Define how to collect bidder geographic scope

[bretg]

Prebid Server is considering an enhancement to define a formal way for bidders to declare where their business operates. We're aware that some adapters don't support processing bids or syncs outside of a particular geographic region. However, Prebid Server doesn't currently provide a way for host companies to know these details or act on them.

We're thinking about tackling this improvement in two parts:

1. Adding a piece of metadata to bidder documentation and/or the bidder YAML file. e.g. just like you declare what mediatypes you support, you could declare which countries you operate in. With this information, host companies could enable/disable bidders in some datacenters.

2. Add this information as default in a future "bidder optimization" module. Feature request: bidder filtering module #2541

Initial feedback from the community is supportive,

In addition, one bidder requested that we include the ability for them to provide additional instructions for PBS host companies to limit where their adapter can be hosted by PBS infrastructure. e.g "don't run our bidder on hardware in country X,Y,Z"

Proposal

1. Define bidder YAML field to carry a list of countries (continents?). Positive or negative?
2. Define bidder YAML field to carry arbitrary special instructions. (YAML vs separate MD file?)

[bretg]

Here are the bidders that have expressed geographic preferences so far:

• mobilefuse: operates in US, CA
• IMDS/synacormedia: operates in US, CA
• 33across: does not operate in EEA
• lockerdome: US only
• smaato: doesn't sync in GDPR context

The first phase of this would just be documentation -- defining how bidders can declare their scope so that at least PBS host companies can set datacenter-specific config.

Here's a proposed bidder YAML for the first phase:

adapter:
  bidderA:
    // see bidderA.md for more info
    geoscope: USA, CAN
    endpoint: URL
    ...
    usersync:
      syncwhengdpr: false

And to limit the number of times EEA countries are replicated, I would suggest supporting an alias "EEA" which is a country group containing the 30-odd entities.

[bretg]

Discussed in committee. Here's an example of the way this could work:

1. in US datacenters

adapter:
  bidderA:
    // see bidderA.md for more info
    geoscope: USA, CAN
    endpoint: NA-URL
    ...

2. in EU datacenters

adapter:
  bidderA:
    // see bidderA.md for more info
    geoscope: EEA
    endpoint: EU-URL
    ...

I'll write a section in the bidder doc describing host company setup, MD file, and the geoscope config.

1. 'geoscope' setting in YAML file is a list of 3-digit countries (with EEA). No action on this field, but it allows a future module. The field should allow negation (e.g. !EEA). It should also allow an explicit "global" signal.
2. conventions and docs about adapter/host company instructions for multiple geo endpoints.

The usersync.syncwhengdpr item will be split into a separate issue and we'll consider generalizing to take into account GPP SID.

[hhhjort]

In the last example, I would still recommend that bidders handle geo-specific endpoints in their adapter, rather than rejecting the traffic if it routes through a datacenter in the wrong geo. For example, if the PBS host US datacenter goes down, and US traffic is routed to the EU datacenter, then all the US traffic will be blocked from consideration. If the adapter handles the geo specific endpoint, then the adapter can see the US origin in the ORTB request and send that bid request to the bidder's US datacenter. I am not suggesting we find a way to prevent PBS hosts/bidders from configuring as in the above example, just noting the drawbacks vs. a geo-aware adapter.

[bretg]

I think that fault tolerance is out of scope when we talk about geo-specific endpoints. This is all in the bidder's hands -- they could handle datacenter outages:

1. use a 'global traffic management' service.
2. in a failure situation, update their region-specific DNS aliases to point to another region

So be clear, what I'm trying to do here is solve 2 related-but-separate problems:

1. define a way for bidder to communicate region-specific endpoints to host companies. i.e. that the host company should deploy different endpoint config for the bidder from different regions.
2. define a way for bidders to communicate which regions they do business in. i.e. that the host company should completely disable the bidder in certain different regions.