option is given by the website, e.g. no sharing/sale of data on the page or publisher believes they are in a different legal framework)

as for the "illegal":
yes CA does seem to require the actual opt-out-link but others seem not to need it: e.g. in the gpp CO signals we separate by "SharingNotice", "SaleOptOutNotice" and "SaleOptOut". Hence my assumption is that there is a case when a website only shows a notice but does not offer any opt-out (SharingNotice=1, SaleOptOutNotice=0, SaleOptOut=0)

[patmmccann]

The latest proposal is now that we have event listeners in GPP (see #55 ); we can mirror the eventStatus codes from TCF v2 spec. This means that a page can signal with eventStatus 'useractioncomplete' that an auction is 'ready to go' in say California, even though cmpDisplayStatus may remain 'visible'. 'tcloaded' could become 'gpploaded'

See eventStatus codes from TCF at https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20-%20CMP%20API%20v2.md#addeventlistener

[thcolin-bricks]

Hi,

IABTechLab/iabgpp-es repository seems to already use TCF v2 events behavior, can I trust it ?

[janwinkler]

@thcolin-bricks no, the naming & logic is not final yet