Combined U.S. Privacy - CCPA and GDPR TCF setup and configuration (Legacy)

Overview

Setting up Sourcepoint’s combined U.S. Privacy - CCPA and GDPR TCF solution is a simple process that publisher teams can follow to get up and running quickly. This document is a quick start guide on how to implement a Do Not Sell (my data) experience on your website using Sourcepoint’s JavasScript code-snippet along with Sourcepoint's GDPR TCF solution. The JavaScript code snippet needs to be placed on your site, preferably in the head tag before any advertising technology scripts implemented on your site. The goal of the implementation is to render a Do Not Sell (my data) notification required under U.S. Privacy - CCPA and syndicate the user's privacy settings to any relevant third party technology running on your site along with a GDPR TCF message when appropriate. The Sourcepoint script implementation has been optimized for high performance and fast delivery.

Below are the tags and libraries necessary to serve a U.S. Privacy - CCPA "Do Not Sell" message and a GDPR TCF message:

//Example only. Please use stub file generated in Sourcepoint portal as it may have changed.
<script type="text/javascript">
function _typeof(t){return(_typeof="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t})(t)}!function(){for(var t,e,o=[],n=window,r=n;r;){try{if(r.frames.__tcfapiLocator){t=r;break}}catch(t){}if(r===n.top)break;r=n.parent}t||(function t(){var e=n.document,o=!!n.frames.__tcfapiLocator;if(!o)if(e.body){var r=e.createElement("iframe");r.style.cssText="display:none",r.name="__tcfapiLocator",e.body.appendChild(r)}else setTimeout(t,5);return!o}(),n.__tcfapi=function(){for(var t=arguments.length,n=new Array(t),r=0;r<t;r++)n[r]=arguments[r];if(!n.length)return o;"setGdprApplies"===n[0]?n.length>3&&2===parseInt(n[1],10)&&"boolean"==typeof n[3]&&(e=n[3],"function"==typeof n[2]&&n[2]("set",!0)):"ping"===n[0]?"function"==typeof n[2]&&n[2]({gdprApplies:e,cmpLoaded:!1,cmpStatus:"stub"}):o.push(n)},n.addEventListener("message",(function(t){var e="string"==typeof t.data,o={};if(e)try{o=JSON.parse(t.data)}catch(t){}else o=t.data;var n="object"===_typeof(o)?o.__tcfapiCall:null;n&&window.__tcfapi(n.command,n.version,(function(o,r){var a={__tcfapiReturn:{returnValue:o,success:r,callId:n.callId}};t&&t.source&&t.source.postMessage&&t.source.postMessage(e?JSON.stringify(a):a,"*")}),n.parameter)}),!1))}();
</script>

<script type="text/javascript">
      (function () { var e = false; var c = window; var t = document; function r() { if (!c.frames["__uspapiLocator"]) { if (t.body) { var a = t.body; var e = t.createElement("iframe"); e.style.cssText = "display:none"; e.name = "__uspapiLocator"; a.appendChild(e) } else { setTimeout(r, 5) } } } r(); function p() { var a = arguments; __uspapi.a = __uspapi.a || []; if (!a.length) { return __uspapi.a } else if (a[0] === "ping") { a[2]({ gdprAppliesGlobally: e, cmpLoaded: false }, true) } else { __uspapi.a.push([].slice.apply(a)) } } function l(t) { var r = typeof t.data === "string"; try { var a = r ? JSON.parse(t.data) : t.data; if (a.__cmpCall) { var n = a.__cmpCall; c.__uspapi(n.command, n.parameter, function (a, e) { var c = { __cmpReturn: { returnValue: a, success: e, callId: n.callId } }; t.source.postMessage(r ? JSON.stringify(c) : c, "*") }) } } catch (a) { } } if (typeof __uspapi !== "function") { c.__uspapi = p; __uspapi.msgHandler = l; c.addEventListener("message", l, false) } })();
</script>

<script  type="text/javascript">
window._sp_ = {
      config: {
          accountId: ACCOUNT_ID_HERE,
          baseEndpoint: 'https://cdn.privacy-mgmt.com',
          targetingParams: {
            type: "GDPR"
         }
      }
}
window._sp_ccpa = {
   config: {
         baseEndpoint: "https://cdn.privacy-mgmt.com",
         accountId: ACCOUNT_ID_HERE,
         getDnsMsgMms: true,
         alwaysDisplayDns: false,
         targetingParams: {
         type: "CCPA"
         }
   }
}
</script>
<script src="https://cdn.privacy-mgmt.com/wrapperMessagingWithoutDetection.js"></script>
<script src="https://cdn.privacy-mgmt.com/ccpa.js"></script>

TCF configuration details

The first section of the snippet contains the IAB stub file. The stub file is defining the __tcfapi function to queue all calls into the CMP's onsite API to be released as soon as the consent information is available. It is important to have this script tag always at the top of the HTML document in the first position to avoid errors and failure of the service. To learn more about the IAB stub file please refer to the IAB's TCF Technical Specifications.

The second section of the snippet contains your account specific configuration parameters. This section sets up the parameters necessary for your website to communicate with the Sourcepoint messaging platform and establishes a communication channel with the Sourcepoint messaging and consent service libraries. In addition to the standard parameters in the example above, there are additional parameters that allow for JavaScript callbacks to be triggered for different customization purposes. For GDPR TCF implementations there are currently two required parameters to deliver a user notification successfully:

In addition to the required parameters you can use following optional configuration parameters to tailor the implementation to your use case:

window._sp_ = {
         config: {
             accountId: 1234,
             baseEndpoint: "https://cmp.clienturl.com",
             propertyHref: "https://uat.tomnews.com",
             authId: 123456
         }
     }

window._sp_ = {
         config: {
             accountId: 1234,
             baseEndpoint: "https://cmp.clienturl.com",
             propertyHref: "https://uat.tomnews.com",
             authCookie: "test_uuid"
         }
     }

window._sp_ = {
         config: {
             accountId: 1234,
             baseEndpoint: "https://cmp.clienturl.com",
             propertyHref: "https://uat.tomnews.com",
             joinHref  : true
         }
     }

window._sp_ = {
         config: {
             accountId: 1234,
             baseEndpoint: "https://cmp.clienturl.com",
             isSPA  : true
         }
     }
      

propertyHref: "https://tom.sourcepoint.com",

targetingParams: {
                    key1: valueA,
                    key2: valueB
                }

consentLanguage: "nl"
      

U.S. Privacy - CCPA configuration details

The first section of the U.S. Privacy - CCPA snippet contains the IAB Stub function. The Stub function sets up the IAB US Privacy String object __uspapi and makes it available on queue to be called and released when needed. It is important to have this script tag always at the top in the first position to avoid errors and failure of the service.

The second section of the snippet contains your account specific configuration parameters. This section sets up the parameters necessary for your website to communicate with the Sourcepoint messaging platform and establishes a communication channel with the Sourcepoint messaging service library. In addition to the standard parameters in the example above, there are additional parameters that allow for JavaScript callbacks to be triggered for different customization purposes. For U.S. Privacy - CCPA implementations, there are currently four required parameters to deliver a message successfully:

In addition to the required parameters you can use following optional configuration parameters to tailor the implementation to your use case:

targetingParams: {
                    key1: valueA,
                    key2: valueB
                }

Setting up The Messaging Domain

Setting up a first-party subdomain with a CNAME record for the baseEndpoint is optional. The goal of creating a first-party subdomain is for the U.S. Privacy - CCPA and GDPR TCF JavaScript libraries to communicate with the Sourcepoint messaging server in a first-party capacity. The benefit of this approach is to allow Sourcepoint cookies to be the first party and thus, circumventing Safari’s Intelligent Tracking Prevention (ITP). This creates a discrete messaging channel between the publisher’s messaging subdomain and the Sourcepoint messaging server.