Vendors relying on LI for purpose 7 are blocked by tcfcontrol

[bjorn-lw]

If no consent is given for purpose 7 but LI are given for purpose 7, vendors that rely on legitimate interest for the purpose are still blocked. The below TCF string should allow for instance the Livewrapped and Magnite Analytics through, but doesn't:

https://iabgpp.com/#CQhQy4AQhQy4AAGABCENCWFgALAAAELAACQgLXQGoAFAAWABUADwAIAAZAA0ACYAE4AQgA0QB-gERAImASIApIBpgFJgLhAXmAxkBlgDVwHLgRmAmkBa4EZoDkACgALAAqAB4AEAAMgAaAA_ACYAE4APwAhABogD9AIiARMAiwBIgDzQJkAmUBSYC2QF5gMZAZYA1cBy4D-wIzAFBgCAACwAKgAeABBADIANAAmABOAEIANEAfoBEwCRAMZAauBGYC1wgAEAAoBcIUAKAAoAaIBEwGMgRmCABAAFgBOAXCBa4eAIAAUAB4AH4ATgCIgETAYyBGYcAGAEIAUkA0wC4QJpAWuJgAQGMkgAoAhAB-gETAjMBa4qAEAAUARMBjIEZigAMAQgDlwLXAAA.ILXQI4AFAAWABUADwAIAAZAA0AB-AEwAJwAfgBCADRAH6AREAiYBFgCRAFJAM-AaYA80CZAJlAUmAtkBbwC4QF5gMZAZYA1cBy4D-wIzATSAtcAA.dgAACEAAAAAA

[patmmccann]

It seems we don't reference the gvl but assume everyone declared LI on p2 but not p7

We could:
-Document this and tell people to roll their own AC if they don't like it
-Assume everyone declared on p7
-lookup p2 and p7 declaration in build
-allow module p7 declaration in the spec
Something else?

Since we're accessing gvl in build now, option 3 seems best to me

[dgirardi]

https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20-%20Consent%20string%20and%20vendor%20list%20formats%20v2.md#example-global-vendor-list-json-object:

"purposes": conditionally OPTIONAL (see "Constraints") array of positive
integers. List of Purpose ids declared as performed on the legal basis of
consent

"legIntPurposes" conditionally OPTIONAL (see "Constraints") array of
positive integers. List of Purpose ids declared as performed on the legal
basis of legitimate interest

"flexiblePurposes": OPTIONAL array of positive integers. Array may be
empty. List of purpose ids where the vendor is flexible regarding the
legal basis; they will perform the processing based on consent or a
legitimate interest. The 'default' is determined by which of the other two
mutually-exclusive purpose fields is used to declare the purpose for the
vendor