ampproject / ampproject/amphtml
Inconsistent behavior of initialConsentMetadata in different CMPs
- Dominant language
- JavaScript
- Stars
- 14.9k
- Forks
- 4.1k
- PR merge metrics
- No merged PRs in 30d
Description
## What's the issue?
`window.context.initialConsentMetadata` behaves inconsistently between different CMPs and different consent types (GDPR / CCPA). This inconsistency makes it difficult for 3p providers to identify which consent type is being used, and basically means we cannot rely on `window.context.consentMetadata` and have to resort to other ways of identifying the consent type / value.
## How do we reproduce the issue?
### Example 1 - LeFigaro
LeFigaro are using AppConsent CMP with the amp-consent integration.
**Issue:** The `consentHrefResponse` doesn't contain `consentMetadata` field, but somehow it gets into the 3p iframe.
**Example url:** https://amp.lefigaro.fr/flash-actu/trump-appelle-les-republicains-a-se-retourner-contre-leur-chef-au-senat-20210216
Seems like the response from the `checkConsentHref` doesn't contain the `consentMetadata` field (this is after "accepting" - also no consent string):
But if you check `window.context.initialConsentMetadata` (inside a 3p frame), it has a value:

### Example 2 - DailyMail
DailyMail are using their own CMP solution (under dmg::media brand).
**Issue:** Seems like their CMP implementation doesn't support `consentMetadata`.
**Example url:** https://www.dailymail.co.uk/news/article-9264237/amp/Joe-Biden-plans-release-immigration-bill-grant-path-citizenship-11-million.html
Use a proxy to route your traffic via California, US, otherwise the consent request is not sent.
The consent request contains a `consentString` but no `consentMetadata`:
The `window.context.initialConsentMetadata` object is undefined (as expected I believe).

### Example 3 - Bloomberg
Bloomberg are using Sourcepoint as their CMP. They are NOT using the amp-consent integration. They have custom consent URLs.
**Issue:** Their implementation differs between CCPA and GDPR. There is no `consentMetadata` in either response, but with GDPR `window.context.initialConsentMetadata` exists with values.
**Example url:** https://www.bloomberg.com/amp/news/articles/2021-02-14/u-k-backs-biden-over-call-for-china-to-release-covid-data
Route your traffic via California, and the CMP response will not contain `consentMetadata`:

`initialConsentMetadata` will be undefined (as expected..?):

If you route via Europe, you get a different response, with all kinds of stuff but no `consentMetadata`:

But you do get a `initialConsentMetadata` object somehow:

### Example 4 - Ouest France
Ouest France are using the Didomi amp-consent integration.
**Issue:** Always uses GDPR even when navigating from California. Does not provide CCPA consent.
**Example url:** https://amp.ouest-france.fr/economie/banques-finance/cryptomonnaies-nouveau-record-pour-le-bitcoin-7106717
When navigating from California, the `checkConsentHref` response contains `consentMetadata` but has consent type of GDPR:

## What browsers are affected?
Only tested on desktop Chrome with emulation.
## Which AMP version is affected?
Not sure, we were unaware of this issue until recently (last week or two).
cc @micajuine-ho
Contributor guide
Assessment
This issue has not been assessed yet.