Data Privacy Controls

Manage your consent and opt-out privacy obligations under the GDPR and CCPA with Data Privacy Controls. This feature is not prescriptive and there is no single way to implement consent or opt-out. Instead, mParticle gives you a simple, standard technique for storing and applying consent and opt-out choices. Consent state powers both GDPR consent and CCPA data sale opt-out.

This guide introduces you to mParticle’s data privacy control functionality and shows you how to collect an individual’s consent and apply it to your data flows.

Common uses of data privacy controls

Data privacy controls are flexible and customizable, allowing you to build any data flow or consent-based logic you need.

Use mParticle’s data privacy controls to help comply with CCPA’s “do not sell my data” requirement by collecting users who opt-out and blocking those users’ data from flowing to any ‘data sale’ output by:

• Recording a CCPA data sale opt-out as a user consent (more information below)
• Identify which outputs count as ‘data sale’ and apply the below forwarding rule to them
• Applying a forwarding rule of: Do not forward if CCPA Data sale opt out is present

GDPR defines consent as one method of lawful data processing. One common setup is to:

• Define a processing purpose of ‘marketing’
• Prompt users for affirmative consent for ‘marketing’
• Identify which outputs would perform ‘analytics’ processing
• Apply a forwarding rule of: Only forward user data if GDPR Consent for ‘marketing’ is true

Data privacy and the mParticle platform

Once enabled and configured, data privacy work with the mParticle platform to ingest and pass on consent state:

• Define categories of data collection called consent purposes.
• Store the consent state in a user’s profile.
• Control data flow based on stored consent.
• Send user consent state to your integrations (outputs).

Enabling data privacy controls

Data privacy controls save user consent decisions and applies them to data flows.

1. Enable GDPR and/or CCPA compliance features on your workspace from Workspace Settings > Workspace > Regulation.

2. For GDPR, create a set of purposes from Privacy > Privacy Settings in the dashboard.

3. For CCPA, once it is enabled in your workspace, the purpose data_sale_opt_out is automatically created. The SDKs and mParticle UIs facilitate using this purpose, so you don’t need to hardcode it anywhere.

Consent properties

The mParticle format for a single record of a user decision on a privacy prompt, .consent, is our consent_state object. This is used for both GDPR-style opt-in consent and for CCPA-style opt-out.

For each user or workspace, consent state can be stored for each possible combination of regulation and purpose. For each purpose, the following fields are supported.

All fields are optional, except consented, timestamp_unixtime_ms, regulation and purpose. The regulation and purpose fields are built into the structure. Be sure to include your privacy and compliance experts when deciding how to implement optional fields.

Example consent state

Consent state can be logged via the HTTP API simply by including a consent state object in a batch, mirroring the structure of the user profile (above):

"consent_state": {
 "gdpr": {
   "location_collection": {
     "document": "location_collection_agreement.v43",
     "consented": true,
     "timestamp_unixtime_ms": 1523039002083,
     "location": "dtmgbank.com/signup",
     "hardware_id": "IDFA:a5d934n0-232f-4afc-2e9a-3832d95zc702"
   },
   "parental": {
     "document": "standard_parental_consent.v2",
     "consented": true,
     "timestamp_unixtime_ms": 1523039002083,
     "location": "dtmgbank.com/signup",
     "hardware_id": "IDFA:a5d934n0-232f-4afc-2e9a-3832d95zc702"
   }
 },
 "ccpa":{
   "data_sale_opt_out":{
     "consented": true,
     "timestamp_unixtime_ms": 1579198790480
   }
 }
}

Collecting consent state

For detailed definitions of how to report consent state, please see our SDK and API specific developer documentation:

• Web SDK
• iOS SDK
• Android SDK
• AMP SDK
• HTTP API

Using consent state

User profiles

Consent state is maintained per person on the User Profile using the structure defined above.

For testing consent, you can use User Activity View to check that a consent was recorded correctly. Here is an example of how CCPA data sale opt-out will appear:

Audiences

Consent state can be used to create conditions in the Audience Builder to check a users’ consent state as a requirement for audience inclusion or exclusion.

For example, for CCPA you may want to include only users who have NOT opted out of data sale, by adding a criteria like this:

For GDPR, you may want to include only users that have an opt-in consent for a given purpose, shown here as ‘Advertising’:

Connections and forwarding rules

Consent state can be used to create forwarding rules that selectively filter data based on a users consent state, in real time and per-person.

For example, you can choose to only forward data from users who have given consent for a particular purpose.

For CCPA, you may want a forwarding rule to apply a data sale opt-out. In this example, users’ who have a consent state of true for the CCPA purpose of data_sale_opt_out will NOT have their data forwarded (if the consent state is missing or false for that purpose, data will flow):

For GDPR, you may want a forwarding rule to only send data when a single purpose is consented:

Kits and forwarding rules

If you set up a Forwarding Rule for an embedded kit integration, the iOS and Android SDKs will check consent status for the user on initialization. If the rule condition fails, the kit will not be initialized. Note that kits are only initialized when a session begins or on user change, so if consent status changes in the course of a session, while mParticle will immediately stop forwarding data to the kit, it is possible that an embedded kit may remain active and independently forwarding data to a partner from the client until the session ends.

Forwarding consent state to partners

When the consent state of a profile changes, that change can be communicated to mParticle event integrations. If the consent_state object on an incoming event batch contains changes from the existing profile, mParticle adds a ‘system notification’ to the batch for each consent state change before the batch is sent to incoming forwarders. This notification contains the full old and new consent state objects:

"system_notifications": [
 {
   "data": {
     "purpose": "location_collection",
     "current": {
       "regulation": "GDPR",
       "document": "location_collection_agreement_v4",
       "consented": false,
       "timestamp_unixtime_ms": 1523045332033,
       "location": "17 Cherry Tree Lane",
       "hardware_id": "IDFA:a5d934n0-232f-4afc-2e9a-3832d95zc702"
     },
     "old": {
       "regulation": "GDPR",
       "document": "location_collection_agreement_v4",
       "consented": true,
       "timestamp_unixtime_ms": 1523039002083,
       "location": "17 Cherry Tree Lane",
       "hardware_id": "IDFA:a5d934n0-232f-4afc-2e9a-3832d95zc702"
     }
   },
   "type": "gdpr_change"
 }
]

There are currently two ways that consent state changes are forwarded to mParticle event integrations:

1. Some partners accept raw event batch data from mParticle, mostly for data storage or custom analytics use cases. For these partners, mParticle will forward the ‘system_notifications’ object with each relevant event batch. Forwarding of system notifications can be turned off with a user setting. Integrations that can currently receive the system notifications object include:

   • Amazon Kinesis
   • Amazon S3
   • Amazon SNS
   • Amazon SQS
   • Google Pub/Sub
   • Google Cloud Storage
   • Microsoft Azure Event Hubs
   • Slack
   • Webhook

2. mParticle is working with other partners to support forwarding consent state changes as a Custom Event. These events contain the new consent state information as custom attributes, a custom event type of "Consent", and an event name of "Consent Given" or "Consent Rejected". These consent events are forwarded to supporting partners as standard custom events.

   {
    "data": {
      "event_name": "Consent Given",
      "custom_event_type": "Consent",
      "custom_attributes": {
        "consented": "true",
        "document": "location_collection_agreement_v4",
        "hardware_id": "IDFA:a5d934n0-232f-4afc-2e9a-3832d95zc702",
        "purpose": "location_collection",
        "location": "17 Cherry Tree Lane",
        "regulation": "GDPR",
        "timestamp_unixtime_ms": 1523039002083
      },
      "event_type": "custom_event"
    }
   }

   Partners that currently accept these custom consent state events include:

   • Amplitude
   • Snowplow
   • Mixpanel
   • Google Analytics
   • Salesforce DMP

“GDPR Consent Change” is listed as a data type in the Integrations directory and we will update this list as more partners add support. Please reach out to your success manager if you would like to distribute consent to an additional partner.

Data subject requests

mParticle helps you respond to data subject requests as mandated by the GDPR and CCPA regulations.

You can search for integrations that support data subject requests in the Integrations page. Search on category Data Subject Request.

Ingest GPC signals

The California Consumer Protection Act (CCPA) and the upcoming CPRA (California Privacy Rights Act) require that users can signal their privacy choices. In support of that requirement, you can ingest Global Privacy Control (GPC) signals with mParticle.

Browsers append the GPC signal to HTTP requests and make it queryable via the DOM. This signal is designed to convey a person’s request to websites and services to not sell or share their personal information with third parties, per the Global Privacy Control specification. This opt-out is at the browser level, allowing users to turn on the GPC signal for all or specific websites.

The workflow for ingesting and forwarding GPC signals via SDK or Events API:

Sample code for GPC

This sample code show two options: mapping to a GDPR purpose and mapping to a user attribute.

/*
 First, grab the GPC signal. "true" indicates the user has signaled an opt-out
 See here for more details on querying the GPC signal:
 https://globalprivacycontrol.github.io/gpc-spec/
*/
var gpcSignal = navigator.globalPrivacyControl;


/*
 Option 1:
 In this example, the GPC signal is mapped to a "targeting_collection" GDPR purpose.
 This is only an example, you determine the GDPR purposes and how GPC maps to them.
 You can do the same mapping to CPPA.
*/
var targeting_consent = mParticle.Consent.createGDPRConsent(
   !gpcSignal, // note that this is inverted
   Date.now(), // Timestamp
   "browser_gpc_signal", // Document
   "17 Cherry Tree Lane", // Location
   "browser-id:a5d934n0-232f-4afc-2e9a-3832d95zc702" // Hardware ID
);


// Add to your consent state
var consentState = mParticle.Consent.createConsentState();
consentState.addGDPRConsentState("targeting_collection", targeting_consent);
var user = mParticle.Identity.getCurrentUser();
user.setConsentState(consentState);


/*
 Option 2:
 In this example, the GPC signal is mapped to a user attribute
*/
var user = mParticle.Identity.getCurrentUser();
user.setUserAttribute("gpc_signal", gpcSignal);