Overview

Increase brand loyalty by allowing users to control the data collected about them & establish trust through transparency.As a result of the increasing number of data breaches and the misuse of personal information, privacy management is a growing part of the modern marketing landscape.The General Data Protection Regulation (GDPR) has largely been perceived as a legal issue, due to the fines that can be imposed because of non-compliance, but it’s also created opportunities for brands to build greater trust with their users. In fact, according to research conducted by iProspect, 88% of global marketers say trust is a priority in 2019, and they are looking to build this trust through credibility, relevancy, and reliability.Fueled by consumer privacy laws like the GDPR, most marketers are turning to solutions like Commanders Act CMP that alert website and mobile app users of the personal data that’s being captured, stored, and shared with third parties.This documentation will provide you with an overview of Commanders Act CMP, setup guides per platform, user guides per feature and a knowledge base for frequently asked questions.ComponentsCommanders Act CMP consists of following components:

Frameworks

Commanders Act CMP supports following frameworks:

• IAB TCF 2.0 (v2.2 will be supported before September 30)

• Google ACM

Extensions

It is possible to extend Commanders Act CMP with following modules:

Cookie Scanner

TagFirewall

Tag Hierarchy

Setup

Please refer to the Setup Guides section for detailed installation instructions of Commanders Act CMP per platform. In case your platform is not listed you can reach out to a Commanders Act consultant for a custom implementation.

Setup Guides

The collection of personal information is regulated by law at European level with the GDPR.As a European player, Commanders Act fits into this framework and pays particular attention to the governance of its data.This page explains the positioning of Commanders Act and that of its customers within this regulatory framework.​

Commanders Act

Under RGPD rules, Commanders Act acts as a data processor. Therefore, Commanders Act is responsible for the following obligations:- maintain data security- continuously improve security processes- duty of cooperation, in particular in the event of control by the CNIL- appointment of a data protection officer- keep a processing register- notify any data breach to the data controller​

The customer

Customers of Commanders Act, users of the platform, are considered data controllers. Therefore their obligations are:- decide on the purpose of the processing (reasons for the processing, categories of data)- decide on the means of processing (retention period, recipient, right of opposition, right of rectification)Commanders Act puts its technical expertise at the service of its customers in order to guarantee the protection of users' personal data.As your partner and processor, we are at your disposal for all questions on data protection subjects.

Consent Module and TMS Commanders Act are natively integrated with each other. This setup requires minimal technical knowledge and can be done entirely in the interface.

Setup

Following you will find the required steps to implement a standard Commanders Act Consent module setup.

1. Choose the default account configuration mode for your account (see Options).

2. Setup your Consent categories & vendors (see Manage Categories).

3. Assign your Consent categories & vendors to your Commanders Act Web Container tags (see Assign categories)

4. Create one or multiple Consent banner templates (see Manage Banner)

5. Deploy your Consent banner templates to the Commanders Act CDN or on premise target (see Deploy Banner).

6. Connect your privacy banner templates with Commanders Act Web Container and implement rules for which the banner should be played out (see below).

Install Consent banner with TMS Commanders Act

To deploy a Consent banner with the Commanders Act TMS it needs to be linked to a container. Commanders Act TMS can then be use to implement detailed rules for which a Consent banner is shown to visitors.

Implement rules to display Consent banners

Sources > Overview > Web Containers > tab RULES > Privacy Banners Constraints​

In Commanders Act TMS it is possible to provide exact conditions to decide when each of the linked privacy banners should be shown to visitors. Typical use cases consist of:

• Implement different banner for different languages or regions

• Avoid to deploy the banner on legal pages (privacy policy) so that users can read them before providing consent.

• Implement AB test for two banner designs.

You can create constrains under the PRIVACY BANNERS section to define under which conditions a privacy banner should be shown. Privacy banner constraint work the same way as tag constraints. Please reference constraints in the Web Container documentation for more information.

Link Consent banner with Commanders Act Web Container

Sources > Overview > Web Containers > tab GENERATE

Commanders Act TMS makes it easy to implement Consent banner on websites. To link a privacy banner with a Commanders Act TMS container it just has to be activated in the GENERATE tab with the ACTIVATION checkbox. This installs the selected privacy banner in the generated container version.

Go further with OnSite API

The OnSite API allows you to reload your container(s) on consent, manage behaviour or create custom variables/rules!

You can find the full list of commands in the dedicated section.

To reload your web container(s) on user consent, here's a sample code that you can use in the custom js block of your privacy banner, or directly in your web containers

/* Reload web containers on user interaction */

cact('consent.onUpdate', function (result) {      
        tC.script.add("https://cdn.tagcommander.com/xxxx/my_container_name.js");
});

/* Different approach for container reoad - based on work environment variable */

cact('consent.onUpdate', function (result) {      
    if (tc_vars.env_work === 'prod') {    
        tC.script.add("https://cdn.tagcommander.com/xxxx/my_container_name.js");
    } else {          
        tC.script.add("https://cdn.tagcommander.com/xxxx/uat/my_container_name.js"); 
    } 
});

Introduction

In this section, you will find a complete guide to integrate Commanders Act Consent banners in your Google Tag Manager

Enclosed you'll find two sample configuration files, a very simple setup that you'll need to reproduce you'll need to reproduce on your site. The first and most common configuration is the gtm_category_template.json, a category-based configuration (example with only 1 category). The other possibility is a vendor-based configuration, with only the Cact allows Statistical variable changing in gtm_partner_template..json.

Getting Started

1. In GTM, create a new account so as not to overwrite your current configuration.

2. In this new test account, go to Admin, then on the right side of the screen click on Import Container and select the file attachment gtm_category_template.json

1. Observe the configuration to constrain a simple Google Analytics page view tag

Added elements

Understand and personalize the json

Tags

1. "Google Analytics Page view" is only a basic tag example, "Cact consent given Statistical" trigger is applied on

2. "Consent Cact - Start" tag refers to the "Consent Banner - URL" variable, and is the tag that "activates" the privacy module* and is the only tag that will be triggered with a simple All pages trigger. All other tags must have a trigger that includes the user's consent. *if you need more information about setup of your Consent banner, you can read our Consent management starter kit documentation)

Trigger

"Cact consent given Statistical" which triggers the page view tag as soon as the user has given consent on a first visit. consent has been given by the user on a first visit. The page view hit from consent pushes a tcConsentChanged event in GTM's dataLayer for each interaction with the privacy module

Tips about trigger

"Cact consent given Statistical" is an arbitrary name, you can call it "Consent on page view for Analytics" or "Consent Analytics".

It is dedicated to a specific category, you will need to create "Cact on page view Advertising" and/or "Consent on page view Functional" for example, depending on your needs.

"Cact consent given Statistical" should also be reproduced and adapted for your other categories and coupled with custom triggers

Configuration example

The trigger should therefore refer to the variable for its category and trigger the associated tag if it returns "allowed"

Variables

1. "Cact - User consent": will return different values, depending of user consent choice (no_consent, optout, all_consent or the list of consent categories IDs accepted by the user)

2. "Cact allows Statistical": return "allowed" or "refused", depending of the choice of the user *Don't forget to personalize the ID with the value of your own setup on the Commanders Act Platform

1. "GA4 - ID": Change this value by your own GA4 - ID

1. "Browser language": will detect the browser language, do not modify this variable. It will be helpful if you have a multi-language website

2. "Consent banner - URL": to be personalized with the your Consent banners url. To obtain your privacy banner url, go on the page Sources > Privacy banners > Deploy You can also have a look on this page for more information

Commanders Act provides a tag template to manage the "Consent Mode" in Google Tag Manager. This seamless integration takes advantage of our Commanders Act OnSite API.

Setup

Summarizing all recommended steps:

1. Access GTM.

2. Select your "Web" type container.

3. Add our tag template from the "Community Template Gallery".

4. Configure the related tag and its trigger.

5. Configure your third-party vendor tags.

6. Test and deploy your container.

Configure the related tag and its trigger

Following the above steps, adding our template "Commanders Act CMP" from the Google "Community Template Gallery", you're presented with the following "Tag Configuration" which is the core area where you can manage your consent needs with GTM:

First, you need to input your consent category identifiers for the following 7 categories: Ad Storage, Analytics Storage, Functionality Storage, Personalization Storage, Security Storage, Ad User Data and Ad Personalization. You can define/find these identifiers by logging in to our platform and follow the section: (A)"Data Governance" → (1)"Consent Management" → (2)"Categories".

Your identifiers are shown between round parentheses (see highlighted in green below):

If your CMP loads asynchronously, it might not always run before your GTM container. That’s why you have the option to set a "Wait for update" value in milliseconds to control how long to wait before data is sent. This field is optional and its default value is 0. In case you need to set it, we recommend starting from the base value of 500 milliseconds.

You also need to set the default status, for each of the 7 categories, before users interact with your privacy banner and taking into account region-specific behavior. This is done by clicking the "Add Row" button and selecting either "Denied" or "Granted" to match with your input regions and/or sub-regions.

To make sure that the consent is correctly managed by GTM with third-party vendor tags, we strongly recommend to enable reactive events. Turn on the (3) "Advanced Features", (4) "Activate Reactive Events" and (5) "Activate [Storage-Name] Reactive Event" for each [Storage Name] you're using. Finally, enter their (6) "Event Name". These events will be used in the next section when configuring your third-party vendor tags.

You also have the option to directly inject your CMP script by turning on the (7) "Advanced Features", (8) "Inject CMP Script" and input your (9) "URL".

Disabling the default consent may come handy when you don't want to use the Consent Mode. This is done by turning on the (10) "Advanced Features" and (11) "Disable Default Consent".

As the last step, you need to select the "Consent Initialization - All Pages" trigger in the "Triggering" lower area:

Modify Permissions

If your banner is hosted on your servers (on premise) or if you use our CDN 1st party feature, then you need to update the Permissions of the template.

Simply add your host URL in the tab "Injects scripts" (see block "allowed patterns").

Configure your third-party vendor tags

While Google native product tags, such as "Google Analytics" or "Google Ads" ones, work out of the box, third-party vendor tags require additional settings to properly operate with the user consent. First, open your tag configuration and check under the (12) "Advanced Settings" and (13)"Consent Settings" if a consent type (E.g. "ad_storage") is already preconfigured, if not you need to add it by selecting the option (14) "Require additional consent for tag to fire" and (15) input the consent type(s) you want to include.

Then, you need to configure its triggers and this is where we're going to use our reactive events we prepared in the previous section. Locate the "Triggering" area in your tag configuration and add a "Trigger Group".

In the trigger group add (16) any preexisting triggers and (17)a trigger named as your configured reactive event.

The latter has to be configured as a (18)"Custom Event" with the same (19)"Event Name" you used in the previous section and it has to fire on (20)"All Custom Events".

This completes your configuration. You can now start the testing phase, leading to the final deployment in production. Learn more on how you can configure and run tests with your tags in GTM by checking the section "Consent configuration" in the "Help Center". You can also read the page Consent Mode setup provided by Google for Developers

Introduction

Google Consent Mode will evolve in March 2024!

As Google strongly recommends the use of Consent Mode on their tags, Commanders Act has developed a new built-in feature for clients who wish to implement it.

Just use our new native feature for a super smooth implementation! Please read the following documentation to learn more about this new feature, and how to use it. If you have already implemented Consent Mode v1 using our tag template and would like to keep it, you can update it on v2. Please see the following section for instructions: Migration Guide Consent Mode v1 tag template to v2

Difference between Basic & Advanced mode

Google Consent Mode provides 2 approaches: Basic & Advanced In both cases, you will have to activate the feature Google Consent Mode on your account. The only difference will be the following: Basic Mode: Google tags aren't triggered before consent & remains submitted to Commanders Act Consent Rules, there will be no tags firing in case of Optout Advanced Mode: Google tags are triggered before consent & the collected data will depend on the Consent Mode Signal. Tags remains fired even when user has Optout.

How to use the Google Consent Mode feature ?

Just follow these 6 steps:

1- Activate the feature on your workspace

Login on your workspace Go on page Data Governance > Consent Management > Settings Turn On the option Google Consent Mode. The sub-menu "Google Consent Mode settings" will appears

2-Configure your settings

Categories

Select your appropriate Privacy category from the drop-down list for each Google's category.

Default Status

The Default Status will determine the behaviour of your tags BEFORE consent. If set on "denied": Google will collect minimum information (as if the user has Optout) If set on "granted": Google will collect all information (as if the user has Optin) *You should ask to your DPO before to set a "granted" default status for any of theses categories

In all cases: once the user has given his consent (optin or optout), the default status will no longer apply. The user's choice will determine the status after consent.

Additional Settings

• enable_tcf_support If you use TCF 2.2 CMP template: TCData update (TCData.enableAdvertiserConsentMode) allows Google to infer ad_storage, ad_personalization, and ad_user_data settings from the TC string. This will incorporate consent mode v2 updates directly into the TC string. Enable the feature tcf_support to let your IAB TCF privacy banner manage the advertising categories. *Google recommends to activate this feature if your website use an IAB TCF banner template Don't forget to add your Google associated Vendors (see dedicated documentation for more details)

• wait_for_update Enabling this optional feature will send a signal to Google's tags to wait for an update. Enter a value in milliseconds to control the waiting time before the data is sent. This can be useful if you are experiencing timing issues. Otherwise, you can leave it blank!
• ads_data_redaction set ads_data_redaction to ON to further redact your advertising data when "ad_storage" is "denied"
• url_passthrough URL passthrough option can be used to send event and session-based analytics (including conversions) without cookies across pages.

3-Activate the feature on your privacy banner(s)

Sources > Privacy Banners > Select your banner(s) Go at the edition step of your privacy banner, open the settings menu to turn ON Google Consent Mode Signal

The privacy setup is done! You can now Generate and Deploy your Privacy Banner. *At this point, Consent Mode will not affect the behaviour of your tags. Please follow the next steps!

4- Advanced Mode: Remove your privacy constraints from Google tags

To setup the version "Advanced" of the Consent Mode, remove Commanders Act Privacy rules from all the Google tags, now it's managed by Google Consent Mode Data Governance > Consent Management > Categories see tab assign tags - Remove the privacy constraints from Google tags - Save

5-Generate your container(s)

Go on Sources > WebContainers > generation step For a single container setup, generate your container with privacy banner(s) included

For a multiple container setup, generate all your containers. The privacy banner(s) must be linked to the first loaded container to ensure that the Consent Mode signal is always sent correctly.

6-Tests & deployment

Deployment

We recommend to test you setup on a UAT environment if possible.

Test your configuration

There's 3 different ways to verify your Consent Mode setup:

Verify the Consent Mode sequencing with our tC. method

To help you ensure that the consent signal is sent before your Google tags, we offer a method to get logs in the browser console

tC.privacy.explainGCMSequencingValidation() If the Consent is set before any Google tags triggered, you will obtain the log 'valid sequencing' If Google tags are triggered before the Consent is set, then your implementation is incorrect. The log will returns the value 'Consent is set too late, Google tags are triggered before consent set. Please verify your Consent Mode sequencing'

Need a boolean value for specific use cases ? Use tC.privacy.validateGCMSequencing() Will simply return true if your sequencing is correct, otherwise the result will be false

FAQ

Modification/Update Configuration

In case of setup modification, such as activation/deactivation of a parameter, mapping changes on categories, etc.... Web Containers & Privacy banners must be regenerated & deployed.

Parameter "Region"

Google Consent Mode allows the consent management only for the declared Region(s) Our native feature does not include this parameter, for web performance reasons. If you need to use this parameter, we recommend using our TMS Tag template. Please refer to the next section of documentation for configuration details.

Support & assistance

Still facing trouble shooting on your implementation, and looking for help ? Contact our technical support team ! As a Google CMP partner with a Gold status, we provide a dedicated email support : cact_support_cmp_google@commandersact.com They will ever gave you a personalized reply to your questions!

Migration guide

For customers who has already implemented the Consent Mode v1: You can activate the built in feature as described above (don't forget to deactivate your actual consent mode tag) However, if you really want to keep your actual setup and simply update your tag, then you can refer to this documentation!

Summarizing all recommended steps:

1. Access your Commanders Act account.

2. Update your tag template.

3. Test and deploy your container(s).

Update your tag template

Go on page "Sources" > "Web containers" Select you "Google Consent Mode with Trust" tag.

Update the js code block of your tag with the following code, then save to obtain the new fields

<script language="javascript">
window.dataLayer = window.dataLayer || [];
var gtag = function (){
	dataLayer.push(arguments);
};
tC.internalvars.getRegion = function(a){
	a = a.toString().replace(/\s/g, '');
	a = a.split(",");
	return a;
};
tC.internalvars.setRegion = function(a) {
	tC.internalvars.regionArray = tC.internalvars.getRegion(a);
	if (((typeof tC.privacy.isEnable !== "undefined") && tC.privacy.isEnable()) && (tC.internalvars.regionArray.length > 0) && (tC.internalvars.regionArray[0] !== "") && (typeof tC.internalvars.consentSettings !== "undefined")) {
		tC.internalvars.consentSettings.region = tC.internalvars.regionArray;
		return true;
	} else return false;
};
tC.internalvars.setWait = function(a){
	if (((typeof tC.privacy.isEnable !== "undefined") && tC.privacy.isEnable()) && (isNaN(parseInt(a, 10)) === false) && (parseInt(a, 10) > 0) && (typeof tC.internalvars.consentSettings !== "undefined")) {
    	tC.internalvars.consentSettings.wait_for_update = parseInt(a, 10);
      	return true;
    } else return false;
};
tC.internalvars.setConsentCommand = function(a, b, c){
	tC.internalvars.isRegionSet = tC.internalvars.setRegion(b);
	tC.internalvars.isDelaySet = tC.internalvars.setWait(c);
  	if (((typeof tC.privacy.isEnable !== "undefined") && tC.privacy.isEnable()) && (tC.internalvars.isRegionSet || tC.internalvars.isDelaySet)){
    	return "default";
    }
  	if ((a.toString() === "default") || (a.toString() === "update")){
		return a;
	}
	if ((typeof tC.privacy.isEnable !== "undefined") && tC.privacy.isEnable()) return "default";
	else return "update";
	return "default";
};
gtag('set', 'developer_id.dOWVhY2', true);
tC.internalvars.consentSettings = {
	'ad_storage': (#DEFAULT_AD_CATEGORY# !== "")?#DEFAULT_AD_CATEGORY#:"denied",
	'analytics_storage': (#DEFAULT_ANALYTICS_CATEGORY# !== "")?#DEFAULT_ANALYTICS_CATEGORY#:"denied",
	'functionality_storage': (#DEFAULT_FUCTIONALITY_CATEGORY# !== "")?#DEFAULT_FUCTIONALITY_CATEGORY#:"denied",
	'personalization_storage': (#DEFAULT_PERSONALIZATION_CATEGORY# !== "")?#DEFAULT_PERSONALIZATION_CATEGORY#:"denied",
	'security_storage': (#DEFAULT_SECURITY_CATEGORY# !== "")?#DEFAULT_SECURITY_CATEGORY#:"denied",
  'ad_personalization':(#DEFAULT_AD_PERSONALIZATION_CATEGORY# !== "")?#DEFAULT_AD_PERSONALIZATION_CATEGORY#:"denied",
  'ad_user_data':(#DEFAULT_AD_USER_DATA_CATEGORY# !== "")?#DEFAULT_AD_USER_DATA_CATEGORY#:"denied" 
}
console.log(tC.internalvars.consentSettings);
console.log("REGION: " + #REGION#);
console.log("WAIT_FOR_UPDATE: " + #WAIT_FOR_UPDATE#);
// Default command on page load
console.log("INFO: default command");
gtag('consent', tC.internalvars.setConsentCommand("default", #REGION#, #WAIT_FOR_UPDATE#), tC.internalvars.consentSettings);
tC.internalvars.ga_url_passthrough = #URL_PASSTHROUGH#;
tC.internalvars.ga_ads_data_redaction = #ADS_DATA_REDACTION#;
if ((typeof tC.internalvars.consentSettings !== "undefined") && (tC.internalvars.consentSettings.ad_storage === "denied")) {
	if ((tC.internalvars.ga_url_passthrough !== "") && ((tC.internalvars.ga_url_passthrough.toLowerCase() === "true") || (tC.internalvars.ga_url_passthrough.toLowerCase() === "false"))) {
		gtag('set', 'url_passthrough', (tC.internalvars.ga_url_passthrough.toLowerCase() === "true"));
	}
	if ((tC.internalvars.ga_ads_data_redaction !== "") && ((tC.internalvars.ga_ads_data_redaction.toLowerCase() === "true") || (tC.internalvars.ga_ads_data_redaction.toLowerCase() === "false"))) {
		gtag('set', 'ads_data_redaction', (tC.internalvars.ga_ads_data_redaction.toLowerCase() === "true"));
	}
}
tC.internalvars.setConsentUpdateCommand = function(result){
	tC.internalvars.consentSettings = {
	    'ad_storage': (result.consent.categories[#TRUST_AD_CATEGORY_ID#].status === "on") ? "granted" : "denied",
	    'analytics_storage': (result.consent.categories[#TRUST_ANALYTICS_CATEGORY_ID#].status === "on") ? "granted" : "denied",
	    'functionality_storage': (result.consent.categories[#TRUST_FUNCTIONALITY_CATEGORY_ID#].status === "on") ? "granted" : "denied",
	    'personalization_storage': (result.consent.categories[#TRUST_PERSONALIZATION_CATEGORY_ID#].status === "on") ? "granted" : "denied",
	    'security_storage': (result.consent.categories[#TRUST_SECURITY_CATEGORY_ID#].status === "on") ? "granted" : "denied",
	  'ad_personalization':(result.consent.categories[#TRUST_AD_PERSONALIZATION_CATEGORY_ID#].status === "on") ? "granted" : "denied",
  'ad_user_data':(result.consent.categories[#TRUST_AD_USER_DATA_CATEGORY_ID#].status === "on") ? "granted" : "denied"
    }
	console.log(tC.internalvars.consentSettings);
	console.log("REGION: " + #REGION#);
	console.log("WAIT_FOR_UPDATE: " + #WAIT_FOR_UPDATE#);
	// Update command on page load
	console.log("INFO: update command");
	gtag('consent', tC.internalvars.setConsentCommand("update", #REGION#, #WAIT_FOR_UPDATE#), tC.internalvars.consentSettings);
};
cact('consent.get', function (result) {
	if (result.consent.status !== "unset") {
      tC.internalvars.setConsentUpdateCommand(result);
	}
});
// Triggered on consent changes
cact('consent.onUpdate', function (result) {
  	tC.internalvars.setConsentUpdateCommand(result);
});
</script>

You can do your mapping on the new fields & Save again your tag

Set the by default status of the *new categories (denied or granted)

Enter the ID of your privacy categories to link them with the Google's *new categories If needed, you can find your privacy ID on the page Data Governance > Consent Management > Categories

Don't forget to save your settings

Generate & Deploy your container

Update your Privacy Banner(s)

Go on page Source > Privacy Banners > edition step

You can now Generate & Deploy your privacy banner(s)

You are up to date, you can test your settings on your website. Don't hesitate to refer at the test step above to get tips & tricks.

Commanders Act provides a plug-in to integrate with Adobe Launch. The setup requires technical installation steps.

Setup

Following you will find the required steps to implement a standard Commanders Act Consent setup.

1. Choose the default account configuration mode for your account (see Settings).

2. Setup your Commanders Act Consent categories & vendors (see Manage Categories).

3. Create one or multiple banner templates (see Manage Banner).

4. Deploy your Consent banner templates to the Commanders Act CDN or on premise target (see Deploy Banner).

5. Implement Commanders Act Consent JavaScript tag (see below)

6. Manage Adobe Launch tags with Commanders Act Consent (see below).

Implement Commanders Act Consent JavaScript tag on website and inside Adobe Launch

1 - Website configuration

Delay your Adobe container. Commanders Act creates the consent variables when the privacy javascript file is loaded. You have to delay your Adobe container until Consent is ready otherwise the variables containing the consent status will be undefined.

To delay your container, update your <script> tags loading your Adobe container in order to execute it after Commanders Act Consent JavaScript tag is loaded.

<script type="text/javascript" src="/path/to/adobe_launch_script.js"></script>

is replaced by:

<script type="text/tc_privacy" src="/path/to/adobe_launch_script.js"></script>

The text/javascript script type has to be replaced by text/tc_privacy. In this way, Adobe is loaded only when Commanders Act Consent is ready.

Add the Consent javascript file (if possible, call it before Adobe container and after datalayer):

<script type="text/javascript">
var tCPrivacyTagManager = "adobe";
</script>
<script type="text/javascript" src="my-privacy.js"></script>

2 - Configure consent variables

When Commanders Act Consent is loaded and gets the consent, a variable tcCategoriesConsent is created by Commanders Act Consent in the Adobe datalayer:

window.digitalData.user.tcCategoriesConsent = tcCategoriesConsent;

This variable contains the ID of the categories accepted by the user and separated by a coma.

You have to declare this variable in Adobe Launch interface, in the Data Elements configuration. From a Property page, open the Data Elements tab, then click Add Data Element, and add "tcCategoriesConsent" variable.

Then, you have to create the rules that will fire your tags based on the categories ID accepted by the users. You have to create a separate rule for each category you want to use as a firing condition (ex: "Retargeting category accepted", "Analytics category accepted"...).

In the Adobe Launch interface, open the "Rules" tab and click Create New Rule.

Set a rule based on the previously created tcCategoriesConsent. Ex: if you want to trigger a tag based on the Retargeting category (ID 6), you will have to create a rule "if tcCategoriesConsent contains 6", then the Criteo tag has to be triggered.

Commanders Act Consent can be directly integrated with websites. The setup requires technical installation steps.

Setup

Following you will find the required steps to implement a standard Commanders Act Consent setup.

1. Choose the default account configuration mode for your account (see Settings).

2. Setup your Commanders Act Consent categories & vendors (see Manage Categories).

3. Create one or multiple banner templates (see Manage Banner)

4. Deploy your Commanders Act Consent banner templates to the Commanders Act CDN or on premise target (see Deploy Banner).

5. Install Commanders Act Consent JavaScript tag (see below)

6. Manage onsite tags with Commanders Act Consent (see below).

Install Commanders Act Consent script

To hard code Commanders act Consent on websites you need to add following JavaScript code to your website. This snippet should be added to the <head> of your website.

<script type="text/javascript" src="{{ privacy_tag_url }}"></script>

{{ privacy_tag_url }} has to be replaced with your privacy JavaScript tag URL. This URL can be found in the GENERATE & DEPLOY tab of each privacy banner.

Manage onsite tags with Commanders Act Consent

Add tag triggers with OnSite API

We recommend to use our OnSite API, to trigger your tags only if user has accepted the related category. If you are looking for your categories ID's, please refer to the section 'Manage Categories'

Add tag triggers without OnSite API

If, for some specific reasons, you cannot use our OnSite API, there's an alternative approach.

Commanders Act can manage onsite JavaScript tags by wrapping them in a script tag with a custom MIME type.

This Commander Act wrapper does only fire that wrapped JavaScript code in case a visitor provided consent for the specified privacy category ID.

<script type="text/tc_privacy" data-category="{{ category_or_sub-category_id }}" data-vendor="{{ vendor_id }}">
    {{ tag_javascript_code }}
</script>

The <script> has to have type="text/tc_privacy" .

{{ tag_javascript_code }} has to be replaced with the JavaScript code of the tag you want to manage with Commanders Act Consent.

{{ category_or_subcategory_id }} has to be replaced with the category or sub-category of the Commanders Act Consent category that should manage this tag (see Manage Categories). Be careful when you create sub-categories associated to a category: you have to enter the sub-category ID in the attribute, not the category ID, as the user will be able to activate or deactivate only sub-categories and not the main category in the banner:

{{ vendor_id }} has to be replaced with the vendor ID of the vendor related to the tag (Only available when native vendors are activated for the account).

Example

Following examples shows how you would manage a Criteo Tag based on a Consent category named "retargetting".

"Retargetting" was assigned to sub-category ID 6. In case a sub-category is used you should never use the main category (2 in this case) to manage tags.

The Tag wrapper for the Criteo JavaScript tag might look like this (example shortened):

<script type="text/tc_privacy" data-category="6" src="//static.criteo.net/js/ld/ld.js" async="true">
</script>

<script type="text/tc_privacy" data-category="6">
    window.criteo_q = window.criteo_q || [];
    window.criteo_q.push(...);
</script>

Lorsque l’utilisateur retire son consentement, il est parfois nécessaire de supprimer les cookies déposés précédemment (cas de la France notamment). Nous mettons à disposition un script simple et personnalisable qui permet de supprimer automatiquement les cookies first-party (déposés par votre propre site) et cookies tiers (via appel API)

Certains cookies spécifiques nécessitent une approche ciblée. Voici comment procéder étape par étape :

1. Identifier les cookies à conserver

Avant toute chose, il vous faut lister les cookies indispensables au bon fonctionnement de votre site. Exemples de cookies techniques ou liés à la gestion du consentement à conserver :

• TCPID

• TC_PRIVACY

• TC_PRIVACY_CENTER

👉 Comment identifier ces cookies essentiels ? Nous mettons à votre disposition la fonctionnalité Cookie Scanner, qui vous permet de lister les cookies présents sur votre site, pour vous aider à identifier ceux qui doivent être conservés. Cela évite d’en oublier et assure un bon fonctionnement après la suppression des cookies non essentiels. Il est conseillé de vérifier avec vos équipes techniques ou votre prestataire les cookies techniques qui ne doivent pas être supprimés.

💡 Action : Utilisez Cookie Scanner pour obtenir une liste complète des cookies présents sur votre site

2. Utiliser un script pour supprimer automatiquement les cookies non essentiels

Nous proposons un script JavaScript simple et personnalisable qui se déclenche automatiquement lorsque l’utilisateur retire son consentement via la CMP Commanders Act. Le script réalise les actions suivantes :

• Détection du retrait de consentement : Le script s’abonne à un événement de mise à jour du consentement. Dès que l’utilisateur opte pour le refus, le script se lance.

• Suppression des cookies first-party : Il parcourt l’ensemble des cookies déposés par votre domaine et supprime ceux qui ne figurent pas dans votre liste blanche. Pour être efficace, il teste plusieurs variantes de domaine (votre domaine et ses sous-domaines).

• Optionnel – Appel de services côté serveur et partenaires : Le script peut également appeler des URL que vous aurez renseignées pour demander la suppression de cookies déposés côté serveur (cookies HTTP-only) ou par des partenaires externes (cookies tiers). 👉 Voir le chapitre 3 pour en savoir plus sur la gestion des cookies HTTP-only et tiers.

  ⚠️ Note : L’ajout de ces URL est facultatif. Si vous ne souhaitez pas utiliser cette fonctionnalité, il vous suffit de laisser le tableau des URL vide ou de supprimer cette partie du code. Vous pouvez aussi gérer ces suppressions par vous-même ou avec vos partenaires.

📌 Où intégrer ce script ?

Vous pouvez insérer ce code JavaScript : ✅ Dans la section "Custom JS" de la bannière Commanders Act (recommandé dans la plus part des cas). ✅ Dans votre Tag Management System (TMS) (si vous souhaitez une gestion plus centralisée).

Télécharger le script JavaScript :

/**
 * This script listens for consent updates via the Commanders Act OnSite API.
 * When a user revokes consent (opt-out), it removes all 1st party cookies
 * except for those explicitly allowed. It also calls configured URLs to delete cookies
 * on the server side (e.g., httpOnly or third-party cookies).
 */
(function () {
  // List of cookies to retain (system cookies, technical storage items)
  var allowedCookies = ["TCPID", "TC_PRIVACY", "TC_PRIVACY_CENTER"];
  // Optional: Regex to match additional cookies or storage keys to retain
  var allowedCookiesPattern = /your_regex_[a-z0-9]*/; // Adjust this pattern if necessary

  // Array of server URLs to call for server-side deletion of cookies (httpOnly/partner cookies). Leave empty if you don't have such urls/api
  var serverDeletionUrls = [
    "https://server1.example.com/delete-cookies",
    "https://server2.example2.com/delete-cookies"
  ];

  // Subscribe to consent updates using the Commanders Act OnSite API
  cact("consent.onUpdate", function (consentData) {
    if (consentData.updateEvent === "revoked" || consentData.consent.status === 'all-off') {
      // Retrieve all cookies
      var allCookies = document.cookie.split(";").map(function (item) {
        return item.split("=")[0].trim();
      });
      // Determine which cookies need to be removed (i.e. not allowed)
      var cookiesForRemoval = allCookies.filter(function (cookieName) {
        return allowedCookies.indexOf(cookieName) === -1 && !allowedCookiesPattern.test(cookieName);
      });

      // Remove each cookie from all possible domain variants
      cookiesForRemoval.forEach(function (cookieName) {
        var hostParts = window.location.hostname.split(".");
        while (hostParts.length > 0) {
          var domainCandidate = "." + hostParts.join(".");
          tC.removeCookie(cookieName, domainCandidate);
          hostParts.shift();
        }
        // Also try removing the cookie without a domain specification
         document.cookie = `${cookieName}=;expires=Thu, 01 Jan 1970 00:00:01 GMT;path=/`;
      });

      // Call server-side endpoints to delete httpOnly and partner cookies
      serverDeletionUrls.forEach(function (url) {
        // Use fetch with no-cors mode to trigger the deletion endpoints
        fetch(url, { mode: "no-cors" }).catch(function (error) {
          console.error("Error calling server deletion URL:", url, error);
        });
      });
    }
  });
})();

3. Supprimer les cookies créés côté serveur et les cookies tiers

Cookies HTTP-only sur votre domaine

Certains cookies sont créés côté serveur et marqués comme HTTP-only. Ils ne sont pas accessibles par JavaScript et ne peuvent être supprimés que par le serveur.

• Origine : Ils peuvent être déposés par vos propres serveurs ou par un partenaire à qui vous avez délégué la gestion de votre domaine (via un CNAME, un WAF, un proxy, etc.).

👉 Que pouvez-vous faire ?

• Créer une API sur votre serveur pour supprimer ces cookies.

• Ajouter l’URL de votre API dans le script, afin qu’elle soit automatiquement appelée lors du retrait du consentement.

Cookies tiers

Ces cookies sont déposés par des services externes (publicité, analyses, widgets, etc.) et ne sont pas générés directement sur votre domaine.

• Limitation : Le script JavaScript ne peut pas supprimer directement ces cookies, sauf si ces fournisseurs offrent une API ou une URL dédiée permettant leur suppression.

• Que faire ? 👉 Demandez à vos partenaires s’ils proposent un mécanisme de suppression (API ou URL dédiée). Si c’est le cas, ajoutez ces URL dans le script pour automatiser leur appel lors du retrait du consentement. Sinon, utilisez le mécanisme proposé par le partenaire.

4. Ce que fait (et ne fait pas) notre script

✅ Il supprime automatiquement les cookies déposés sur votre domaine (first-party), en conservant ceux que vous avez explicitement listés. ✅ Il permet d’appeler des URL de suppression pour les cookies HTTP-only et tiers (optionnel). ❌ Il ne peut pas supprimer directement les cookies tiers, sauf si ces derniers proposent une url ou API dédiée. ❌ Il ne peut pas supprimer les cookies HTTP-only, sauf si ces derniers proposent une url ou API dédiée.

Please refer to the subpages for implementation on mobile apps

Having the user consent is essential to send sensible information like the IDFA/AAID. To prevent having to manually save the consent asked to the user and manually using it with our SDKs, we created a module helping you do it automatically.

This module will gather the consent and will:

• Display a consent page (if needed)

• Save consent and reload it every time the application is launched.

• Save and check the validity of the consent. The validity duration is set to 13 months.

• Send a hit to our servers to record the consent.

• Enable or disable the SDK. (if used alongside the SDK ServerSide)

• Add the categories automatically to the hits the SDK sends. (if used alongside the SDK ServerSide)

Since April 2021, Apple requires that your app provide a transparency popup to ask user permission for tracking, beginning with iOS 14.5 () and the ATT framework.

When and how should you request permission from the ATT?

Before attempting to use the IDFA from an iOS device, you must first display the ATT tracking permission alert, according to Apple's guidelines. If permission is not requested or if the user declines, the IDFA will be unavailable to your app and any embedded third-party SDKs. Third-party SDKs may not function properly in this case.To really complies with both Apple and GDPR requirements, you must open the ATT popup to get user permission as well as open CMP popup to get user consent for GDPR purpose. ATT isn't currently compliant with the IAB TCF or with GDPR prerequisites, so it can't be utilized as the lone consent collection system and should be utilized with the Commanders Act CMP.

Our recommended solutions

1. Most accepted solution : ATT first

From customer's experiences, the most accepted solution by Apple is to :

1. Open the ATT popin

2. Depending of user's choice on ATT :

   1. if the user choose to allow the tracking, then open the TrustCommander popin to collect the consent

   2. If the user refuse the tracking in the ATT popin, the user has to be considered as optout without opening the TrustCommander popin

2. ATT after Commanders Act Consent banner

For some customer's this solution worked also :

1. Open the Commanders Act Consent popin

2. Whatever the consent, open the ATT popin just after

To go further, here a for France customers the position of the competition authority on this subject: https://www.autoritedelaconcurrence.fr/fr/communiques-de-presse/ciblage-publicitairemise-en-place-par-apple-de-la-sollicitation-att-lautorite

Having the user consent is essential to send sensible information like the IDFA/AAID. To prevent having to manually save the consent asked to the user and manually using it with our SDKs, we created a module helping you do it automatically.This module will gather the consent and will:

• Display a consent page (if needed)

• Save consent and reload it every time the application is launched.

• Save and check the validity of the consent. The validity duration is set to 13 months.

• Send a hit to our servers to record the consent.

• Enable or disable the SDK. (if used alongside the SDK)

• Add the categories automatically to the hits the SDK sends. (if used alongside the SDK)

Data Governance > Consent Management > Categories

In this section you can manage your Commanders Act Consent categories and sub-categories. These categories will be used by your privacy center to provide users with detailed privacy management options.

Category options

Each Commanders Act Consent category has following options:

Managing categories

Default category

In case you use Consent module with TMS Web Container you can select a default category with a drop down on the top left of the interface. New tags in TMS client-side will automatically receive the default category as their privacy category. The default category has a * in the category list.

Creating categories

To add a new category press ADD CATEGORY on the the top right of the interface.

Editing categories

You can edit a Consent category by pressing the pencil icon to the right of the category.

Deleting categories

You can delete Consent categories by pressing the x icon to the right of the category.

iAB categories

Commanders Act Consent module is compliant with IAB TCF 2.2 (Link to official listing) and can use predefined IAB TCF purposes instead of manually configuring categories. Go to Data Governance > Consent Management > Settings tab to activate IAB TCF 2.2 option for your account.

IAB TCF 2.2 purposes, special purposes, features and special features are automatically added to the CATEGORIES tab depending the vendors you add in the MANAGE VENDORS tab. You can still add custom categories that you can use side by side with the predefined IAB categories.

The description of IAB TCF 2.2 categories is automatically loaded from the IAB TCF 2.2 framework.

Data Governance > Consent Management > Vendors

In this section you can manage your Commanders Act Consent vendors. These vendors will be used by your privacy center to provide users with detailed privacy management options.

Vendors

Click ADD VENDOR to add vendors to your Commanders Act Consent installation. You can select vendors available on Commanders Act TMS (Predefined Vendors) or add custom vendors (Custom Vendor) by selecting the respective tab. A Commanders Act vendor is available by default.

Each vendor can be mapped to Consent categories with the respective dropdown. This allows users to provide consent to all vendors of a category at once in the privacy center. A PEN icon allows to edit information of the vendor that is displayed in the privacy center. Following fields are available per vendor. A TRASH icon allows to remove the vendor.

IAB vendors

Click ADD IAB TCF 2.2 VENDORS to manage the IAB vendors with your Commanders Act Consent installation. You can either select all vendors or select specific vendors that are relevant for your setup.

The description of IAB TCF 2.2 vendors is automatically loaded from the IAB TCF 2.2 framework.

Commanders Act Consent will automatically configures purposes, special purposes, features and special features in the CATEGORIES tab depending on the selected vendors.

Google ACM vendors

Google Additional Consent Mode (ACM) allows to manage consent for Google Ad Technology Providers (ATP) (that are not part of the IAB TCF Global Vendors List) alongside IAB TCF vendors.

Add Google ACM vendor allows to add Google ACM vendors to add a Google ATP to your Commanders Act Consent installation. Each vendor has to be mapped to a TrustCommander category.

Descriptions for the ATP that are shown in the Consent banner (into the privacy center) are automatically loaded from the Google ACM list.

Google ACM vendor management only works with IAB TCF 2.0 & 2.2 banner templates.

Data Governance > Consent Management > Categories (tab ASSIGN TAGS)

Commanders Act TMS tags can be assigned to Consent categories & vendors in following locations.

• In ASSIGN TAGS tab of Data Governance > Consent Management > Categories.

• In the EDIT tab of TMS Commanders Act.

Assign categories & vendors in Commanders Act Consent interface

Categories & Vendors are managed separately for each web container. You can select a Web Commander container in the left column. Then you can manage following Consent setting per tag on the right side of the interface.

Additionally you can also manage these Consent settings for following elements:

Assign categories in Commanders Act TMS interface

For convenience it is also possible to directly assign Commanders Act Consent categories & vendors inside the Edit tab of TMS Commanders Act (Web Containers). Assigning a category & vendor also includes the tag in the privacy scope.

In case a new vendor is added to the account the tag will not be fired when a user provided an optin for the corresponding category. Therefore it is necessary to activate the "Re-activate privacy" option during the generation of a new banner version to re-ask consent. The option "Don't re-ask the consent to trigger this tag" will change this default behaviour so that the vendor will receive an automatic optin based on the corresponding category.

IAB TCF V2.2 option

In case you choose to manage tags with IAB 2.2 you do not need to assign IAB compliant tags in the category assignation tab. IAB compliant tags are automatically controlled by the IAB framework.

It is still possible to assign tags to categories to allow Commanders Act Consent to manage them directly with TMS Commanders Act.

Banner templates

Manage Banner

Deploy Banner

Copy Banner

Commanders Act offers multiple banner templates for different kind of privacy workflows.

WCAG standards : offer a privacy fully functional for people with disabilities

Among the available templates, one is dedicated to accessibility. It ensures compatibility with RGAA and WCAG 2.0 level AA standards.

Web Content Accessibility Guidelines (WCAG) is developed through the W3C process in cooperation with individuals and organizations around the world, with a goal of providing a single shared standard for web content accessibility that meets the needs of individuals, organizations, and governments internationally.

More information here : https://www.w3.org/WAI/standards-guidelines/wcag/

What is Web Accessibility ?

When websites and web tools are properly designed and coded, people with disabilities can use them. However, currently many sites and tools are developed with accessibility barriers that make them difficult or impossible for some people to use.

Making the web accessible benefits individuals, businesses, and society. International web standards define what is needed for accessibility.

Web accessibility means that websites, tools, and technologies are designed and developed so that people with disabilities can use them. More specifically, people can:

• perceive, understand, navigate, and interact with the Web

• contribute to the Web

With this template the main key point is to offer a privacy fully functional for people with disabilities.

Translation

The Accessibility template provides an automatic translation of different labels. This translation is based on navigator language. Currently, it supports : Italian, English, German, French and Russian.

Options :

1. Personalize translation

Banners

You can either add new translation or override aria labels by using the function tC.privacy.addTranslation() in the custom JS.

Labels available :

iframeTitle : Title attribute of the iframe

privacyLabel : Aria Label of the footer

acceptAria : Aria Label of the accept button

refuseAria : Aria Label of the refuse button

showPcAria : Aria Label of the “Show Privacy Center“ Button

Exemple :

tC.privacy.addTranslation({
  en : {
    // overriding
    iframeTitle : 'the iframe title you want',
    privacyLabel : 'the aria label you want',
    acceptAria: 'the aria label you want for accept button',
    refuseAria: 'the aria label you want for refuse button',
    showPcAria: 'the aria label you want for display the pc button'
  },
  ru: {
    // add new translation
    iframeTitle : 'the iframe title you want',
    privacyLabel : 'the aria label you want',
    acceptAria: 'the aria label you want for accept button',
    refuseAria: 'the aria label you want for refuse button',
    showPcAria: 'the aria label you want for display the pc button'
  }
})

Privacy Center

⚠️ To translate the privacy you must use another function: pc.addTranslation()

Available keys and their values :

var en = {
    "pcAria":"Cookie settings",
    "closePrivacyCenter":"Close the cookie setting dialog",
    "acceptAll":"Accept all",
    "refuseAll":"Refuse all",
    "saveLabel":"Save",
    "saveAria":"Save the current cookie settings",
    "acceptAllAria":"Accept all cookies",
    "refuseAllAria":"Refuse all cookies",
    "showVendors":"Show vendors",
    "showPurposes":"Show purposes",
    "vendors":"Vendors",
    "enableCookieLabel":"Enabled:",
    "enableCookieAria":"{label} cookies enabled",
    "disableCookieAria":"{label} disabled cookies",
    "turnOnSubCategoriesAria":"Enable {label} cookies",
    "turnOffSubCategoriesAria":"Disable {label} cookies",
    "cookieAlwaysOnSrPrefix":"",
    "cookieAlwaysOnSrSuffix":"",
    "cookieSrPrefix":"",
    "cookieSrSuffix":"",
    "showRelatedVendors":"Show related vendors",
    "privacyPolicy":"Privacy policy",
    "categories":"Categories"
}

Some of the translation accept a label as {label}. The label here is always the label of the category.

The last keys with SrPrefix/SrSuffix have empty translation by default. These keys are used for “sr-only” text which are prefixing and suffixing the category name. These text are only readable by a screen reader.

cookieSr are used when the category isn’t locked

cookieAlwaysOnSr replaces cookieSr if the category is blocked to on

Example:

pc.addTranslation({
  en : {
    // Override english Aria Label
    closePrivacyCenter: 'Close the privacy center', 

  },
  ru : {
    // you can also add a new language
    closePrivacyCenter: 'Close the privacy center',
      },
})

2. Force Translation

By default, texts provided to screen readers is translated depending on the navigator language. In some case you may want to display a privacy in english for example even if the navigator language is another one. ie : with an ISO language code in the url

You can force the privacy to take a language by using the function setLocale in the Privacy Center > Custom JS field > JS Block Before :

pc.setLocale("fr");

Value can be : fr, it, de, ru or en

Note : this function must be placed after the translation declaration.

3. Focus Trap

The focus trap is an accessibility option designed so that keyboard user have their navigation locked to the banner. Pressing the TAB key would cycle between the different navigation elements of the banner without going on your website. This is an accessibility recommendation when using modal on a webpage.

You can deactivate the focus trap by adding the following JavaScript snippet to the custom JS of the accessibility template banner:

tC.privacy.enableFocusTrap(false);

Manage Banner

Options to create and edit banner templates.Sources > Privacy banners

Creating Privacy Banner

Click ADD PRIVACY BANNER in the top right of the interface to add a new banner to your account. Each template has following options:

Example: Configuring options of a privacy banner.

Update Privacy Banner

You can open and edit the privacy banner settings via the gear icon on the top left of the interface.

Customize banner content

Sources > Privacy banners (tab EDIT BANNER)

Options for banner customization

All banner templates can be customized with a WYSIWYG editor. Following options are available for all banners (except IAB TCF and Popin with Categories templates).

Changes have to be saved with the SAVE button.

Options for privacy center customization

Following options are available for the privacy center and "Popin with categories" templates.

Changes have to be saved with the SAVE button.

IAB TCF banners advanced options

Customise Publisher Country Code Field

Option to manage the publisherCC field of the IAB TCF API.

​Country code of the country that determines the legislation of reference. Normally corresponds to the country code of the country in which the publisher's business entity is established.

Consent banners sets this value to "FR" by default in the IAB response. The publisher country code field can be customised with following JavaScript snippet (should be implemented in the first container on the website.).

tC.privacy.iabPublisherCC = "<country_code>";

Example to set the publisher country code field to a German country code:

tC.privacy.iabPublisherCC = "DE";

Customise Purpose One Treatment Field

Option to manage the purposeOneTreatment field of the IAB TCF API.

IAB TCF offers this field to specify how purpose one should be treated in specific scenarios.

true: Purpose 1 not disclosed at all. CMPs use publisherCC to indicate the publisher's country of establishment to help Vendors determine whether the vendor requires Purpose 1 consent.

false: There is no special Purpose 1 treatment status. Purpose 1 was disclosed normally (consent) as expected by TCF Policy

Consent banner sets this value to false by default in the IAB response. The purpose one treatment field can be customised with following JavaScript snippet (should be implemented in the first container on the website.).

tC.privacy.iabPublisherCC = (true|false);

Neutral vendor buttons

You can change the vendor button type to neutral if you choose the neutral position as the default status.f

Synchronization mode between vendors and categories

You can choose to synchronize vendors status with categories, choosing to do it only for neutral buttons or always. If you use an IAB TCF template, this option will not have any effects on TCF vendors, as the TCF framework doesn't allow this.

IAB TCF Stacks Beta

Commanders Act Consent offers IAB TCF Stacks to reduce the size of the purpose list in the privacy center. IAB TCF Stacks group purposes and special features in a foldable panel and allows visitors to configure consent for all purposes and special feature in a Stack at once. More information on IAB TCF Stacks can be found in the IAB TCF Policy.

Right now IAB TCF Stacks are in beta in Commanders Act Consent. They are activated with a JavaScript command that needs to be added to the privacy center CUSTOM JS field JS BLOCK BEFORE.Example: Activating Auto Stacks

Commanders Act Consent offers two options to activate Stacks:

pc.iab.useAutoStack();

pc.iab.useStackIds(1,2); // activates Stacks with ID 1 and 2

Move native Categories above IAB Purposes

Per default IAB Purpose controls are placed above native category controls. It is possible to display native categories above IAB TCF Purpose controls by adding following JavaScript snippet to the CUSTOM JS field JS BLOCK BEFORE of the privacy center.

pc.tc.categoriesSectionTop(true);

The "Other" headline of the native category controls can be translated by adding following configuration snippet to the CUSTOM JS field JS BLOCK BEFORE of the privacy center.

pc.addTranslation({en: { others: 'My Headline' }});pc.setLocale('en');

Sources > Privacy banners ( tab GENERATE & DEPLOY)

Generate Banner Versions

To deploy a new or updated banner it is first necessary to generate a new version of the banner. Click GENERATE to open the modal dialogue.

You will have following option when generating a new container version.

Preview New Banner Versions

You can preview and test new banner versions by clicking the TEST option on the right site of the banner version in the banner version list. This will preview the banner on a demo website.

Banner Deployment Options

The deployment process of a new banner version varies depending on the selected hosting method of the privacy banner. You can select the hosting method of a banner in the privacy banner settings that can be accessed with the gear icon on the top left of the interface (beside the privacy banner name).

Commanders Act CDN

Commanders Act CDN ensures a reliable and performant hosting of your banner. It allows to deploy banners automatically and in real-time.

Click DEPLOY to deploy a banner to the Commanders Act CDN.

On premise (self-hosted)

This option allows to self-host privacy banner. It therefore requires manual effort on each update. For on premise hosting it is necessary to provide the URL of the folder where the on premise banner is hosted. Example:

http(s)://www.mydomain.com/myfolder/

Click DOWNLOAD to download on the right side of the new banner files and manually update them on your server.

Container vs. Banner Deployment

In case both TMS and Consent Commanders Act are used to manage tags it is important to understand what needs to be generated and deployed for different update scenarios. Following table lists the elements that needs a generation and deployment for common scenarios.

Administration > Copy management

Commanders Act copy management allows to copy privacy banner. Privacy banners can be copied within the same account or transferred to another account.

Copying a Banner

Steps to copy a banner with copy management.

Step 1

Select Privacy banner(s) in the Elements to copy dropdown.

Step 2

Use the Site containing the privacy banner(s) to copy dropdown menu to select the site where the privacy banner is located that you want to copy.

Step 3

Select one or more privacy banner that you would like to copy in the Privacy banner(s) to copy dropdown menu.

Step 4

Choose one or multiple target sites where you want to copy the selected privacy banner with the Destination site(s) dropdown menu.

Step 5

You can copy your privacy banner to a new template by selecting Yes in the Copy the privacy content to a new template option.

After this you will be able to select the new template in the Destination template dropdown menu.

This will keep the content (text, selected color, etc.) of the banner and change the template.

Step 6

Click on blue buttonCOPY at the top right corner of the interface to copy the banner with the selected options.

The Commanders Act Consent Analysis dashboard provides insights into critical KPIs of your consent management setup.

Interface

Filter options

The dashboard provides KPIs for each individual Commanders Act Consent banner. You can customize the dashboard by adjusting filter settings at the top left of the interface. Commanders Act Consent Analysis provides the following filters:

Time selection

On the top right you will find options to filter data for a specific time range by specifying a start and end date. The dashboard will show metrics including the selected start and end date.

Export options

It is possible to export CSV reports via the EXPORT option on the top right in the interface. Reports will only include data for the selected timeframe.

Measurement approach

Commanders Act Consent Analysis measures privacy banner interactions to calculate consent KPIs.

All metrics are visitor/ traffic based and not user based. Commanders Act Consent Banner therefore sets a 1st party cookie TCPID on website visitors. It deduplicates certain metrics (e.g. opt-in actions) of a visitor based on this cookie. Commanders Act identifies visitors as new visitors in case they delete this cookie.

Optin vs. optout action

To understand dashboard metrics it is important to understand how Commanders Act Consent Analysis measures optin and optout actions.

Examples

Following examples outline a hypothetical scenario with only one website visitor to explain the measurement approach:

Example 1

1. A new visitor arrives at a website with a Commanders Act Consent banner.

2. He accepts the privacy banner and immediately navigates to the privacy policy page.

3. There he re-opens the privacy center and revokes his prior consent.

This would lead to one optin action and one optout action and two banner views. Commanders Act Consent Analysis deduplicates action and therefore only uses the last action of a visitor to calculate the consent KPIs per day. Additionally it deduplicates the banner views per visitor per day therefore only counts one banner view in this scenario. This user journey leads to an optin rate of 0%, a no choice rate of 0%, and optout rate of 100%.

Example 2

1. A new visitor arrives at a website with a Commanders Act Consent banner.

2. He does not interact with the banner and leaves the site immediately.

3. On the next day he returns to the website.

4. He accepts the privacy banner and immediately navigates to the privacy policy page.

5. There he re-opens the privacy center and revokes his prior consent.

On the first day this would lead to no action and one deduplicated banner view. On the second day this leads to one deduplicated optout action (see Example 1) and one deduplicated banner view.

For a selected timeframe that only includes the first day this would result in a no choice rate of 100%. For a selected timeframe that only includes the second day this would result in a optout rate of 100%. For a selected timeframe that includes both days this would result in an optin rate of 0%, a no choice rate of 50%, and an optout rate of 50%.

Dashboard metrics

Following you will find detailed descriptions of each metric in the dashboard. When available you can expand the line to get the break down by categories.

Global

Consent methods

How engaged visitors react to CMP?

How visitors interact with the CMP banner?

How visitors use the privacy center?

Understanding metrics

No choice vs. Bounce rate

In an optin configuration (no tracking before a user provides consent), bounce rate tracking is not possible anymore as bouncers usually won't interact with the website and therefore won't provide consent for analytic services. The no choice metric of Commanders Act Consent Analysis can help to get an idea on your bounce rate, but it is not the same metric!

In a default optin configuration, the "no choice" is expected to include:

Normal cases:

• Visitors who do not provide an optin and leave the website (bounce)

• Visitors who do not provide an optin and continue to browse the website without closing the privacy consent message (possible with header/ footer banner templates, less likely with a popin template that blocks website navigation)

• Visitors who do not provide an optin who continue browsing the website after closing the privacy consent message with the closing cross

Special cases:

• Visitors that are redirected by an internal redirect of the website (for example due to a language redirect on the landing page)

• Mobile visitors who are redirected to the mobile app when arriving on the landing page in a mobile browser

• Visits of bots like web crawlers. Common bot traffic is excluded but industry specific crawlers might increase "no choice" percentage

AB testing

The performance of privacy banner is crucial for the success of any data driven marketing activity. Therefore it is especially important to perform AB tests of your privacy banner to improve the user experience of your website visitors and to improve your consent KPIs. For AB tests it is common to set a goal to minimise the no choice and optout KPIs.

Commanders Act Consent Analysis dashboard makes it very easy to compare metrics of two banners set up for AB test side by side by adding the AB test banners via the PRIVACY filter option.

Manual or Scheduled export

You can export the raw consent data in the Options menu.

You can download consent data once, or schedule a recurrent export, by email or FTP.

Export fields

The export includes the following fields:

Storage retention

The option "Consent storage duration in database" allows to set a duration (in month) the consent data is stored in the consent database (which is used to prove consent). Be careful when changing the setting to not lose old consents by accident! You will be shown a prompt after changing the value to confirm the new duration. The maximum storage duration is 13 months. In case you need a longer storage duration, please contact your Commanders Act support or consultant.

Data Governance > Consent Management > Settings.

Account Default Configuration

Default optout / optin

This setting allows you to handle how tags should be handled in case no consent was yet provided by a user.

IAB TCF compliancy

This option enables the IAB TCF 2.0 framework for your account. This will enable IAB TCF 2.0 banner, categories and vendors.

Google Additional Consent Mode

This option enables the Additional Consent Mode (ACM) for Google Ad Technology Providers (ATP) for your account. This will enable Google ACM vendor management in the Categories & Tags section and extends the IAB TCF API according to the ACM specification.

Vendor management

This option activates vendors. This will enable vendor management options in the Categories & Tags section and enables a vendor management screen in your privacy centers that allows users to manage consent per vendor (requires re-deployment or banners).

Localisation

This option allows to select country codes (e.g. fr for French) that are used to localise the cookie notice of the cookie scanner feature. It is possible to add default country codes by clicking in the white area and selecting a country code from the dropdown. Additionally custom country codes can be added by clicking in the white area and typing the custom country code. The custom country code is saved after pressing Enter.

Consent Export Options

See dedicated documentation here.

Privacy Cookie Name, Separator and Subdomain

These settings allow you to modify the default name, separator and subdomain of your privacy cookie.

Overview

Commanders Act offers a cookie scanner that continuously monitors websites for cookies in real time. The scanner has access to a database of common analytics and marketing cookies and can therefore provide ready to use descriptions and information. This cookie information can be used to install a dynamic cookie notice on the website that provides transparent information about the used cookies and their purpose to visitors.

Activation

Simply follow these 3 steps to enjoy this feature on your account:

1-Cookie Scanner is an optional module. Only a Commanders Act consultant (or support team) can activate it. So the first step will be to ask to our team to activate the feature on your Commanders Act site.

2-Declare the domains that you need to be scanned with the Cookie Scanner Data Governance > Consent Management > Settings > Cookie Scanner Domains

3-Regenerate and Deploy your privacy banner(s)

Scan Cookies

Mechanisms

Cookie scanner combines three mechanisms to identify cookies on websites:

Some technical systems (like Drupal) create dynamic cookie names. Cookie Scanner therefore groups cookies when 5 or more cookies start with the same 4 characters. (e.g. abcd123, abcd2345, abcd3456, etc.)

Cookie Types

Cookie scanner can scan following types of cookies:

Cookie Fields

Cookie Scanner scans following fields per cookie:

Manage Cookie Information

Health > Website Monitoring > Cookie Scanner > EDIT (Tab)

In the edit step of the cookie notice it is possible to investigate, edit and enrich cookie information.

Sections

All identified cookies are listed in three groups:

1. New lists new Cookies that have not yet been manually investigated

2. Active lists Cookies that should be shown in the cookie notice

3. Ignored lists (internal) Cookies that should not be shown in the cookie notice

Edit Cookie Information

It is possible to edit the information of each cookie by pressing the Pen icon to the right on the table. This will open a cookie dialogue with following options:

Create Custom Cookie

It is possible to add custom cookies by pressing the ADD COOKIE button on the top right of the interface. This will open a cookie dialogue that has the same fields as the edit cookie information dialogue. Additionally it has a Name field that allows to set the name of the custom cookie.

Activate, Deactivate or Delete Cookies

New cookies and inactive cookies can be activated via the Checkmark icon. This adds them to the Active cookies list.

Active cookies and be deactivated by clicking the Stop sign icon. This adds them to the Inactive cookies list.

Inactive cookies can be deleted with the Trash can icon. This removes the cookie from the list entirely.

Localize Cookie Information

It is possible to localize cookie information. This allows to translate important information of each cookie for the cookie notice that can be embedded on a website.

To localize cookie information it is first necessary to select supported languages. To select supported languages go to Data Governance > Consent Management > Settings and select the country codes of the languages the cookie notice should be made available in. It is recommended to select country codes from the dropdown menu, but it is also possible to add custom country codes. Cookie Scanner offers automatic translation of predefined information for common languages (EN, FR, DE, IT).

After selecting the needed country codes the cookie information can be translated in the EDIT step of the interface. To translate a cookie click the Pen icon to open the edit modal. There it is possible to select a country code via a dropdown. Then adjust the setting the fields to translate them. You can preview the cookie list in a specific language by using the country code dropdown in the top right of the interface.

Following fields support localisation:

• Vendor Label

• Category Label

• Description

• Custom Fields

Labels

The cookie list displays optional labels for each cookie in the cookie list to inform about important information and notifications.

Occurrence frequency

For all types of cookies & storage you can visualize the percentage of detection frequency

Manage Cookie Notice

Health > Website Monitoring > Cookie Scanner > DEPLOY (Tab)

The DEPLOY (Tab) interface is used to install, create and deploy a cookie notice on a website. It provides a versioned list of cookie notices that were created within the account.

Install Cookie Notice

After all cookie information was setup in the EDIT (Tab) it is possible to install the cookie notice on a website. The cookie notice is available in 3 versions:

1. Javascript snippet

Copy/past the js code on your legal page to automatically build the cookies list table.

2. HTML Table

The HTML table is the recommended way to install a dynamic cookie notice on websites.

For this it is recommended to setup both a JavaScript tag (e.g. tag template 'TRUST | Install Cookie Notice' in TagCommander) and a placeholder <div> on the website (e.g. in the Content Management System). The placeholder is a slot where the table should be inserted and the tag loads the table and inserts it into the slot.

Both the <div> and the tag need to be configured with a common id. e.g. in case the placeholder <div> has following id: <div id="ca-slot--cookie-notice"></div> it is necessary to set the parameter #PLACEHOLDER_DIV_ID# of the tag template TRUST | Install Cookie Notice to ca-slot--cookie-notice .

Endpoint of the HTML file:

https://cdn.tagcommander.com/cookie-scanner/<site_id>/v1/cookies-<language_code>.html

site_id: Commanders Act site ID (e.g. 1234).

language_code: Language of the cookie notice (e.g. fr, default language is en).

3. JSON API

The JSON API provides a method to install a cookie notice for advanced use cases. It provides all cookie information in a structured data format that can be used by technical users to create custom functionalities. The JSON API can e.g. be used to inject a custom cookie notice into a native App.

Endpoint of the json file:

https://cdn.tagcommander.com/cookie-scanner/<site_id>/v1/cookies-<language_code>.json

site_id: Commanders Act site ID (e.g. 1234).

language_code: Language of the cookie notice (e.g. fr, default language is en).

Create Cookie Notice Version

Before it is possible to deploy updates to the cookie notice it is necessary to create a new version. To create a new cookie notice version click the NEW VERSION button on the top right of the interface. This will take all cookies in the Active list of the EDIT (Tab) to create the cookie notice. In the new version dialogue it is possible to provide a comment that explains changes in the new version for internal reference.

Preview Cookie Notice Version

The Play button to the right of a cookie notice version can be used to preview a cookie notice. This will not apply any styling of the website so the look will differ compared to the cookie notice on the website.

Export Cookie Notice Version

A Down Arrow button is available for each cookie notice version. It allows to download the cookie notice in all localisations in HTML, JSON, CSV and XSLX format. In the XSLX one tab is included per language. For all other formats a ZIP will be provided that includes one file per language.

Deploy Cookie Notice Version

The DEPLOY button to the right of each cookie notice version can be used to deploy a cookie notice to the website. This allows to deploy new versions, but allows to roll back to older version in case of issues.

Options

Custom Fields

Cookie Scanners allows to add custom fields to provide additional details per cookie. These fields can be added inside of the feature settings accessible via the Gear icon. It is possible to re-arrange the fields by changing their order via drag and drop.

Filters

You can filter your cookie's list by host (website), language and storage type (1st party, 3rd party, local storage, session storage)

If you select 3rd party type, you will obtain an additional filter to view cookies from a specific domain:

Rare cookies filter

By default, the rare cookies (scanned on less than 5% of pages) are now excluded from your list. Use the cursor to manage the scanner's tolerance. If it is positioned on 10%, the list will displays only the cookies scanned more often than 9.9%. You can modify this value, it's up to you!

User Rights

Cookie Scanner offers following user rights:

Tag mapping: View all your site's tags and their relationships on a map.

Focus by page type: Filter by page type (conversion page, product page, cart, etc.) and optimize the orchestration of your different tags for these pages in particular.

Health > Website Monitoring > Piggybacking

Overview

TagFirewall blocks unauthorized tags (domains) in real time. This can e.g. help to block and reduce the risk of piggybacking tags. TagFirewall is highly dynamic and can therefore enrich an existing Content Security Policy (CSP) setup to resolve critical issues with tags in minutes or replace the need for a Content Security Policy (CSP) entirely. TagFirewall offers two modes:

Blacklist Mode

This mode blocks tag communication with a configurable list of domains. Communication with all other domains is still permitted.

Whitelist Mode

This mode blocks tag communication with all domains except a configured whitelist.

Setup

Commanders Act

TagFirewall can be set up and configured with the tag template "Commanders Act - TagFirewall" in Commanders Act TMS tag library.

Standalone

TagFirewall can be set up and configured with a custom JavaScript tag for all other installations. The tag has following options.

<script>
tC = tC || {};
tC.tagFirewall = tC.tagFirewall || {};

tC.tagFirewall.list = {
    "blacklist": {
        "tags": <blacklist_tags>
    }
};

tC.tagFirewall.checkSSL = <check_ssl>;
tC.tagFirewall.blocked  = <active_flag>;  
</script>
<script src="<script_url>"></script>

<script>
tC = tC || {};
tC.tagFirewall = tC.tagFirewall || {};

tC.tagFirewall.list = {
    "whitelist": {
        "internal": <whitelist_internal>,
        "tags": <whitelist_tags>
    }
};

tC.tagFirewall.checkSSL = <check_ssl>;
tC.tagFirewall.blocked  = <active_flag>; 
</script>
<script src="<script_url>"></script> 

Examples

<script>
tC = tC || {};
tC.tagFirewall = tC.tagFirewall || {};

tC.tagFirewall.list = {
    "blacklist": {
        "tags": ["bad-domain1.com", "bad-domain2.com"]
    }
};

tC.tagFirewall.checkSSL = true;
tC.tagFirewall.blocked  = true;  
</script>
<script src="<script_url>"></script>

<script>
tC = tC || {};
tC.tagFirewall = tC.tagFirewall || {};

tC.tagFirewall.list = {
    "whitelist": {
        "internal": ["cdn.yourdomain.com", "cdn.yourdomain2.com"],
        "tags": ["facebook.com","twitter.com"]
    }
};

tC.tagFirewall.checkSSL = true;
tC.tagFirewall.blocked  = true;
</script>
<script src="<script_url>"></script>

What is our Marketing Preferences Center?

Marketing Preferences Center is part of our Consent management Premium offer. It allows you to build a personalized Preferences Center where online and offline consents are merged around unified users and stored in the same database.

Then, you can easily create and customize a web page to display this information to visitors who want to manage their consents and personal information.

It turns a legal page into a preference center that is way more valuable for a customer as it is more like a sharing space between the brand and their visitors/clients rather than just a way to collect the consent.

How it works?

Marketing Preferences Center is a realtime searchable nosql database. We provide also a dedicated API to read and/or write preferences/consents on this database

GET/PUT Consents / preferencesConsent management

· Consents are collected through our CMP solution (native integration)

· Preferences coming from a CRM database could be added with the FTP importer files or API

· Our customers can personalize the look and feel of their marketing preferences center page, we don’t host the webpage.

· Paid option: our customers can choose to receive regularly a full consents database copy to have a backup on their side

Limitations:

• The API accepts a maximum of 20 preferences

The Consent Object is a standardized way to represent consent throughout all methods of the onsite JavaScript API (similar to the IAB TCF consent string). The object holds a meta property that includes metadata like the validity of the cookie and a consent property that holds that current consent settings stored on the browser.The onsite API and Consent Object is the official way to access the consent settings of Commanders Act CMP with JavaScript. The direct usage of the Consent Cookie is deprecated.

Example Consent Object

{
    meta: {
        version: "1.0",
        tcfPolicyVersion: "2",
        siteId: "1234",
        bannerId: "12",
        bannerVersion: "50",
        consentId: "183049723840253",
        dateCreated: 1614174067000,
        dateUpdated: 1614185078030,
        dateExpires: 1614236789942
    },
    consent: {
        status: "all-on|all-off|mixed|unset",
        categories: {
            "1": {
                status: "on",
                required: true
            },
            "2": {
                status: "on|off|unset"
            },
            "tcf2_1": {
                status: "on|off|unset"
            },
            "tcf2_2": {
                status: "on|off|unset",
                legIntStatus: "on|off|unset"
            },
            "tcf2_sf_1": {
                status: "on|off|unset"
            }
        },
        vendors: {
          "1": {
                status: "on|off|unset"
          },
          "tcf2_1": {
                status: "on|off|unset"
          },
          "tcf2_2": {
                status: "on|off|unset",
                legIntStatus: "on|off|unset"
          },
          "acm_1": {
                status: "on|off|unset"
          }
        }
    }
}

Meta Properties

The meta property includes metadata and context for the consent that was provided on a browser.

Consent Properties

The consent property includes detailed information about the consent provided on the browser.

Category and Vendor IDs are prefixed with an identifier in case they are managed by a consent framework.

​

For its own operations, our Consent Module sets 1st party cookies to store the user's consent and to report anonymous consent statistics.

These cookies are necessary for the proper functioning of the collection of consent and the reporting of anonymous statistics. To this regard they are exempt from the obligation of consent.

Consent storage cookies

Consent storage cookies differ depending on the banner template used:

• standard templates: TC_PRIVACY & TC_PRIVACY_CENTER

• IAB TCF templates (local storage) : TC_PRIVACY_IAB_VENDORLIST & TC_PRIVACY_TCF

Cookie for anonymous statistics and consent proof (TCPID)

A 1st party cookie is set to be able to collect anonymous statistics of consent: TCPID. This cookie is also used as a unique identifier to provide proof of consent when required (for auditing or when requested by the user). We have worked together with the CNIL France to design the setting and processing of this cookie to strictly comply with the rules of the RGPD and in particular the rules enacted by the CNIL in 2019.

  if (tC.getCookie("TC_PRIVACY") == "") {
    tC.privacyCookieDisallowed = true;
  }

When are cookies exempt from consent?

In order to be exempt from consent in accordance with article 82 of the Data Protection Act, these tracers must:

• have a purpose strictly limited to measure the audience of the site or application (performance measurement, detection of navigation problems, optimization of technical performance or its ergonomics, estimation of the power of the necessary servers, analysis of content consulted) for the exclusive account of the publisher

• be used to produce anonymous statistical data only

Conversely, to be exempt from consent, these tracers must not:

• lead to a cross-checking of the data with other processing or the data to be transmitted to third parties

• do not allow the aggregate tracking of the user's navigation across different applications or websites. Any solution using the same identifier across several websites (for example via cookies placed on a third-party domain loaded by several websites) to cross, split or measure a unified coverage of a content is excluded.

CNIL recommendations

To put in place solutions that respect people's rights, the CNIL also recommends that:

• users are informed of the implementation of these tracers, for example via the privacy policy of the site or the mobile application

• the lifespan of the tracers is limited to a period allowing a relevant comparison of audiences over time, as is the case with a period of 13 months, and that it is not automatically extended on new visits

• the information collected through these tracers is kept for a maximum period of 25 months

• the above-mentioned retention periods are subject to periodic review in order to be limited to what is strictly necessary

• for FR market : link the Consent Statistics to a category of cookies which can be turn off by the users on 'refuse all'

• for FR market : if you decide to do not link the Consent Statistics to a cookies category, you will be must to provide to your users another way to be Optout of Consent Statistics. We provide an FR implementation guide for Optout statistics, as recommended for CNIL compliance

A subcontractor can provide a benchmark service to multiple publishers if:

• the data is collected, processed and stored independently for each publisher

• tracers are completely independent from each other

Commanders Act Consent stores the consent of website visitors in a 1st party cookie.

This article only explains the consent cookie. Here you can find a list of all Commanders Act Consent cookies.

Name

The default name of the consent cookie is TC_PRIVACY. It can be configured in Data Governance > Consent > Settings.

Domain

The cookie is set as a 1st party cookie. The subdomain/domain of the cookie can be configured in Data Governance > Consent > Settings

Value

The value consist of multiple fields separated by @ symbols. The separator can be configured in Data Governance > Consent > Settings .

The cookie value follows following pattern (optional elements are wrapped in []).

<status>@<privacy_version>[|<tcf_version>]|<banner_id>|<site_id>@<consent_categories>@<blocked_on_categories>@<updated_timestamp>,<creation_timestamp>,<to_expire_timestamp>[@<tcf_vendor_consent_string>]

Examples

Example1: Optin for some categories

0@002|12|3441@1%2C3@4@1592900933049@1592900933049

Example 2: Optout for all categories

1@012|26|4221@@4@1592900933049@1592900933049

Introduction

In February last year, the Belgian Data Protection Authority (APD, “Autorité de Protection des Données”) issued a decision against IAB Europe related to the Transparency and Consent Framework (TCF), fining the organization 250k€ and instructing it to come up with a plan to solve the issues that were identified.

Since then, IAB Europe has come up with a plan to update its TCF, which will come into action over the following months. In this article, we review the context surrounding the APD decision, catching you up on the events from last before presenting IAB Europe’s action plan, and finally going over what these changes will mean in practice for Commanders Act users.

March 2023 update: On March 15th, 2023, IAB Europe confirmed that the Belgian APD has voluntarily suspended the six-month implementation period of IAB Europe’s action plan. As a result, the July 2023 deadline no longer applies. It’s now reported for Q4 2023

For more details and pending additional information, read the official IAB communication here.

Context about the Belgian APD and the Transparency and Consent Framework

More than a year ago, on February 2nd, 2022, the Belgian APD issued a decision against IAB Europe citing 4 issues with its Transparency and Consent Framework (what’s the TCF? Learn more here). According to the Belgian APD:

The Transparency & Consent (TC) string, the consent signal stored by players in the advertising industry, is personal information. As such, participants should establish a legal basis.

IAB Europe is a data controller of that information, whether or not it processes the consent information

IAB Europe is a joint controller with TCF participants (vendors, CMPs, publishers)

Security measures in place to protect the integrity of the consent signal were not sufficient

IAB Europe was subsequently fined and instructed to come up with an action plan to solve these issues. The IAB Europe, along with some TCF participants, has worked on the action plan and submitted it to the APD in April 2022. Despite additional procedural events in September, the action plan was reviewed on January 11th by the Belgian APD.

Of course, we will communicate with Commanders Act customers with specific action points before then.

What is going to change in 2023 for the TCF?

Here are the main changes and obligations that will impact your Consent Management Platform if you’re using the TCF after April 2023:

New TC string special purpose

Users of the TCF will be required to add a new (special) purpose to the classification of purposes in the TCF, informing their users that they are capturing and sharing data subject choices via the TC String.

No more legitimate interest for targeted advertising

Going forward, users won’t be able to rely on legitimate interest for personalized advertising.

Specifically, the purposes impacted will be purpose 3 (create a personalized ads profile), purpose 4 (select personalized ads), purpose 5 (create a personalized content profile), and purpose 6 (select a personalized content profile).

Mandatory disclosures in the second layer of the CMP

After April, users of the TCF will be required to disclose new information in their CMP second layer:

• The legitimate interests at stake

• The categories of data collected and/or already held by Vendors

• The retention periods (in the Vendors’ description)

Vendor-related changes

Publishers will be presented with a warning about the impact that a large number of vendors can have on the ability of users to make informed choices.

Additionally, the number of vendors will need to be disclosed in the first layer of the CMP. Finally, we will recommend using event listeners to ensure proactive communication of changed TC String to vendors.

As a Commanders Act customer, what am I supposed to do?

As a Commanders Act customer, what do these changes in the TCF mean and what are you supposed to do? Don’t worry, we’ve got it all planned out.

Not a lot will be expected from Commanders Act customers. However, if you decide to continue using the Transparency and Consent Framework, you must know that consent notices/consent banners will be changing slightly (based on the changes listed in the previous section), and you should therefore be ready for it.

The migration from the TFC v2.2 will take place on November 20, 2023 serving as the hard deadline for the change. You will be must to regenerate your consent banners TCF before this deadline.

Once the migration will be complete, we will recommend that you recollect consent from your customers, as previously collected consent was deemed invalid following the Belgian APD decision. Additionally, you’ll most likely have to reduce your vendor list, and updating mobile SDK versions to get the new TCF various updates will be compulsory.

But don’t worry, we will remind you about this before the deadline.

Conclusion

To conclude, and while it’s important to be aware of the upcoming changes following this important industry decision, the impact on Commanders Act customers should be minimal, and we’re hoping to provide thorough assistance to everyone along the way If you wish to go further, you will be able to verify your TCF compliancy, since IAB Europe has released a new CMP Validator Chrome Extension available here that includes all requirements of TCF v2.2.

This is an informative page. Almost every listed points above are automatically managed by our Consent Module (only the buttons "accept all" and "refuse all" are not automatically added). Simply follow our Migration guides for Web and for App to update you banner with these new requirement

1st Layer

The standard text has evolved with more precise list of usage of datas, and the total number of IAB TCF vendors must be displayed

2nd Layer (purposes menu)

Buttons Accept All/Refuse All are required

If you don't have yet an accept all / refuse all buttons in your privacy center, you must add them manually. You can refer to the step n°2 of this page for setup help

The automatic text of Purposes has evolved

There's no more "Legal Description" it is replaced by "Examples"

New TC string special purpose

The TCF will add a new (special) purpose to the classification of purposes in the TCF, informing their users that they are capturing and sharing data subject choices via the TC String. The name of this new special purpose is "Use limited data to select content" (ID 11)

Legitimate interest buttons will be removed on the following Purposes:

• purpose 3 (create a personalized ads profile)

• purpose 4 (select personalized ads)

• purpose 5 (create a personalized content profile)

• purpose 6 (select a personalized content profile)

3rd Layer (Vendors Menu)

3 major changes for the information provided by the Vendors

• They can provide a cookie policy url in multiple languages (the displayed url will be the same then the browser language)

• They must show the data retention period for each purpose

• They must show data they will collect

Here's the 5 steps to follow to remains compliant with the TCF on your website

1. Verify/Update your IAB Vendors The Vendors List has evolved, we recommend to verify your IAB Vendors selected. Data Governance > Consent Management > Vendors
2. Setup an Accept All/Refuse all buttons in your privacy center Sources > Privacy Banners > Edit (select your banner) > Privacy Center tab > Buttons *don't forget to save your changes !
3. Generate a new version of your Consent banner Sources > Privacy Banners > Edit (select your banner) > Generate *We recommend to check the option 'reactivate the privacy', so all you users will have the new consent string format, including the new purpose and the updated vendors
4. Generate a new version of the Web Container related to you Consent Banner Sources > Web Containers > Edit (select your container) > Generate
5. Deploy your latest versions of Web Container and Consent Banner

Introduction

Here's the 2 steps to follow to remains compliant with the TCF on your mobile application

1-Update the SDK Module

Simply download the latest versions of our TCIAB SDK Modules

• Android

• iOS

2-Update the json files

Upload the latest version to update your offline json's

• vendor-list.json

• purposes-xx.json (required if you're using other languages then EN, this link example is for FR language)

• your privacy json file updated (needs to be modified, following the step "Update the content of your privacy json file")

Upload your CDN json file

Your privacy json file updated needs to be uploaded on CDN Commanders Act, please contact your consultant or our support team to upload the latest version of your json on our servers. (the content of this json file needs to be updated, following the next step.)

Update the content of your privacy json file

1. Verify your vendor list "vendors": "15,48,501,506,520,539,512,895", *if you left the "vendors" empty, it will be considered as ALL vendors by our SDK Pay attention to your Vendor List, some Vendors aren't existing anymore in the GVL v3

2. Add the new required fields texts -> generic -> "illustationsButton": "illustrations"

   texts -> generic -> "dataCategoriesDef" : "Data Categories" texts -> vendors -> "legIntClaimTitle": "Legal policies"

Full json example:

{
	"information": {
		"update": "2023-06-30",
		"version": "1",
		"vendors": "8,241",
		"google_vendors" : "323,389,385,424",
		"consentDurationInMonths": 6,
		"significantChanges": "",
		"resetSave": ""
	},
	"components": {
		"firstLayerButton": ["RefuseAll", "Detail", "AcceptAll"],
		"secondLayerButton": ["RefuseAll", "Save", "AcceptAll"]
	},
	"customisation": {
		"content": {
			"fontcolor": "#000000",
			"backgroundcolor": "#ffffff",
			"bordercolor": "#806423"
		},
		"button": {
			"fontcolor": "#ffffff",
			"backgroundcolor": "#4287f5",
			"disabledBackground": "#E1E1E1",
			"linkcolor": "#0907F7"
		},
		"order": ["Custom", "IAB"]
	},
	"texts": {
		"generic": {
			"saveButton": "Save & Exit",
			"detailButton": "Details",
			"acceptAllButton": "Accept All",
			"refuseAllButton": "Refuse All",
			"vendorButton": "Vendors",
			"purposeButton": "Purposes",
			"legalButton": "Legals",
			"illustationsButton": "illustrations",
			"backButton": "Back",
			"purposeDef": "Purposes",
			"consentDef": "Consent",
			"legIntPurposeDef": "Legitimate Interest",
			"flexiblePurposeDef": "Flexible Purpose",
			"specialPurposeDef": "Special Purpose",
			"featureDef": "Features",
			"specialFeatureDef": "Special Features",
            		"dataCategoriesDef" : "Data Categories",
			"partnersLinkText": "our partners",
			"relatedVendorsButton": "show related vendors",
			"month": "month",
			"day": "day",
			"seconds": "seconds",
			"hours": "hours"
		},
		"popup": {
			"title": "We respect your privacy",
			"content": "We and our partners use technologies, such as cookies, and process personal data, such as IP addresses and cookie identifiers, to personalise ads and content based on your interests, measure the performance of ads and content, and derive insights about the audiences who saw ads and content. Click below to consent to the use of this technology and the processing of your personal data for these purposes. You can change your mind and change your consent choices at any time by returning to this site.\n",
			"purposeTitle": "We and our {total_number} partners:",
			"specialPurposeTitle": "We need your consent for all the purposes above, but we have legitimate interest for these purposes:",
			"featureTitle": "For some of the purposes above we and our partners:",
			"specialFeatureTitle": "For some of the purposes above we and our partners:"
		},
		"purposes": {
			"title": "Find out more about how your personal data is processed and set your preferences below.",
			"content": "You can set your consent preferences and determine how you want your data to be used based on the purposes below. You may set your preferences for us independently from those of third-party partners. Each purpose has a description so that you know how we and partners use your data.",
            "privacy_policy_text": "Check our privacy policies",
			"privacy_policy_url": "https://ourcompany.com/privacypolicies"
		},
		"vendors": {
			"title": "See the partners we work with below. Expend each one to see how they process your data.",
			"content": "You can set consent preferences for individual third-party partners we work with below. Expand each company list item to see what purposes they use data for to help make your choices. In some cases, companies may use your data without asking for your consent, based on their legitimate interests. You can click on their privacy policy links for more information and to object to such processing.",
			"privacyPolicyText": "Privacy Policy",
			"legIntClaimTitle": "Legal policies",
			"deviceStorageTitle": "Storage Type:",
			"deviceStorageCookieLifetime": "Cookie lifetime: ",
			"deviceStorageOther": "Others",
			"deviceStorageCookies": "Cookies",
            "googleVendorsDef" : "Google Ad Technology Providers",
            "domainsDef" : "Domain list", 
            "IABVendorsDef" : "IAB TCF Vendors"
		},
		"others": {
			"title_purpose": "Other categories EN",
			"title_vendors": "Other vendors EN"
		}
	},
	"texts_fr": {
		"generic": {
			"saveButton": "J'accepte",
			"detailButton": "Détail",
			"acceptAllButton": "Tout Accepter",
			"refuseAllButton": "Tout Refuser",
			"vendorButton": "Afficher les partenaires",
			"purposeButton": "Afficher les finalités",
			"legalButton": "Informations légales",
            "illustationsButton": "illustrations",
			"backButton": "Retour",
			"purposeDef": "Finalités",
			"consentDef": "Consentement",
			"legIntPurposeDef": "Intérêts légitimes",
			"flexiblePurposeDef": "Finalités flexibles",
			"specialPurposeDef": "Finalités spéciales",
			"featureDef": "Fonctionnalités",
			"specialFeatureDef": "Fonctionnalités spéciales",
            "dataCategoriesDef" : "Categories de Data",
			"partnersLinkText": "nos partenaires",
			"relatedVendorsButton": "Voir les partenaires",
			"month": "mois",
			"day": "jours",
			"seconds": "secondes",
			"hours": "heures"
		},
		"popup": {
			"title": "Le respect de votre vie privée est notre priorité",
			"content": "Nous et nos {total_number} partenaires pouvons stocker et/ou accéder à des informations sur un terminal, sélectionner des publicités standard, créer un profil personnalisé de publicités, sélectionner des publicités personnalisées, mesurer la performance des publicités, mesurer la performance du contenu, exploiter des études de marché afin de générer des données d’audience, développer et améliorer les produits, créer un profil pour afficher un contenu personnalisé, sélectionner du contenu personnalisé, mesurer la performance des publicités, exploiter des études de marché afin de générer des données d’audience, développer et améliorer les produits, sélectionner des publicités standard, mesurer la performance du contenu, créer un profil personnalisé de publicités, sélectionner des publicités personnalisées, créer un profil pour afficher un contenu personnalisé, sélectionner du contenu personnalisé. Ces technologies peuvent traiter des données personnelles comme l'adresse IP et les données de navigation pour assurer la sécurité, prévenir la fraude et déboguer, diffuser techniquement les publicités ou le contenu. Elles peuvent mettre en correspondance et combiner des sources de données hors ligne, recevoir et utiliser des caractéristiques d’identification d’appareil envoyées automatiquement, relier différents terminaux. Elles peuvent analyser activement les caractéristiques du terminal pour l’identification, utiliser des données de géolocalisation précises.\n",
			"purposeTitle": "Gérer vos préférences",
			"specialPurposeTitle": "Gérer vos special purposes",
			"featureTitle": "Gérer vos features ",
			"specialFeatureTitle": "Gérer vos specialFeatures"
		},
		"purposes": {
			"title": "Gérer vos préférences P",
			"content": "Nos partenaires P et nous déposons des cookies afin d'assurer la sécurité, améliorer votre expérience digitale et afficher des publicités et contenus personnalisés Vous pouvez accepter ou refuser ces différentes opérations.",
			"privacy_policy_text": "Notre politique de confidentialitée",
			"privacy_policy_url": "https://ourcompany.com/privacypolicies"
		},
		"vendors": {
			"title": "Gérer vos préférences V",
			"content": "Nos partenaires V et nous déposons des cookies afin d'assurer la sécurité, améliorer votre expérience digitale et afficher des publicités et contenus personnalisés Vous pouvez accepter ou refuser ces différentes opérations.",
			"privacyPolicyText": "Politique de confidentialité",
			"deviceStorageTitle": "Type de stockage:",
			"legIntClaimTitle": "Legal policies" 
			"deviceStorageCookieLifetime": "Durée du cookie: ",
			"deviceStorageOther": "Autres",
			"deviceStorageCookies": "Cookies",
            "googleVendorsDef" : "Partenaires Google Ad Technology",
            "domainsDef" : "liste des domaines utilisés", 
            "IABVendorsDef" : "liste des partenaires IAB"
		},
		"others": {
			"title_purpose": "Other categories FR",
			"title_vendors": "Other vendors FR"
		}
	},
	"categories": [{
			"name": "Statistics",
			"ID": "1",
			/* Ajouter "isMandatory": "true" pour bloquer la category sur ON 
			   If you are using sub-categories, only sub can be marked as mandatories */
			"isMandatory": "true",
			"related_vendors": [1],
			"description": "These cookies allow us analyze user behavior on the site, measure and improve performance and the quality of our service."
		},
		{
			"name": "Advertising",
			"ID": "2",
			"related_vendors": [2],
			"description": "These cookies allow us display adverts matching your interests on the websites you visit."
		},
		{
			"name": "Big category",
			"ID": "30",
			"description": "Here you can select the vendors.",
			"subcategories": [{
					"name": "GA",
					"ID": "31",
					"description": "Should we send information to GA."
				},
				{
					"name": "Xiti",
					"ID": "32",
					"description": "Should we send information to AT Internet."
				},
				{
					"name": "Vendor3",
					"ID": "33",
					"related_vendors": [1, 2],
					"description": "Should we send information to this vendor3."
				}
			]
		}
	],
	"vendors": [{ /* list here all the not IAB Vendors */
			"name": "Commanders Act",
			"ID": "1",
			"description": "Allow Commanders Act",
			"privacy_policy": "http://commandersact.com/privacypolicy"
		},
		{
			"name": "Another non IAB Vendor",
			"ID": "2",
			"description": "The desc of another vendor",
			"privacy_policy": "http://anothervendor.free.fr/privacypolicy"
		}
	],
	"categories_fr": [{
			"name": "Statistiques",
			"ID": "1",
			"related_vendors": [1],
			"description": "Avec cette catégorie on remonte les stats."
		},
		{
			"name": "Pub",
			"ID": "2",
			"related_vendors": [2],
			"description": "Pour afficher de superbes pubs personalisées"
		},
		{
			"name": "Super cat",
			"ID": "30",
			"description": "Une super cat.",
			"subcategories": [{
					"name": "Sous cat 1",
					"ID": "31",
					"description": "Mais on peut choisir que cette sous cat."
				},
				{
					"name": "Sous cat 2",
					"ID": "32",
					"description": "Ou alors uniquement celle-ci."
				},
				{
					"name": "Sous cat 3",
					"ID": "33",
					"related_vendors": [1, 2],
					"description": "Ou plus en fait, mais la 3 c'est pareil."
				}
			]
		}
	],
	"vendors_fr": [{
			"name": "Commanders Act",
			"ID": "1",
			"description": "Permettre à Commanders Act d'envoyer des informations",
			"privacy_policy": "http://commandersact.com/privacypolicy"
		},
		{
			"name": "Autre Vendors",
			"ID": "2",
			"description": "Permettre à cet autre vendor d'envoyer pleins d'informations",
			"privacy_policy": "http://anothervendor.free.fr/privacypolicy"
		}
	]
}

If you are using IAB TCF option (see this page to setup IAB TCF on your account), you will be able to use IAB TCF's __tcfapi where your privacy banner is deployed.

That function is defined in your container and in your privacy banner so that you can use it before your privacy banner has finished loading. It is sometimes referred by IAB as the TCF API stub.

IAB TCF consent is encoded in a format called the Consent-String.

How to use the TCF API

The recommended way of getting the value of TCF's consent-string (tcData.tcString in the example below) is by using the addEventListener command.

__tcfapi('addEventListener', 2, (pingReturn, success) =>{
 if(success &&
    (pingReturn.eventStatus === 'tcloaded' || pingReturn.eventStatus === 'useractioncomplete')) {
 
    // do something with pingReturn.tcString

  } else {

    // do something else

  }
});

Sometimes you do not want to be notified of consent updates. You can achieve this by using the more advanced code below:

__tcfapi('addEventListener', 2, function(pingReturn, success) {
  if(success &&
    (pingReturn.eventStatus === 'tcloaded' || pingReturn.eventStatus === 'useractioncomplete')) {

    // do something with pingReturn.tcString

    // remove ourselves to not get called more than once
    __tcfapi('removeEventListener', 2, pingReturn.listenerId);

  } else {

    // do something else

  }
});

• Reference: IAB TCF commands

How to decode the Consent-String

You can use this copy-paste a Consent-String on this page: https://iabtcf.com/#/decode.

• Reference: IAB TCF Consent-String format

Google Additional Consent Mode

This an optional extension to IAB TCF. Once setup in Consent Management Settings, an additional addtlConsent property will be available on the tcData object.

__tcfapi('addEventListener', 2, function(pingResult, success) {
  if(success &&
    (pingResult.eventStatus === 'tcloaded' || pingResult.eventStatus === 'useractioncomplete')) {

    // do something with pingResult.addtlConsent

  } else {

    // do something else

  }
});

• Reference: Google Additional Consent Mode Technical Specification

How to enable Google ACM Vendors

Common issues encountered while using the TCF 2 to integrate with Google Advertising Products