Gdpr enforcement softVendorExceptions

prebid · Oct 25, 2022 · 5e6530d · 5e6530d
1 parent b84883c
commit 5e6530d
Show file tree

Hide file tree

Showing 3 changed files with 21 additions and 7 deletions.
diff --git a/modules/gdprEnforcement.js b/modules/gdprEnforcement.js
@@ -154,13 +154,14 @@ export function validateRules(rule, consentData, currentModule, gvlId) {
  const purposeId = TCF2[Object.keys(TCF2).filter(purposeName => TCF2[purposeName].name === rule.purpose)[0]].id;
 
  // return 'true' if vendor present in 'vendorExceptions'
- if (includes(rule.vendorExceptions || [], currentModule)) {
+ if ((rule.vendorExceptions || []).includes(currentModule)) {
  return true;
  }
+ const vendorConsentRequred = !((gvlId === VENDORLESS_GVLID || (rule.softVendorExceptions || []).includes(currentModule)))
 
  // get data from the consent string
  const purposeConsent = deepAccess(consentData, `vendorData.purpose.consents.${purposeId}`);
- const vendorConsent = gvlId === VENDORLESS_GVLID ? true : deepAccess(consentData, `vendorData.vendor.consents.${gvlId}`);
+ const vendorConsent = vendorConsentRequred ? deepAccess(consentData, `vendorData.vendor.consents.${gvlId}`) : true;
  const liTransparency = deepAccess(consentData, `vendorData.purpose.legitimateInterests.${purposeId}`);
 
  /*

diff --git a/modules/genericAnalyticsAdapter.js b/modules/genericAnalyticsAdapter.js
@@ -3,7 +3,6 @@ import {prefixLog, isPlainObject} from '../src/utils.js';
 import * as CONSTANTS from '../src/constants.json';
 import adapterManager from '../src/adapterManager.js';
 import {ajaxBuilder} from '../src/ajax.js';
-import {VENDORLESS_GVLID} from '../src/consentHandler.js';
 
 const DEFAULTS = {
  batchSize: 1,

diff --git a/test/spec/modules/gdprEnforcement_spec.js b/test/spec/modules/gdprEnforcement_spec.js
@@ -791,11 +791,12 @@ describe('gdpr enforcement', function () {
  });
 
  describe('validateRules', function () {
- const createGdprRule = (purposeName = 'storage', enforcePurpose = true, enforceVendor = true, vendorExceptions = []) => ({
+ const createGdprRule = (purposeName = 'storage', enforcePurpose = true, enforceVendor = true, vendorExceptions = [], softVendorExceptions = []) => ({
  purpose: purposeName,
- enforcePurpose: enforcePurpose,
- enforceVendor: enforceVendor,
- vendorExceptions: vendorExceptions
+ enforcePurpose,
+ enforceVendor,
+ vendorExceptions,
+ softVendorExceptions,
  });
 
  const consentData = {
@@ -909,6 +910,19 @@ describe('gdpr enforcement', function () {
  expect(isAllowed).to.equal(true);
  });
 
+ describe('when the vendor has a softVendorException', () => {
+ const gdprRule = createGdprRule('storage', true, true, [], [vendorBlockedModule]);
+
+ it('should return false if general consent was not given', () => {
+ const isAllowed = validateRules(gdprRule, consentDataWithPurposeConsentFalse, vendorBlockedModule, vendorBlockedGvlId);
+ expect(isAllowed).to.be.false;
+ })
+ it('should return true if general consent was given', () => {
+ const isAllowed = validateRules(gdprRule, consentData, vendorBlockedModule, vendorBlockedGvlId);
+ expect(isAllowed).to.be.true;
+ })
+ })
+
  describe('when module does not need vendor consent', () => {
  Object.entries({
  'storage': 1,