TCF restrictions for server-side bidders

[bretg]

Type of issue

feature request

Description

Moving a PBJS bidder server-side can result in TCF2 fetchBids errors in PBJS -- those bidders are removed from the auction.

The issue is that PBJS doesn't know the GVL ID when there's no client-side adapter. The way to solve it is to add a gvlMapping, but this is kind of a pain -- when the pub wants to push a bidder server-side, they have to remember to look up each GVL ID and add it to the gvlMapping.

The proposal is to add a deferS2Sbidders flag to the TCF Control module for basicAds” (Purpose 2). We discussed doing this for other purposes, but decided that the only known problem is when PBJS completely suppresses the auction. The proposal is that we start with the known problem and enhance to refine when those use cases are defined.

Proposed config:

 pbjs.setConfig({
   consentManagement: {
     gdpr: {
       cmpApi: 'iab',   // activates the enforcement module
       defaultGdprScope: true,
       rules: [{
         purpose: "basicAds",
         enforcePurpose: true,
         enforceVendor: true,
         deferS2Sbidders: true         // default is false
       },{
         purpose: "personalizedAds",
         enforcePurpose: true,
         enforceVendor: true
       },{
         purpose: "transmitPreciseGeo",
         enforcePurpose: true,
         enforceVendor: true
       },{

Then before the module rejects the auction for server-side bidders, it would check this flag.

[bretg]

Updated per committee discussion

[bretg]

It's been pointed out that there’s a decent argument to be made that Prebid.js is being overly cautious even with this proposal - since the request isn’t actually going directly to the bidder with the unknown GVLID, it seems reasonable to delegate the decision to hit a server-side bidder’s endpoint to Prebid Server.

I would suggest that we add this flag in 9.x with the default to false, then consider flipping the default for 10.0

[bretg]

Bump. We've been hit with this again.

The workaround proposed (gvlMapping) doesn't work for the kobler adapter because they're not on the GVL list. So the workaround for them requires both client-side and server-side vendor exceptions.