prebid
Handle deleted GVL entities
https://github.com/prebid/Prebid.js/issues/13606 has some consideration for how to handle gvl entries with a deletedDate. Prebid server does not consider this field.
It could consider adapters with deleted gvl values as invalid somehow. It could also complain at build time if any adapter specifies a deleted value.
The Identify PMC supports PBS checking the vendor-list.json for deleted or invalid gvl values in as close to realtime as possible.
There are a couple of different options we can consider here. One is to run a github actions job that pulls down the latest GVL and checks if all of the GVL IDs in the project are active (not deleted).
The Prebid Server team is not inclined to stop the build if a deleted entry is found but we should discuss further. One option here is to consider temporarily removing them from the project until the issue is rectified. PBJS's approach is to fail the build and remove that adapter's GVL ID which triggers activity control behavior.
Also, if we do allow the build to complete, how do we handle the scenario where the GVL entry is deleted in the latest GVL but a request is received with a consent string that references a previous GVL version where the entry is not deleted?
We'll discuss this at the next PMC.
Discussed with the PMC. The preference here is to handle this at runtime. When the vendor lists are fetched and cached at startup, we can remove any deleted entries. Downstream, in the GDPR request processing, the bidder will have a GVL ID but it will not find it in the referenced vendor list which will result in that part of the legal processing allowing it. It should behave the same way as if no GVL ID exists for the bidder.
If a GVL entry is deleted in the most recent vendor list and a request is received with a consent string referencing an older vendor list where the entry exists, the request should undergo normal GDPR processing with all legal basis calculations taking place.
Prebid.js does not have the gvlid at runtime, only build time. So we only refer to the current GVL and our build blocks if a GVL has a delete date and we have a GVL for that vendor. We then remove those GVLs from those adapters.
Discussed with Privacy and identity PMC.
- PBS should periodically (how frequently should be configurable by the host company) fetch the latest GVL and build an internal list of deleted vendors.
- Vendors, who are marked as deleted in the latest GVL, should be treated as deleted in all historical GVL versions too, for the purposes of privacy enforcement.
- Deleted GVL entries should be treated the same way as if such a vendor never existed in the first place.
- PBS should then perform enforcement based on how the host company has configured the enforcement (
no,basic, orfullenforcement)
