Few adapters not reading user id data from bidRequest.userId object

[Fawke]

Description

We added GDPR Enforcement module for TCF v2.0 recently. One of the features of this module states that, if a user doesn't consent to purpose 4, Prebid won't send userId data to the adapter. We request all the adapters listed here to use standard Prebid api/code when available and not add their own custom code to access user id.
Purpose 4 implementation details are still in discussion and enforcement rules may change.

User Ids include - user.buyeruid, user.id, user.ext.eids, user.ext.digitrust and device.ifa, device.macsha1, device.macmd5, device.dpidsha1, device.dpidmd5, device.didsha1, device.didmd5

Find more details about TCF enforcement here

Prebid.js provides all configured userIds to adapters under the bidRequest.userId / bidRequest.userIdAsEids object. To enforce purpose 4, these two objects will not be passed to the adapters if consent is not given.

In light of this, all adapters will have to read user id information from either of the two objects mentioned above.

Few adapters have been found populating user id values from other sources. If you are a maintainer of any of the adapters listed below, please submit a PR in which you read the values from bidRequest.userId or bidRequest.userIdsAsEids object.

1. user.buyeruid

• deepintentBidAdapter.js - Copies this value from bid.params. Check this line. @sourabhg
• luponmediaBidAdapter.js - Copies this value from bidRequest.crumbs.pubcid. Check this line. @adxpremium @EfdalMustafic
• seedingAllianceBidAdapter.js - Copies this value from bidRequest.crubms.pubcid. Check this line. @SeedingAllianceTech

2. user.id

• deepintentBidAdapter.js - Copies this value from bid.params. Check this line. @sourabhg
• luponmediaBidAdapter.js - Generates a new id on the client side. Check this line. @adxpremium @EfdalMustafic

3. digitrust ID

I've few few bid adapters read the value of Digitrust ID from the window object. Should they not read it from bidRequest[0].bidder[].userId.digitrust ?

• gumgumBidAdapter.js - Check this line @mikewilso @jddeleon
• luponBidAdapter.js - Check this line @adxpremium @EfdalMustafic
• pubmaticBidAdapter.js - Check this line @pm-harshad-mane
• rubiconBidAdapter.js - Check this line @robertrmartinez
• sonobiBidAdapter.js - Check this line @JonGoSonobi
• prebidServerBidAdapter - Getting Digitrust Id from the config. Check this line

4. user.ext.eids

• prebidServerBidAdapter.js - Reads this value from bids.0.userIdAsEids. Check this line

5. user.ext.digitrust

• Refer to 3 digitrust ID

6. device.ifa

• platformioBidAdapter.js - Reads this value from bid[].params. Check this line @barslev @varashellov
• windtalkerBidAdapter.js - (Almost identical code to platformioBidAdapter.js) Reads this value from bid[].params. Check this line @barslev

Related PR - #5228

[pm-harshad-mane]

Thanks @Fawke , we are working on it, code changes are in QA

[jddeleon]

Tagging @susyt for GumGum adapter.

[goosemanjack]

Hold off on any further DigiTrust integration work. We are evaluating some extensive changes that may be breaking.

[patmmccann]

also the ix adapter includes // RTI ids will be included in the bid request if the function getIdentityInfo() is loaded // and if the data for the partner exist if (window.headertag && typeof window.headertag.getIdentityInfo === 'function') { let identityInfo = window.headertag.getIdentityInfo(); if (identityInfo && typeof identityInfo === 'object') { for (const partnerName in identityInfo) { if (identityInfo.hasOwnProperty(partnerName)) { let response = identityInfo[partnerName]; if (!response.responsePending && response.data && typeof response.data === 'object' && Object.keys(response.data).length) { userEids.push(response.data); } } } }

[robertrmartinez]

I have created an internal ticket for the Rubicon bid adapter changes.

[patmmccann]

fyi @ix-prebid-development

[ix-prebid-support]

@patmmccann

While it is correct that the IX Adapter reads Authenticated Signals made available on the page by the IX Identity Library javascript, the IX Identity Library is already fully privacy compliant with GDPR (TCF 1 and 2) as well as CCPA. Therefore, it's our position that:

• When we source IDs from the IX Identity Library - these IDs are subject to consent guidance that is collected and consumed by the IX Identity Library
• When we source IDs from the Prebid user module - these IDs are subject to consent guidance that is collected and consumed by Prebid

This is in alignment with the desire of Publishers who choose to use the IX Identity Library as well as Prebid.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.