-
Notifications
You must be signed in to change notification settings - Fork 4.1k
Description
What's the issue?
When a CMP iframe sends consent information to AMP (consent-response message sent via postMessage), the maximum string length is 150.
The size of the IAB consent string can vary when users make more granular choices due to the encoding of the string and the difficulty of encoding granular choices (vs encoding a yes or a no for all vendors). See https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/Consent%20string%20and%20vendor%20list%20formats%20v1.1%20Final.md#vendor-consent-string-format- for the encoding of the consent string.
When encoding fully granular choices, a consent string has a size of 143 characters today. This grows with the number of vendors that are part of the IAB framework so we will soon be over 150 and not be able to store the IAB consent string in the allocated storage.
As is, the storage is too small to accommodate all variations of the current IAB consent strings (TCFv1) which means that the user choices might sometimes not be correctly stored and applied. When the string is too long, the consent UI keeps popping up on every page that the user visits.
With the new version of the IAB Transparency and Consent Framework (TCF v2) that Google has joined and should implement in its ad products, the string will get a little bit longer to accommodate for new signals (see https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20-%20Consent%20string%20and%20vendor%20list%20formats%20v2.md#tc-string-format).
I'd recommend increasing the storage limit for the consent status to 300. That would be plenty for the current consent string. I am not completely sure about the size of the v2.
cc @janwinkler (I am sure you'll run into this issue soon enough!)
cc @zhouyx @torch2424
How do we reproduce the issue?
Run
window.parent.postMessage({
type: 'consent-response',
info: 'string longer than 150 characters',
}, '*');from an iframe loaded by amp-consent
What browsers are affected?
The issue does not depend on the browser
Which AMP version is affected?
All versions are affected (since the addition of support for external CMPs)