Use * syntax for faster search

In this article:


Overview

As a reminder, clients that wish to comply with the General Data Protection Regulation (GDPR) - Transparency Consent Framework (TCF) v2.0 policy must make all necessary changes according to IAB timeline and finish by August 15, 2020. IAB Europe Transparency and Consent Framework (TCF) intends to help the digital advertising industry interpret and comply with EU rules on data protection and privacy (GDPR, ePD).

TCF v1.0 vs. TCF v2.0

Take Action

If you aim to comply with the GDPR - TCF v2.0 guidelines, you must be do the following:

Work with a Consent Management Platform (CMP) to collect a Transparency and Consent String (TC String)

Integrate with FreeWheel on TCF v2 by configuring the GDPR key-values directly OR update to FreeWheel's most recent SDK

Send FreeWheel TC string and GDPR declaration in an ad request when applicable

TCF v2 will take effect on March 31, 2020. FreeWheel will support TCF v1 in parallel of TCF v2 until we deprecate the support of V1 in September 2020.


Impact on Key Value Pairs

Under TCF v2.0, there are two required parameters related to GDPR: "gdpr" and "gdpr_consent" (TC string), which translate to FreeWheel reserved request key-values "_fw_gdpr" and "_fw_gdpr_consent":

  • If "_fw_gdpr" is 0, meaning the publisher indicates that GDPR does not apply, then the FreeWheel GDPR product features related to TCF will not be triggered.
  • Otherwise, FreeWheel will extract and parse the TC string within "_fw_gdpr_consent", and that will trigger GDPR features that relate to data processing within FreeWheel products, and/or the GDPR data flow constraints that relate to sending data downstream.

While the implementation of TCF v2.0 has not changed, there is an expected behavior change regarding the key pairs: _fw_gdpr and _fw_gdpr_consent. Please see additional details below.




Prior to February 18, 2020 (6.34 Release)

As of February 18, 2020 (6.34 Release)

Scenario 1:

  • _fw_gdpr=1
  • _fw_gdpr_consent is empty

MRM assumes no consent has been given for audience targeting and reporting.

MRM will no longer assume that no consent has been given if _fw_gdpr_consent is empty. Instead, it will not trigger GDPR product features.

Clients must include a TC string in _fw_gdpr_consent in accordance with the new TCF v2.0 policy.

Scenario 2:

  • _fw_gdpr=0
  • _fw_gdpr_consent has a value
MRM looks at the consent string to see if the user gives consent, even if _fw_gdpr=0.MRM GDPR product features related to TCF will not be triggered. This happens because the publisher has indicated that GDPR does not apply (_fw_gdpr=0).


Impact on Publisher

Be sure to check the readiness required for TCF v2.0 with your CMP and your DMP, DSP and other vendors you work with. Passing the proper user consent and being integrated with a CMP allows you to:

  • Pass the proper personal information to the demand
  • And also allows you to better monetize your inventory
_fw_gdpr_fw_gdpr_consentFreeWheel Action
_fw_gdpr = 0Any value
  • GDPR does not apply
  • GDPR features are not triggered

_fw_gdpr = 1

OR

_fw_gdpr = Not Present or Invalid

_fw_gdpr_consent = contains valid Consent string

Features of TCF v1 are applied

_fw_gdpr_consent = Contains valid TC (Transparency & Consent) string
  • Features of TCF v2 are applied.
  • Check constraints to data processing, and to sending data downstream.
_fw_gdpr_consent = Not present or invalid
  • GDPR does not apply
  • GDPR features are not triggered

Take Action

→ For publishers already integrated with IAB TCF v1 and sending GDPR key values (_fw_gdpr and _fw_gdpr_consent to SFX/MRM):

No update is required.

FreeWheel will expect to receive the TCF v2 parameters through the same key values; however, please see the behavioral impact on key values.

FreeWheel relies on our clients who are data controllers to disclose details of Freewheel's cookies to the users, and obtain their consent. If the TC string indicates that the publisher does not receive consent from users to set a cookie, FreeWheel will not set up FreeWheel's cookies on the user's device, which will affect all features utilizing cookies (supported on March 17, 2020).


→ For publishers using SFX/MRM to retrieve key values (_fw_gdpr and _fw_gdpr_consent key values from CMP v1):

You must update to the most recent version of MRM/SFX SDK.

The SDK directly calls CMP API v2.

The new MRM SDK will not support CMP API v1.

FreeWheel relies on our clients who are data controllers to disclose details of Freewheel's cookies to the users, and obtain their consent. If the TC string indicates that the publisher does not receive consent from users to set a cookie, FreeWheel will not set up FreeWheel's cookies on the user's device, which will affect all features utilizing cookies (supported on March 17, 2020).

Impact on DSP and DMP

SFX and MRM must not only check the legal basis for its own purpose but also the downstream vendors' (DSP, DMP) before sharing personal data with them.

One of the following conditions must be met to determine if Personal Data can be included into an OpenRTB bid:

DSP adopts TCF v2, while not relying on Out-of-Band (OOB) legal basis and getting consent from user or legitimate interest.

DSP adopts TCF v2, while relying on OOB legal basis, and FreeWheel reasonably believes that the DSP has a justified legal basis for processing the personal data.

DSP does not adopt TCF v2, while FreeWheel reasonably believes that the DSP has a justified legal basis for processing the personal data.


TopicDescriptionAction
User Sync with DMP and DSP

When TCF v2 applies, Cookie-based user sync tags will be returned with ad response if one of the following conditions is met:

  • Receiver of the tag is registered on Global Vendor List
  • FreeWheel reasonably believes that the receiver of the tag has a valid legal basis for processing the personal data.
  • FreeWheel passes on the TCF parameters we received from upstream digital properties to the tag's receivers in the tag
  • Each partner is responsible for their GDPR compliance in regards to their use of personal data sent by FreeWheel
Passing the TC string to Downstream Partners3rd Party Buyers
  • FreeWheel will support {GDPR} and {GDPR_CONSENT_285} macros so that the macros can be expanded when included in a tag booked in SFX/MRM.
  • {GDPR} and {GDPR_CONSENT} macros (SFX) and #{request.KeyValue("_fw_gdpr")} and #{request.KeyValue("_fw_gdpr_consent")} macros (MRM) will continue to be supported.
    • They are the equivalent to {GDPR} and {GDPR_CONSENT_285} macros


DSP OpenRTB integration

FreeWheel will continue to support the IAB OpenRTB Advisory to pass the TC string:

    • Regs.ext.gdpr
    • User.ext.consnet




Impact on MRM and SFX Functionalities

As a data processor, FreeWheel will access user consent/confirmation of legitimate interest in relation to clients' legal basis for corresponding data processing, in the PublisherTC section of the TC string. FreeWheel will process the data for each purpose if either:

  1. The purpose relies on user consent as a legal basis and such user consent has been obtained, as indicated by PublisherTC
  2. The purpose relies on legitimate interest as a legal basis and no user objection has been obtained, as indicated by PublisherTC

Impacted MRM Functionalities


AreaCorresponding PurposeDetails
FreeWheel Cookies

1

Store and/or access information on a device

If the user's choice for the publisher's Purpose 1 indicates no consent:

  • FreeWheel will not drop cookies on the user's device, starting on March 17, 2020
Analytics and Reporting

7

Measure ad performance

If the user's choice for the publisher's Purpose 7 indicates no consent and legitimate interest is not relied upon:

  • The following data elements will be removed from FreeWheel's V4 transactional logs: IP address, device IDs and user IDs. More information on V4 log files can be found here. In addition, the unique user count in FreeWheel's Analytics will be affected as the opted-out users are removed from calculation.
Audience Targeting

2, 4

Select basic ads

Select personalized ads

If the user's choice for the publisher's Purpose 2 or Purpose 4 indicates no consent and legitimate interest is not relied upon:

  • Audience targeting based on server-side segment lookup for all direct and programmatic placements in MRM will be suppressed. 
  • Audience targeting based on custom key-values in requests will continue to function. It is the responsibility of individual publishers to avoid sending personal data, including special categories of personal data as custom key-values.
Frequency Caps

2

Select basic ads


If the user's choice for the publisher's Purpose 2 indicates no consent and legitimate interest is not relied upon:

  • Frequency caps for all direct and programmatic placements will be suppressed.
Geo-Targeting

2


Select basic ads


If the user's choice for the publisher's Purpose 2 indicates no consent and legitimate interest is not relied upon:

  • Regional geo targeting for all direct and programmatic placements will be suppressed. Country level targeting will be retained. 
Forecasting

7

Measure ad performance

Both portfolio and transactional forecasting results will be affected by a user's choices for Purpose 7 due to its reliance on historical and individual-level traffic. 

 

Impacted SFX Functionalities


AreaCorresponding PurposeDetails
FreeWheel Cookies

1

Store and/or access information on a device

If the user's choice for the publisher's Purpose 1 indicates no consent:

  • FreeWheel will not drop cookies on the user's device
Reporting

7

Measure ad performance

If the user's choice for the publisher's Purpose 7 indicates no consent and legitimate interest is not relied upon:

  • The unique user count in FreeWheel SFX reporting will be affected as the opted-out users are removed from calculation.
Audience Targeting

2, 4

Select basic ads

Select personalized ads

If the user's choice for the publisher's Purpose 2, or Purpose 4 indicates no consent and legitimate interest is not relied upon:

  • Audience targeting in SFX will be suppressed.
  • Note: targeting based on audience information declared at the site level will continue to function.
Frequency Caps

2

Select basic ads

If the user's choice for the publisher's Purpose 2 indicates no consent and legitimate interest is not relied upon:

  • Frequency caps in SFX would be suppressed.
Geo-Targeting

2

Select basic ads

If the user's choice for the publisher's Purpose 2 indicates no consent and legitimate interest is not relied upon:

  • Regional geo targeting in SFX will be suppressed. Country level targeting will be retained. 


Additional Resources

FreeWheel announced our support of GDPR - TCF v2.0 with the 6.34 Release. A list articles on FreeWheel's support of TCF 2.0 can be found below:


Contact Us

For all GDPR related questions, please contact:

All requests for assistance in complying with data subject rights for personal data access or deletion should be made through legalnotices@freewheel.com.


  • No labels
Provide feedback on this article