Prebid Quebec Privacy Support

Overview

Starting September 2023, new privacy regulations came into effect in Quebec, a province of Canada, governing about a quarter of Canada’s population.

IAB Canada has offered a modified version of the Transparency and Consent Framework (TCF) as a solution to cover user consent preferences in Quebec. However, at the time of this writing (Jan 2024), guidance from regulators, TCF Canada, and major advertising entities in Canada is in flux. The Canadian vendor list does not have enough vendors for meaningful adoption of the framework by any publisher, as it does not include the primary publisher ad server nor many large DSPs, nor many of the top five CMPs registered as CMPs with TCF Canada.

Given this context, Prebid has identified publisher concern that many will not be able to transact programmatically in Quebec until broader adoption of the IAB TCF-Canada spec is achieved. This document is intended to provide guidance on conveying user notification and consent signals as gathered by the publisher to Prebid software independent of the GPP signals in Section 5 and the lack of a working consent string framework from IAB Canada.

References:

TCF Canada and GPP Support in Prebid.js

Prebid.js supports a GPP module, but it does not interpret the strings in Section 5 (Canada). It simply takes the GPP signal from the CMP and includes it in outgoing network requests if those vendors initiating network requests have added support for GPP in their modules. It isn’t clear if TCF Purpose 2 (consent to ‘basic ad serving’) or a vendor list will be critical parts of a Quebec consent framework. Also, it isn’t clear if publishers will be required to seek vendor-level consent as for TCF-EU.

Prebid.js is planning a TCF Canada module to react to the contents of the string, but it is not yet available, and may not be available on the date the law comes into effect. Instead, publishers may access their CMP or the consent preferences that their website visitors have expressed to them directly, and control Prebid.js activity. Below is an example of how the Prebid.js Activity Control system could be used to implement an interim solution for ad serving in Quebec:

function isQuebecPersonConsentDenied() {
### a __gpp getSection command might be useful here, but generally, the publisher can implement this however they choose
   if(someCondition) { return true } else { return false }});
}

pbjs.setConfig({
    allowActivities: {
          enrichUfpd: {
                 rules: [{
                       condition: isQuebecPersonConsentDenied,
                       allow: false
                 }]
          },
          enrichEids: {
                rules: [{
                       condition: isQuebecPersonConsentDenied,
                       allow: false
                }]
          },
          syncUser: {
                rules: [{
                       condition: isQuebecPersonConsentDenied,
                       allow: false
                }]
          },
          transmitEids: {
                rules: [{
                       condition: isQuebecPersonConsentDenied,
                       allow: false
                }]
          },
          transmitPreciseGeo: {
                rules: [{
                       condition: isQuebecPersonConsentDenied,
                       allow: false
                }]
          },
          transmitUfpd: {
                rules: [{
                       condition: isQuebecPersonConsentDenied,
                       allow: false
                }]
          }
          
    }
})

In addition, according to Google Ad Manager documentation a publisher should call googletag.pubads().setPrivacySettings({nonPersonalizedAds: true}) when consent for personalized advertising is not available.

Quebec and Prebid Server

Like Prebid.js, there is a TCF Canada module planned for Prebid Server, but given the uncertainties in implmentation, it may not be complete by the end of September.

One option for supporting Quebec in Prebid Server (including mobile apps and AMP pages) would be to simply let if pass GPP strings containing Section 5 through to bidders, trusting that they will interpret the string in alignment with Quebec law. Prebid cannot provide guidance on which bidders are in such alignment.

An alternate solution would utilize the Prebid Server version of the Activity Control system.

Only the Java version of Prebid Server currently supports targeting Activity Controls to geographic regions.

Here’s an example account configuration that utilizes the user’s geographic region to determine whether to allow or deny the named activities. Publishers will need to confirm the details with their Prebid Server host company.

{
  privacy: {
    allowactivities: {
      syncUser: {
        rules: [{
          geo: ["CAN.QC"]
        }],
        allow: false
      },
      transmitUfpd: {
        rules: [{
          geo: ["CAN.QC"]
        }],
        allow: false
      },
      transmitPreciseGeo: {
        rules: [{
          geo: ["CAN.QC"]
        }],
        allow: false
      }
    }
  }
}