github.com/prebid/prebid-server/v2@v2.18.0/gdpr/full_enforcement.go (about)

     1  package gdpr
     2  
     3  import (
     4  	tcf2 "github.com/prebid/go-gdpr/vendorconsent/tcf2"
     5  )
     6  
     7  const (
     8  	pubRestrictNotAllowed           = 0
     9  	pubRestrictRequireConsent       = 1
    10  	pubRestrictRequireLegitInterest = 2
    11  )
    12  
    13  // FullEnforcement determines if legal basis is satisfied for a given purpose and bidde/analytics adapterr using
    14  // the TCF2 full enforcement algorithm. The algorithm is a detailed confirmation that reads the
    15  // GVL, interprets the consent string and performs legal basis analysis necessary to perform a
    16  // privacy-protected activity.
    17  // FullEnforcement implements the PurposeEnforcer interface
    18  type FullEnforcement struct {
    19  	cfg purposeConfig
    20  }
    21  
    22  // LegalBasis determines if legal basis is satisfied for a given purpose and bidder/analytics adapter based on the
    23  // vendor claims in the GVL, publisher restrictions and user consent.
    24  func (fe *FullEnforcement) LegalBasis(vendorInfo VendorInfo, name string, consent tcf2.ConsentMetadata, overrides Overrides) bool {
    25  	enforcePurpose, enforceVendors := fe.applyEnforceOverrides(overrides)
    26  
    27  	if consent.CheckPubRestriction(uint8(fe.cfg.PurposeID), pubRestrictNotAllowed, vendorInfo.vendorID) {
    28  		return false
    29  	}
    30  	if !enforcePurpose && !enforceVendors {
    31  		return true
    32  	}
    33  	if fe.cfg.vendorException(name) && !overrides.blockVendorExceptions {
    34  		return true
    35  	}
    36  
    37  	purposeAllowed := fe.consentEstablished(consent, vendorInfo, enforcePurpose, enforceVendors)
    38  	legitInterest := fe.legitInterestEstablished(consent, vendorInfo, enforcePurpose, enforceVendors)
    39  
    40  	if consent.CheckPubRestriction(uint8(fe.cfg.PurposeID), pubRestrictRequireConsent, vendorInfo.vendorID) {
    41  		return purposeAllowed
    42  	}
    43  	if consent.CheckPubRestriction(uint8(fe.cfg.PurposeID), pubRestrictRequireLegitInterest, vendorInfo.vendorID) {
    44  		return legitInterest
    45  	}
    46  
    47  	return purposeAllowed || legitInterest
    48  }
    49  
    50  // applyEnforceOverrides returns the enforce purpose and enforce vendor configuration values unless
    51  // those values have been overridden, in which case they return true
    52  func (fe *FullEnforcement) applyEnforceOverrides(overrides Overrides) (enforcePurpose, enforceVendors bool) {
    53  	enforcePurpose = fe.cfg.EnforcePurpose
    54  	if overrides.enforcePurpose {
    55  		enforcePurpose = true
    56  	}
    57  	enforceVendors = fe.cfg.EnforceVendors
    58  	if overrides.enforceVendors {
    59  		enforceVendors = true
    60  	}
    61  	return
    62  }
    63  
    64  // consentEstablished determines if consent has been established for a given purpose and bidder
    65  // based on the purpose config, user consent and the GVL. For consent to be established, the vendor
    66  // must declare the purpose as either consent or flex and the user must consent in accordance with
    67  // the purpose configs.
    68  func (fe *FullEnforcement) consentEstablished(consent tcf2.ConsentMetadata, vi VendorInfo, enforcePurpose bool, enforceVendors bool) bool {
    69  	if vi.vendor == nil {
    70  		return false
    71  	}
    72  	if !vi.vendor.Purpose(fe.cfg.PurposeID) {
    73  		return false
    74  	}
    75  	if enforcePurpose && !consent.PurposeAllowed(fe.cfg.PurposeID) {
    76  		return false
    77  	}
    78  	if enforceVendors && !consent.VendorConsent(vi.vendorID) {
    79  		return false
    80  	}
    81  	return true
    82  }
    83  
    84  // legitInterestEstablished determines if legitimate interest has been established for a given
    85  // purpose and bidder based on the purpose config, user consent and the GVL. For consent to be
    86  // established, the vendor must declare the purpose as either legit interest or flex and the user
    87  // must have been provided notice for the legit interest basis in accordance with the purpose configs.
    88  func (fe *FullEnforcement) legitInterestEstablished(consent tcf2.ConsentMetadata, vi VendorInfo, enforcePurpose bool, enforceVendors bool) bool {
    89  	if vi.vendor == nil {
    90  		return false
    91  	}
    92  	if !vi.vendor.LegitimateInterest(fe.cfg.PurposeID) {
    93  		return false
    94  	}
    95  	if enforcePurpose && !consent.PurposeLITransparency(fe.cfg.PurposeID) {
    96  		return false
    97  	}
    98  	if enforceVendors && !consent.VendorLegitInterest(vi.vendorID) {
    99  		return false
   100  	}
   101  	return true
   102  }