Using TCF with Prebid

Some publishers use the application Prebid for header bidding on their sites. OneTrust, working as a Universal Consent & Preference Management Provider (CMP), gathers consent from the user and writes consent strings defined by the IAB framework. OneTrust's configuration is compatible with sites that use Prebid.

In order to consider site visitor consent in header bidding auctions, Publishers must first complete the following steps:

  • Update Prebid to the latest version

  • Add the Universal Consent & Preference Management - GDPR module when downloading the prebid.js JavaScript file.

The module uses the following basic process:

  1. Fetch the site visitor's consent data from the CMP.

    To load the TCF stub before the banner script loads, you need to add the following tag to the head section of your website, before any header bidding scripts.

    CODE 
    <script src="https://cdn.cookielaw.org/consent/tcf.stub.js" type="text/javascript" charset="UTF-8"></script>

    You will not need to make any changes to the banner script tag. For an example, see Using TCF with Header Bidding (TCF Stub).

    Note:

    For new visitors, the CMP will respond only once to indicate there is consent information available (i.e. the user has made consent selections). Since this can take time, the module has a timeout setting. The CMP will be allotted a specified amount of time to operate before timeout occurs and the operation fails.

    If an error or timeout occurs, the auction will either be canceled or will proceed without the site visitor's consent selections.

    Publishers can select either option through their implementation of the Prebid code, as appropriate for their sites.

  2. Prebid will incorporate the consent information into the auction objects (for adapters to collect) and then allow the auction to proceed.

Configuring Prebid

GDPR

You can configure your Prebid deployment with an IAB CMP by adding a consentManagement.gdpr configuration option.

GDPR Example:

JSON 
var pbjs = pbjs || {};
     pbjs.que = pbjs.que || [];
     pbjs.que.push(function() {
        pbjs.setConfig({
          consentManagement: {
            gdpr: {
              cmpApi: 'iab',
              timeout: 8000,
              defaultGdprScope: true
            }
          }
        });
     });

If you do not collect consent for the entire IAB Global Vendor List, make sure to configure the IAB Vendor IDs corresponding to the bidders that you are working with through Prebid. If you collect consent of all IAB Vendors, then there is nothing further to configure.

CCPA

You can configure your Prebid deployment with an IAB CMP by adding a consentManagement.gdpr configuration option.

CCPA Example:

JSON 
var pbjs = pbjs || {};
     pbjs.que = pbjs.que || [];
     pbjs.que.push(function() {
       pbjs.setConfig({
         consentManagement: {
           usp: {
            cmpApi: 'iab',
            timeout: 100 // US Privacy timeout 100ms
           }
         }
       });
     });

GDPR and CCPA Example:

JSON 
var pbjs = pbjs || {};
     pbjs.que = pbjs.que || [];
     pbjs.que.push(function() {
       pbjs.setConfig({
         consentManagement: {
           gdpr: {
            cmpApi: 'iab',
            allowAuctionWithoutConsent: false, // suppress auctions if there's no GDPR consent string
            timeout: 3000  // GDPR timeout 3000ms
           },
           usp: {
            timeout: 100 // US Privacy timeout 100ms
           }
         }
       });
     });

For more information about how the Consent Management module from Prebid works, please see Prebid Website