Proposed update to PBS GDPR restriction processing

[bretg]

Xandr has suggested that there's a detail in the original Prebid Server GDPR enforcement that needs to be revisited.

The suggestion is summarized in the "Full Enforcement" truth table in the appendix of https://docs.google.com/document/d/1fBRaodKifv1pYsWY3ia-9K96VHUjd8kKvxZlOsozm8E/edit#

Basically, we think the IAB's document is self-contradictory on this point:

On one hand it says:

RestrictionType 1 Require Consent (if Vendor has declared the Purpose IDs
legal basis as Legitimate Interest and flexible)

But then right next to that it says

If this value is 1 and vendor is registered under Legitimate Interest for that Purpose
then the vendor should not process for that Purpose.

The original PBS+GDPR spec implemented the intent of the first statement. The proposed revision focuses on the second statement, with the proposed changes in green:

Community input welcome.

[bretg]

Confirmed with Prebid's privacy lawyers that this proposal is a good reading of the IAB's document.

I've updated Prebid's doc with the rule change here and will open a ticket for the change in PBS-Java

[SyntaxNode]

@bretg Is this complete in PBS-Java? Looks like it was already merged in.

[bretg]

Released with PBS-Java 1.61