storageControl: how to add device disclosure url

[jdelhommeau]

Hi prebid community,

I work as Utiq, who provides two userId modules (UtiqIdSystem and UtiqMtpIdSystem).

We have a question regarding the new storageControl module that was added as part of prebid 10 I believe.
Some clients have been raising concerns regarding a new warning they gets when trying to use our ID modules :

Reading through the doc, I understand that TCF vendor deviceStorageDisclosure file is used to determined which keys are disclosed for localStorage access. However, Utiq not being a TCF member yet, we don't have such file.

I saw that bidders can also disclose a custom url in such case, using the below code:

registerBidder({ code: 'exampleBidder', disclosureURL: 'https://exampleBidder.com/disclosures.json' })

However, not sure how a user ID module should be disclosing its own custom disclosureURL. Could you help us understand how we, as Utiq user ID module, should provide prebid with device Storage disclosure url containing our utiqPass localStorage key, so the warning is no longer raised and possibly our module block in case of strict enforcement?

Thank you for your help!

cc @patmmccann as I saw you leading the initiative on storageControl module

[patmmccann]

However, not sure how a user ID module should be disclosing its own custom disclosureURL. Could you help us understand how we, as Utiq user ID module, should provide prebid with device Storage disclosure url containing our utiqPass localStorage key, so the warning is no longer raised and possibly our module block in case of strict enforcement?

Do you already host a device disclosure url in tcf format?

[dgirardi]

Could you help us understand how we, as Utiq user ID module, should provide prebid with device Storage disclosure url

You need a disclosure file in TCF format that declares your keys for the * (first party) domain; you can host it yourself, or include it in metadata/disclosures/modules; then provide disclosureURL from your ID provider, for example:

Prebid.js/modules/sharedIdSystem.ts

Line 121 in 0e17566

disclosureURL: 'local://prebid/sharedId-optout.json',

(local:// is to be used only if you decide to include it in this repo, if you have a "real" url you can use that).

[jdelhommeau]

Thank you both!
No we don't yet have a deviceStorageDisclosure url. We are working with IAB Europe to eventually join TCF, at which point we will be able to rely on the default TCF mecanism, but in the meantime, we will create a new file and host it under metadata/disclosures/modules/utiqDeviceStorageDisclosure.json (let me know if there is some naming convention to follow here) and add it under our UtiqIdSystem and UtiqMtpIdSystem as per sharedIdSytem model:

`export const utiqIdSubmodule = {
/**

• Used to link submodule with config
• @type {string}
  */
  name: MODULE_NAME,
  disclosureURL: 'local://modules/utiqDeviceStorageDisclosure.json',`

Thank you very much!

[jdelhommeau]

Just one additional question. As we are not a TCF member, what purposes should we list in our deviceStorageDisclosure file? Is it ok for us to leave the array empty? looking at the example set by sharedId, I believe this is ok, but wanted to confirm.
For reference, I anticipate our fille to look like this:

{ "disclosures": [ { "identifier": "utiqPass", "type": "web", "domains": ["*"], "purposes": [] }, { "identifier": "netid_utiq_adtechpass", "type": "web", "domains": ["*"], "purposes": [] } ], "domains": [ { "domain": "*", "use": "Utiq looks for utiqPass in localStorage which is where ID values would be set if availables." } ] }

[dgirardi]

No naming convention yet, utiqDeviceStorageDisclosure is fine. If you want to test it you'll need to run gulp update-metadata for storageControl to pick up your changes.

what purposes should we list in our deviceStorageDisclosure file?

Prebid doesn't use the purpose list - an empty array would still get rid of the warning. However it's part of the disclosure summary that's made available to publishers, so it should still reflect how you use that storage key. SharedId's are just used to check for opt-out which we were advised maps to no purpose, but that's not true in general; unfortunately I can't offer any better advice than recommending legal counsel.

[patmmccann]

I would recommend 1,2,3,4,7,10

[jdelhommeau]

Thank you both. At the moment, we don't have any purpose matching to TCF, since we are not TCF member. For publishers to work with Utiq, they have to follow strict consent guidelines to disclose to users in their CMP who we are and what we do, so don't think trying to map to specific TCF purposes will bring any value here. For now we will leave empty, but as we work on joining TCF, we will update to reflect the adequate purposes IDs.
Thank you again!

[jdelhommeau]

As update to this thread, we have made the following pull request for the suggested changes: #13770
Once the pull request is approved and merged, I will close this ticket. Thank you again both for you help on solving the matter.