Permission: Vendor List - U.S. Multi-State
U.S. Multi-State Privacy (GPP) vendor lists are configurable registries of opt-in and opt-out privacy choices and authorized third-party vendors that leverage either the national section or state-specific privacy strings as defined in the IAB Multi-State Privacy Agreement (MSPA). That is, Sourcepoint will utilize either the national section or state-specific section (if available) when encoding the gppString
to communicate consent choices regarding data processing activities for end-users located in your designated states/regions.
In order to guide your organization through the configuration process, we will walk you through the various pages of the U.S. Multi-State Privacy (GPP) vendor list wizard.
- Name & Properties
- Framework Territories
- Choices Selection
- Language & Translations
- Region Mapping
- Vendor Management
- Opt In/Opt Out Hooks
- Advanced Settings
To start, click Vendor Management on the left-hand panel and click U.S. Multi-State Privacy from the subsequent menu.
Click + New Regulation.
Select the Global Privacy Protocol option in the next modal and click Start regulation setup to begin your configuration.
Name & Properties
From the Name & Properties page of the wizard, your organization will give your U.S. Multi-State Privacy (GPP) vendor list a name, define the the properties and/or property groups that should be associated with the vendor list, and how consent can be shared across properties.
Field | Description |
Regulation Name | The internal name of your vendor list. |
Property Selection |
Properties associated with a vendor list will inherit the vendors, privacy choices, etc... configured for the vendor list. This information will be surfaced in privacy managers, OTT messages, and/or first layer messages configured for the property. Click here for more information. Note: While properties can be added to multiple inactive vendor lists, a property can only be associated with a single active vendor list. Click here to learn more about active statuses for vendor lists. |
Consent Scope |
|
Framework Territories
From the Framework Territories page, your organization will set your MSPA ID (if your organization is a signatory) and define the regions where you want Sourcepoint to set the relevant sections in the _gpp
string.
Note: Which section (whether national or state-specific) is actually set for your framework territories is performed on the Region Mapping page of the wizard.
Industry Framework Signals
If your organization is a signatory of the MSPA, click + Add to add your organization's MSPA Signatory ID.
In the subsequent modal, input your Signatory ID in the provided field and click Add +.
Click Save.
When finished, click Save in the vendor list builder to confirm the addition.
By adding your MSPA Signatory ID, the MspaCoveredTransactions
field in the relevant section (either national or state-specific) of the gppString
will be set to 1
(i.e. Yes).
{
"Gpc": false,
"GpcSegmentType": 1,
"KnownChildSensitiveDataConsents": [
0,
0
],
"MspaCoveredTransactions": 1, //MSPA Signatory ID added
"MspaOptOutOptionMode": 0,
"MspaServiceProviderMode": 0,
...
}
Framework Territories
Framework territories are the states/regions where Sourcepoint will set a gppString
with its relevant sections for end-users who visit a property associated with the vendor list. The gppString
can be comprised of different sections and each section represents a unique privacy signal. Click here to view our API documentation and learn more about these sections.
Add states/regions to your vendor list by clicking the checkbox to the right of a state's or region's name. Selected states/regions will appear in the Selected pane.
Sourcepoint will provide additional signs to indicate whether the added framework territory has an active state law and/or whether Sourcepoint supports the setting of state-specific string/section in the gppString
.
Choices Selection
The privacy choices added to your U.S. Multi-State Privacy (Standard) vendor list reflect the data processing activities that your company engages in and, for which, you are requesting an opt-in or opt-out decision by your end-users. These privacy choices are divided into two categories:
- IAB
- Custom
Click Add Choice and select either IAB or Custom from the dropdown menu.
IAB privacy choices
IAB privacy choices are defined by the IAB and are included in at least one of the privacy sections included in the gppString
. For your convenience, Sourcepoint will list the privacy sections (i.e. national section and/or any state-specific sections) that include the IAB privacy choice.
Add an IAB privacy choice to your vendor list by selecting the checkbox to the left of the privacy choice name and clicking Add selected choices.
Custom privacy choices
Custom privacy choices allows your organization to name privacy choices as you wish. Add a custom privacy choice by typing a name in the provided field and clicking Add.
Note: In the custom privacy choice modal, Sourcepoint has also included some common custom privacy choices that you can select to auto-populate the name. These choices are: Strictly Necessary, Performance or analytics, Functionality or personalization, and Targeted Advertising.
Language & Translations
Vendor list information is surfaced to your end-user via a first layer message and/or privacy manager. From the Language & Translations page, your organization can add translations (including the default language) to your vendor list so that it is translated in first layer messages and privacy managers according to an end-user's browser language preference.
Supported Language(s)
Use the Supported Language(s) dropdown menu to select all languages your organization plans to support. English will always be selected and act as the default language.
Once your supported languages are selected, translations for these supported languages will appear for the various text fields associated with privacy choices. These translations are supplied by Sourcepoint.
Edit Privacy Choice Translations
Currently, your organization is able to edit translations for a privacy choice's Description or Choice Text.
Field | Description |
Description | The description of a privacy choice is presented to end-users in the message ahead of the opt in or out toggle of the data processing activities listed. It should give users transparency and clarity into how your business is using the data you collect and give them information on how to exercise their choices. |
Choice Text | The choice text of a privacy choice is the text that directs the user to make a choice for a specific data processing activity. For the Processing of Sensitive Personal Information privacy choice, this includes the individual categories of sensitive personal information that are included in the privacy choice. |
Edit a translation by selecting a privacy choice from the left-hand side of the panel.
Once a privacy choice is selected, the translations for each supported language (including the default language) will populate in the right-hand side of the panel. Sourcepoint provides initial translations for your supported translations.
Click the Edit icon inline with the provided translations.
Input your translation and click the checkbox to confirm the edit. Repeat as necessary for each supported language.
Note: Click here if interested in providing translations via csv upload.
Region Mapping
The region mapping page provides a matrix of the framework territories, privacy string that will be set, and privacy choices you have added to your U.S. Multi-State Privacy (GPP) vendor list. Using the provided table your organization can set on a per-state basis which privacy string to use and whether a privacy choice should be an opt-in, opt-out, or not applicable choice.
Consent Option | Description |
Opt-In | The privacy choice will be presented as an opt-in choice for end-users in the U.S. State (i.e. end-users will need to opt into the data processing/terms of the privacy choice) |
Opt-Out | The privacy choice will be presented as an opt-out choice for end-users in the U.S. State (i.e. end-users will need to opt out of the data processing/terms of the privacy choice) |
Disclosure Only | The privacy choice will be presented to the end-user for informational purposes and will not have any toggles that enable the end-user to opt in or opt out. |
Not Applicable | The privacy choice will not be presented for end-users in the U.S. State. |
For your convenience, Sourcepoint has configured the default consent choice for any IAB privacy choice added to your vendor list for each state based on the latest legislation. Additionally, if a state has a state-specific string that Sourcepoint supports then we will set the default privacy string as State.
Note: All Custom privacy choices added to a vendor list will default to Not Applicable for all states unless otherwise edited.
Edit the privacy string used a given state by navigating to the Privacy String field inline with the state/region and selecting an option from the dropdown menu.
Edit the consent option for a privacy choice by navigating to that privacy choice's column and selecting the field inline with one of the states/regions. Repeat as necessary.
Global Privacy Control
Global Privacy Control (GPC) is a technical specification for transmitting universal opt-out signals.
If the IAB privacy choice Sale or Share of Personal Information / Targeted Advertising is added to your list of privacy choices for the vendor list then you will have the option to support the Global Privacy Control (GPC) signal.
From the Region Mapping page, click GPC in the upper-right hand corner.
Enable the Respect Global Privacy Control toggle and select the regions where the signal should apply in the provided field.
Click Save when finished.
Vendor Management
Add new vendors to your U.S. Multi-State Privacy (GPP) vendor list by clicking + Add Vendors in the upper right-hand corner.
In the subsequent modal, select the System Vendors tab and navigate to your desired vendor.
Click the checkbox to the left of the vendor name and use the provided Privacy Choice field to map the vendor to your configured privacy choices.
Note: By default, added vendors will be mapped to all configured privacy choices unless otherwise edited.
Click Add Selected Vendors when finished.
Note: Click here for more information on how to import vendors from a different vendor list into your Multi-State Privacy vendor list.
Opt In/Opt Out Hooks
Opt in/Opt out hooks allow you to set up custom actions for a vendor or privacy choice within a vendor list.
- An opt in hook is eligible to be fired if the vendor or privacy choice has been opted into by the end-user.
- An opt out hook is eligible to be fired if the vendor or privacy choice has been opted out of by the end-user.
Select whether to configure a hook for a Vendor or a Privacy Choice from the page.
Click + Add Hook.
Select a vendor or privacy choice from the provided dropdown menu in the subsequent modal.
Select either Opt In Hooks or Opt Out Hooks tab and configure the hook.
Click Apply changes when finished. Click here to learn more about each aspect of the configuration modal.
The hook will be added to your vendor list and added to the table on the Vendor or Privacy Choice tab.
Advanced Settings
From the Advanced Settings page, your organization can configure how the signal is set and shared across your subdomains.
Advanced Setting | Description |
Write 1st party cookies to root domain |
Toggling this setting ensures that the signal will be stored/persist across both the property's root domain (e.g. test.com) and subdomains (e.g. finance.test.com). In practice, this will ensure that users won't see the same message when moving from root to subdomain or vice versa. |
Write 1st party cookies from the server to the property |
When enabled, the 1st-party cookie will be set by the server by passing a cookie from the server back to your site instead of using the on-site code to set the cookie. This setting should be enabled if your organization has set up a CNAME subdomain. |
Privacy Choice Expiration |
When a user visits one of your properties the state of their privacy choices (e.g. opted in, opted out) is stored within a cookie for reference on future visits. Your organization can set the expiration of this cookie via the Privacy Choice Expiration. Input the expiration date for the privacy choice cookie (up to 36135 days/ 99 years). |
Comments
0 comments