Passing Chrome facilitated Testing modes to bidders

[pm-harshad-mane]

Google Chrome will have two modes of Chrome-facilitated testing and will generate testing labels that can be accessed with a header or using JS API.
Requesting changes in Fledge module to retrieve the testing labels using JS API and pass this information to bidders

https://developer.chrome.com/docs/privacy-sandbox/chrome-testing/
https://developer.chrome.com/docs/privacy-sandbox/chrome-testing/#accessing-the-cookiedeprecationlabel-javascript-api

[patmmccann]

I'd be open to core

[patmmccann]

So, to elaborate: based on the information at the link with regards to consent to device storage, I think we should add this to core enrichments subject and in gdpr be similar to vendorless modules that check purpose 1 consent to the publsiher and also that transmitufpd is allowed on the bidder before transmitting to the bidder

[dgirardi]

From here:

Accessing labels involves accessing information stored on the user’s device. In some jurisdictions (for example, the EU and UK), we understand that this activity is analogous to the use of cookies and thus accessing labels likely requires end user consent. Before you begin requesting labels, we recommend that you seek legal advice as to whether this consent obligation applies to you.

@patmmccann's interpretation is that, for gdpr, prebid should check for purpose 1 consent to retrieve labels and purpose 4 consent to pass them on to a bidder.

To me that reads like a bidder that wants those labels should be treated as if they were accessing device storage.

Either way I think this should require publisher opt-in if it's going to be in core. Otherwise we are effectively choosing what we think is the correct legal advice for publishers, the majority of which will not know that this feature even exists.

[patmmccann]

as reference InteractiveAdvertisingBureau/openrtb#143 by @dmdabbs

[dmdabbs]

Ja, for sure P1 (ePrivacy).

[patmmccann]

Here's an alternative proposal to consider: if gdprApplies, we don't pass the labels. Otherwise, we do.

[dmdabbs]

I'm writing the IAB Europe Framework Signals Group folks to inquire whether this is something about which they would opine.

[patmmccann]

Copied from a relevant email thread:

"When one is seeking a signal indicating whether the Publisher has had their consent (or legitimate interest) legal basis established to the data subject by the CMP, one should examine the Publisher Purposes Transparency and Consent string segment signals, if present. The core string PurposesConsent bit sequence is intended solely to represent disclosures made by the CMP in the context of Vendors."

[pm-harshad-mane]

@dmdabbs , @patmmccann have we concluded the next steps?
@jlquaccia can work on the required changes to pass the labels to bidders.

[dmdabbs]

Hello @pm-harshad-mane. @patmmccann can speak authoritatively on final Prebid approach to signal pre-requisites.

[pm-nitin-nimbalkar]

Hi @patmmccann , Can you please help us with final approach for the proposal.
As per the threads, Bid adapters will get this label in device.ext.dcep from prebid core ? Correct me if am wrong ?

[patmmccann]

Yes, marking as ready for dev; core will access the js api for testing mode and place the result in device.ext.dcep. Prebid will check for publisher purpose 1 consent before calling the API if the gdprEnforcement module is active and the enrichUfpd/transmitUfpd activity controls will govern transmission.

[patmmccann]

@pm-nitin-nimbalkar or @dmdabbs are epsilon or pubmatic planning to pick this pr up?

[pm-harshad-mane]

@jlquaccia can work on this.

[jlquaccia]

Yes, I will start work on this one today 👍

[patmmccann]

completed in #10683