Skip to content

Conversation

@HeinzBaumann
Copy link
Collaborator

@HeinzBaumann HeinzBaumann commented Oct 6, 2025

These updates were open for public comment until December 1st, 2025.

Based on the recent FSWG approval I revised the device storage and disclosure specification with the new supported items for: support for specialPurposes, optOut flag, and in-mobile SDKS declaration

"maxAgeSeconds": 2592000000,
"cookieRefresh": false,
"domains": ["retarget.adtech123.com"],
"purposes": [1,3,4,5,6]
Copy link
Collaborator

@dmdabbs dmdabbs Oct 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NIT "purposes" should now be followed by a comma

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I fixed it.

"cookieRefresh": false,
"domains": ["retarget.adtech123.com"],
"purposes": [1,3,4,5,6]
"specialPurpose": [1]
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

typo?
Is the key name "specialPurpose" or "specialPurposes"?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should be specialPurposes. i fixed it.

@HeinzBaumann HeinzBaumann requested a review from dmdabbs October 7, 2025 17:35
Copy link
Collaborator

@dmdabbs dmdabbs left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Danke.

<td><code>optOut</code></td>
<td>optional</td>
<td>boolean</td>
<td>If the cookie is an opt-out cookie this value is set to <code>true</code>. The default is <code>false,</code>.</td>
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changelog says

Added support to: allow vendors to declare cookies and other storage mechanisms used in pursuit of non-TCF purposes (e.g. global opt-out)

Suggest using generic language since intent is for this to apply to all storage types, not solely cookies.

How about

If the storage/cookie facilitates a user opt-out, this value is set to true. The default is false.

Also a cookie or storage may be used to effect a site-specific opt-out not just a global (cross-origin cookie) one.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed it.

<td><code>description</code></td>
<td>optional</td>
<td>string</td>
<td>The description of what this cookie is used for.</td>
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested generic language tweak (plus a nudge to brevity):

A brief description of this item's use.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed it.


### SDKS array

Vendors must publish the mobile in-app sdks they use for collecting and processing personal data in the context of their TCF registration.
Copy link
Collaborator

@dmdabbs dmdabbs Nov 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

...use for collecting and processing...

Is this strictly whether the Vendor deploys/publishes mobile SDK libraries, or does it also encompass a Vendor's server-to-server integration with another company’s on-device SDK(s)?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is for the in-app mobile SDKs the vendor uses (what is built into the application).

@dmdabbs
Copy link
Collaborator

dmdabbs commented Nov 5, 2025

When we added the more flexible domains attribute in 2022 we noted this in the single-valued domain:

This field may be removed in a future release to only use the field domains.

Is it time to mark domain as deprecated, to be removed in a future release?

@HeinzBaumann HeinzBaumann marked this pull request as ready for review December 5, 2025 18:56
@lamrowena lamrowena merged commit b626c2f into master Dec 10, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants