Update GDPR support for Purpose 4

[bretg]

Type of issue

Enhancement

Description

In reviewing privacy policies in light of the recent MSPA/USNat changes, it was recognizes that we could tighten Prebid GDPR support by allowing publishers to anonymize first party data.

The Prebid GDPR doc has been updated:

1. Define Purpose 4 behavior. It's the same algorithm for determining consent as for P2 and P7, but the impact of not having consent is new: remove UFPD as defined in the doc.
2. Flowchart updated

It should be discussed in committee how the addition of this purpose is phased-in. If it's considered a "breaking" change, it could be added as not-enforced-by-default and switched in future major release.

Here's the proposed config for P4:

 pbjs.setConfig({
   consentManagement: {
     gdpr: {
       cmpApi: 'iab',   // activates the enforcement module
       defaultGdprScope: true,
       rules: [{ 
         ...
       },{
         purpose: "personalizedAds",
         enforcePurpose: true,
         enforceVendor: true
       }]
     }
   }
 });