Support GPP sections 13-22 (FL, MT, OR, TX, DE, IA, NE, NH, NJ, TN)

[bretg]

Type of issue

Enhancement

Description

The GPP Control US State module supports SIDs 8-12 for the original 5 states in the GPP string. Prebid's approach for each state is to normalize it into the US National attributes and then compare those attributes for certain values for each defined activity. See Prebid US Compliance for details.

The IAB has finalized 10 additional states and we've analyzed the differences and discussed with Prebid legal counsel.

The proposal is to extend the GPP Control US State module to normalize each of the new states.

Renamed attributes

Several of the new states mention a ProcessingNotice attribute that is a synonym of the original SharingNotice.

Most of the new states refer to AdditionalDataProcessingConsent, which is a renamed version of PersonalDataConsents.

Normalizing Florida (SID 13)

1. ProcessingNotice maps to SharingNotice
2. AdditionalDataProcessingConsent maps to PersonalDataConsents
3. Set these fields to NULL: SharingOptOutNotice, SharingOptOut, SensitiveDataLimitUseNotice, SensitiveDataProcessingOptOutNotice, SensitiveDataProcessing[9-12]
4. KnownChild - SID 13 does distinguish ages aligned with SID 7
   1. If SID 13 string KnownChildSensitiveDataConsents[1, 2, and 3] are all 0 then assume the user is not a child and set the normalized SID 7 KnownChildSensitiveDataConsents[1 and 2]=0 (N/A)
   2. SID 13 age ranges do not align with National SID 7. Prebid defaults to not processing data for kids 13 and under, so if KnownChildSensitiveDataConsents[1]>0 then set normalized KnownChildSensitiveDataConsents[2] = 1 (no consent). Note that array element 1 is "under 13" for SID 13, but array element 2 is "under 13" for the national string.
   3. SID 13 age ranges do not align with National SID 7. State string array entries 2 (age 13-15) and 3 (age 16-18) both map to national entry 1 (age 13-16).
      1. If both SID 13 KnownChildSensitiveDataConsents[2 and 3] are 0, then normalized KnownChildSensitiveDataConsents[1] is 0.
      2. If both SID 13 KnownChildSensitiveDataConsents[2 and 3] are 2, then normalized KnownChildSensitiveDataConsents[1] is 2 (consent).
      3. Otherwise, normalized KnownChildSensitiveDataConsents[1] is 1 (no consent).
5. All other fields pass through.

Normalizing Montana (SID 14)

1. AdditionalDataProcessingConsent maps to PersonalDataConsents
2. Set these fields to NULL: SharingOptOutNotice, SharingOptOut, SensitiveDataLimitUseNotice, SensitiveDataProcessingOptOutNotice, SensitiveDataProcessing[9-12]
3. KnownChild - SID 14 does distinguish ages aligned with SID 7
   1. If SID 14 string KnownChildSensitiveDataConsents[1, 2, and 3] are all 0 then assume the user is not a child and set the normalized SID 7 KnownChildSensitiveDataConsents[1 and 2]=0 (N/A)
   2. SID 14 age ranges do not align with National SID 7. Prebid defaults to not processing data for kids 13 and under, so if KnownChildSensitiveDataConsents[1]>0 then set normalized KnownChildSensitiveDataConsents[2] = 1 (no consent). Array element 1 is "all ages" for SID 14 which could be under 13. Array element 2 is "under 13" for the national string.
   3. SID 14 age ranges do not align with National SID 7. Prebid does not distinguish between permissions to "process" or "sell". State string array entries 2 (sell age 13-15) and 3 (process age 13-15) both map to national entry 1 (age 13-16).
      1. If both SID 14 KnownChildSensitiveDataConsents[2 and 3] are 0, then normalized KnownChildSensitiveDataConsents[1] is 0.
      2. If both SID 14 KnownChildSensitiveDataConsents[2 and 3] are 2, then normalized KnownChildSensitiveDataConsents[1] is 2 (consent).
      3. Otherwise, normalized KnownChildSensitiveDataConsents[1] is 1 (no consent).
4. All other fields pass through.

Note: SID 14 does not define ProcessingNotice like all others in this batch.

Normalizing Oregon (SID 15)

1. ProcessingNotice maps to SharingNotice
2. AdditionalDataProcessingConsent maps to PersonalDataConsents
3. Set these fields to NULL: SharingOptOutNotice, SharingOptOut, SensitiveDataLimitUseNotice, SensitiveDataProcessingOptOutNotice, SensitiveDataProcessing[10,11,12]
4. SensitiveDataProcessing fields do not are not aligned, so we need to map:
   1. SID 15 SensitiveDataProcessing[1-4] are ok - they map straight through to normalized SensitiveDataProcessing[1-4].
   2. Normalized SensitiveDataProcessing[5] - national entry 5 (citizen) maps to Oregon entries 6 and 7.
      1. If both SID 15 SensitiveDataProcessing[6 and 7] are 0, then normalized SensitiveDataProcessing[5]=0.
      2. If both SID 15 SensitiveDataProcessing[6 and 7] are 2, then normalized SensitiveDataProcessing[5]=2 (consent)
      3. Otherwise, normalized SensitiveDataProcessing[5]=1 (no consent).
   3. Normalized SensitiveDataProcessing[6] - national entry 6 (genetic) maps to Oregon entries 5 and 9.
      1. If both SID 15 SensitiveDataProcessing[5 and 9] are 0, then normalized SensitiveDataProcessing[6]=0.
      2. If both SID 15 SensitiveDataProcessing[5 and 9] are 2, then normalized SensitiveDataProcessing[6]=2 (consent).
      3. Otherwise, normalized SensitiveDataProcessing[6]=1 (no consent).
   4. SID 15 SensitiveDataProcessing[10] is normalized to SensitiveDataProcessing[7]
   5. SID 15 SensitiveDataProcessing[11] is normalized to SensitiveDataProcessing[8]
   6. SID 15 SensitiveDataProcessing[8] is normalized to SensitiveDataProcessing[9]
5. KnownChild - SID 15 does distinguish ages aligned with SID 7
   1. If SID 15 string KnownChildSensitiveDataConsents[1, 2, and 3] are all 0 then assume the user is not a child and set the normalized SID 7 KnownChildSensitiveDataConsents[1 and 2]=0 (N/A)
   2. SID 15 age ranges do not align with National SID 7. Prebid defaults to not processing data for kids 13 and under, so if KnownChildSensitiveDataConsents[1]>0 then set normalized KnownChildSensitiveDataConsents[2] = 1 (no consent). Array element 1 in SID 15 is "all ages" which could be under 13. Array element 2 is "under 13" for the national string.
   3. SID 15 age ranges do not align with National SID 7. Prebid does not distinguish between permissions to "process" or "sell". State string array entries 2 (sell age 13-15) and 3 (process age 13-15) both map to national entry 1 (age 13-16).
      1. If both SID 15 KnownChildSensitiveDataConsents[2 and 3] are 0, then normalized KnownChildSensitiveDataConsents[1] is 0.
      2. If both SID 15 KnownChildSensitiveDataConsents[2 and 3] are 2, then normalized KnownChildSensitiveDataConsents[1] is 2 (consent).
      3. Otherwise, normalized KnownChildSensitiveDataConsents[1] is 1 (no consent).
6. All other fields pass through.

Normalizing Texas (SID 16)

1. ProcessingNotice maps to SharingNotice
2. AdditionalDataProcessingConsent maps to PersonalDataConsents
3. Set these fields to NULL: SharingOptOutNotice, SharingOptOut, SensitiveDataLimitUseNotice, SensitiveDataProcessingOptOutNotice, SensitiveDataProcessing[9-12]
4. KnownChild - Similar to SIDs 9,10, and 11, SID 16 does distinguish ages, so Prebid will never normalize a positive KnownChild consent.
   1. If the SID 16 KnownChildSensitiveDataConsents value is 1 or 2, normalize to SID 7 KnownChildSensitiveDataConsents[1 and 2]=1 (no consent)
   2. If the SID 16 KnownChildSensitiveDataConsents value is 0, assume the user is not a child and normalize to SID 7 KnownChildSensitiveDataConsents[1 and 2]=0 (N/A)
5. All other fields pass through.

Normalizing Delaware (SID 17)

1. ProcessingNotice maps to SharingNotice
2. AdditionalDataProcessingConsent maps to PersonalDataConsents
3. Set these fields to NULL: SharingOptOutNotice, SharingOptOut, SensitiveDataLimitUseNotice, SensitiveDataProcessingOptOutNotice, SensitiveDataProcessing[9-12]
4. Normalized SensitiveDataProcessing[6] - national entry 6 (genetic) covers both Delaware entries 6 and 9.
   1. If both SID 17 SensitiveDataProcessing[6 and 9] are 0, then normalized SensitiveDataProcessing[6]=0.
   2. If both SID 17 SensitiveDataProcessing[6 and 9] are 2, then normalized SensitiveDataProcessing[6]=2 (consent).
   4. Otherwise, normalized SensitiveDataProcessing[6]=1 (no consent).
5. KnownChild - SID 17 definitions do not align with SID 7.
   1. If all SID 17 string KnownChildSensitiveDataConsents[1 through 5] are all 0 then assume the user is not a child and set the normalized SID 7 KnownChildSensitiveDataConsents[1 and 2]=0 (N/A)
   2. SID 17 age ranges do not align with National SID 7. Prebid defaults to not processing data for kids 13 and under, so if KnownChildSensitiveDataConsents[1]>0 then set normalized KnownChildSensitiveDataConsents[2] = 1 (no consent). Array element 1 in SID 17 is "all ages" which could be under 13. Array element 2 is "under 13" for the national string.
   3. SID 17 age ranges do not align with National SID 7. Prebid does not distinguish between permissions to "process" or "sell". All 4 state string array entries map to national entry 1 (age 13-16).
      1. If both SID 15 KnownChildSensitiveDataConsents[2 through 5] are 0, then normalized KnownChildSensitiveDataConsents[1] is 0.
      2. If both SID 15 KnownChildSensitiveDataConsents[2 through 5] are 2, then normalized KnownChildSensitiveDataConsents[1] is 2 (consent).
      3. Otherwise, normalized KnownChildSensitiveDataConsents[1] is 1 (no consent).
6. All other fields pass through.

Normalizing Iowa (SID 18)

1. ProcessingNotice maps to SharingNotice
2. AdditionalDataProcessingConsent maps to PersonalDataConsents - Note the IAB page for SID 18 is missing AdditionalDataProcessingConsent -- we assume this is an error and that implementations will support it.
3. Set these fields to NULL: SharingOptOutNotice, SharingOptOut, SensitiveDataLimitUseNotice, SensitiveDataProcessing[9-12]. (Note: unlike the other states in this batch, Iowa supports SensitiveDataOptOutNotice, so don't NULL it out.)
4. KnownChild - Similar to SIDs 9,10, and 11, SID 18 does distinguish ages, so Prebid will never normalize a positive KnownChild consent.
   1. If the SID 18 KnownChildSensitiveDataConsents value is 1 or 2, normalize to SID 7 KnownChildSensitiveDataConsents[1 and 2]=1 (no consent)
   2. If the SID 18 KnownChildSensitiveDataConsents value is 0, assume the user is not a child and normalize to SID 7 KnownChildSensitiveDataConsents[1 and 2]=0 (N/A)
5. All other fields pass through.

Normalizing Nebraska (SID 19)

1. ProcessingNotice maps to SharingNotice
2. AdditionalDataProcessingConsent maps to PersonalDataConsents
3. Set these fields to NULL: SharingOptOutNotice, SharingOptOut, SensitiveDataLimitUseNotice, SensitiveDataProcessingOptOutNotice, SensitiveDataProcessing[9-12]
4. KnownChild - Similar to SIDs 9,10, and 11, SID 16 does distinguish ages, so Prebid will never normalize a positive KnownChild consent.
   1. If the SID 19 KnownChildSensitiveDataConsents value is 1 or 2, normalize to SID 7 KnownChildSensitiveDataConsents[1 and 2]=1 (no consent)
   2. If the SID 19 KnownChildSensitiveDataConsents value is 0, assume the user is not a child and normalize to SID 7 KnownChildSensitiveDataConsents[1 and 2]=0 (N/A)
5. All other fields pass through.

Normalizing New Hampshire (SID 20)

1. ProcessingNotice maps to SharingNotice
2. AdditionalDataProcessingConsent maps to PersonalDataConsents
3. Set these fields to NULL: SharingOptOutNotice, SharingOptOut, SensitiveDataLimitUseNotice, SensitiveDataProcessingOptOutNotice, SensitiveDataProcessing[9-12]
4. KnownChild - SID 20 does distinguish ages aligned with SID 7
   1. If SID 20 string KnownChildSensitiveDataConsents[1, 2, and 3] are all 0 then assume the user is not a child and set the normalized SID 7 KnownChildSensitiveDataConsents[1 and 2]=0 (N/A)
   2. SID 20 age ranges do not align with National SID 7. Prebid defaults to not processing data for kids 13 and under, so if SID 20 KnownChildSensitiveDataConsents[1]>0 then set normalized KnownChildSensitiveDataConsents[2] = 1 (no consent). Array element 1 in SID 20 is "all ages" which could be under 13. Array element 2 is "under 13" for the national string.
   3. SID 20 age ranges do not align with National SID 7. Prebid does not distinguish between permissions to "process" or "sell". State string array entries 2 (sell age 13-15) and 3 (process age 13-15) both map to national entry 1 (age 13-16).
      1. If both SID 15 KnownChildSensitiveDataConsents[2 and 3] are 0, then normalized KnownChildSensitiveDataConsents[1] is 0.
      2. If both SID 15 KnownChildSensitiveDataConsents[2 and 3] are 2, then normalized KnownChildSensitiveDataConsents[1] is 2 (consent).
      3. Otherwise, normalized KnownChildSensitiveDataConsents[1] is 1 (no consent).
5. All other fields pass through.

Normalizing New Jersey (SID 21)

1. ProcessingNotice maps to SharingNotice
2. AdditionalDataProcessingConsent maps to PersonalDataConsents
3. Set these fields to NULL: SharingOptOutNotice, SharingOptOut, SensitiveDataLimitUseNotice, SensitiveDataProcessingOptOutNotice, SensitiveDataProcessing[9-12]
4. Normalized SensitiveDataProcessing[6] - national entry 6 (genetic) covers both NJ entries 6 and 9.
   1. If both SID 21 SensitiveDataProcessing[6 and 9] are 0, then normalized SensitiveDataProcessing[6]=0.
   2. If both SID 21 SensitiveDataProcessing[6 and 9] are 2, then normalized SensitiveDataProcessing[6]=2.
   4. Otherwise, normalized SensitiveDataProcessing[6]=1 (no consent).
5. KnownChild - SID 21 definitions do not align with SID 7.
   1. If all SID 21 string KnownChildSensitiveDataConsents[1 through 5] are all 0 then assume the user is not a child and set the normalized SID 7 KnownChildSensitiveDataConsents[1 and 2]=0 (N/A)
   2. SID 21 age ranges do not align with National SID 7. Prebid defaults to not processing data for kids 13 and under, so if KnownChildSensitiveDataConsents[1]>0 then set normalized KnownChildSensitiveDataConsents[2] = 1 (no consent). Array element 1 in SID 21 is "all ages" which could be under 13. Array element 2 is "under 13" for the national string.
   3. SID 21 age ranges do not align with National SID 7. Prebid does not distinguish between permissions to "process" or "sell". All 4 state string array entries map to national entry 1 (age 13-16).
      1. If both SID 15 KnownChildSensitiveDataConsents[2 through 5] are 0, then normalized KnownChildSensitiveDataConsents[1] is 0.
      2. If both SID 15 KnownChildSensitiveDataConsents[2 through 5] are 2, then normalized KnownChildSensitiveDataConsents[1] is 2 (consent).
      3. Otherwise, normalized KnownChildSensitiveDataConsents[1] is 1 (no consent).
6. All other fields pass through.

Normalizing Tennessee (SID 22)

1. ProcessingNotice maps to SharingNotice
2. AdditionalDataProcessingConsent maps to PersonalDataConsents
3. Set these fields to NULL: SharingOptOutNotice, SharingOptOut, SensitiveDataLimitUseNotice, SensitiveDataProcessingOptOutNotice, SensitiveDataProcessing[9-12]
4. KnownChild - Similar to SIDs 9,10, and 11, SID 16 does distinguish ages, so Prebid will never normalize a positive KnownChild consent.
   1. If the SID 19 KnownChildSensitiveDataConsents value is 1 or 2, normalize to SID 7 KnownChildSensitiveDataConsents[1 and 2]=1 (no consent)
   2. If the SID 19 KnownChildSensitiveDataConsents value is 0, assume the user is not a child and normalize to SID 7 KnownChildSensitiveDataConsents[1 and 2]=0 (N/A)
5. All other fields pass through.

[patmmccann]

Marking as blocked until next 6 state specs are released

[bretg]

FYI - we're waiting on InteractiveAdvertisingBureau/Global-Privacy-Platform#121 to be finalized and add the additional 6 states.

[bretg]

Ok - added the other states. Ready for review.