Bug: IDFA is not populated for US traffic when CMP returns an all-zero TCF string

[OlenaPostindustria]

Description

Currently, the SDK gates access to device.ifa based on TCF Purpose 1 consent when gdprApplies is set to false. Specifically, UserConsentManager.canAccessDeviceData() denies access to device data when IABTCF_PurposeConsents indicates 0 for Purpose 1, without first verifying whether GDPR applies. The check ultimately falls through to checkDeviceDataAccess(), which returns Boolean.TRUE.equals(deviceAccessConsent) regardless of the gdprApplies value.

Some CMPs provide a default all-zero TCF string even when gdprApplies = false. As a result, the SDK interprets Purpose 1 = 0 as an explicit user refusal, even though the TCF consent framework should not be used to determine device data access in this case. AdvertisingIdManager.getAdvertisingId() then returns null, so DeviceInfoParameterBuilder omits device.ifa from the bid request.

For US regions, access to device data should instead be determined based on applicable US Privacy/GPP signals and the device's limit ad tracking status, rather than TCF Purpose 1 consent.

Steps to reproduce

1. Integrate a CMP that writes TCF keys regardless of region.
2. Serve US traffic, where the CMP sets IABTCF_gdprApplies = 0 and IABTCF_PurposeConsents = "00000000000…", with US privacy/GPP signals permitting targeted advertising.
3. Trigger a bid request and inspect the payload.
4. Observe device.ifa is absent.