prebid.js 7.50.0 → 7.52.0

package/modules/userId/index.js

@@ -110,6 +110,7 @@
  * @property {SubmoduleConfig} config
  * @property {(Object|undefined)} idObj - cache decoded id value (this is copied to every adUnit bid)
  * @property {(function|undefined)} callback - holds reference to submodule.getId() result if it returned a function. Will be set to undefined after callback executes
+ * @property {StorageManager} storageMgr
  */
 
 /**
@@ -133,7 +134,12 @@ import adapterManager, {gdprDataHandler} from '../../src/adapterManager.js';
 import CONSTANTS from '../../src/constants.json';
 import {hook, module, ready as hooksReady} from '../../src/hook.js';
 import {buildEidPermissions, createEidsArray, USER_IDS_CONFIG} from './eids.js';
-import {getCoreStorageManager, STORAGE_TYPE_COOKIES, STORAGE_TYPE_LOCALSTORAGE} from '../../src/storageManager.js';
+import {
+  getCoreStorageManager,
+  getStorageManager,
+  STORAGE_TYPE_COOKIES,
+  STORAGE_TYPE_LOCALSTORAGE
+} from '../../src/storageManager.js';
 import {
   cyrb53Hash,
   deepAccess,
@@ -159,6 +165,9 @@ import {newMetrics, timedAuctionHook, useMetrics} from '../../src/utils/perfMetr
 import {findRootDomain} from '../../src/fpd/rootDomain.js';
 import {GDPR_GVLIDS} from '../../src/consentHandler.js';
 import {MODULE_TYPE_UID} from '../../src/activities/modules.js';
+import {isActivityAllowed} from '../../src/activities/rules.js';
+import {ACTIVITY_ENRICH_EIDS} from '../../src/activities/activities.js';
+import {activityParams} from '../../src/activities/activityParams.js';
 
 const MODULE_NAME = 'User ID';
 const COOKIE = STORAGE_TYPE_COOKIES;
@@ -170,7 +179,10 @@ const CONSENT_DATA_COOKIE_STORAGE_CONFIG = {
   expires: 30 // 30 days expiration, which should match how often consent is refreshed by CMPs
 };
 export const PBJS_USER_ID_OPTOUT_NAME = '_pbjs_id_optout';
-export const coreStorage = getCoreStorageManager('userid');
+export const coreStorage = getCoreStorageManager('userId');
+export const dep = {
+  isAllowed: isActivityAllowed
+}
 
 /** @type {boolean} */
 let addedUserIdHook = false;
@@ -220,11 +232,12 @@ export function setSubmoduleRegistry(submodules) {
   submoduleRegistry = submodules;
 }
 
-function cookieSetter(submodule) {
+function cookieSetter(submodule, storageMgr) {
+  storageMgr = storageMgr || submodule.storageMgr;
   const domainOverride = (typeof submodule.submodule.domainOverride === 'function') ? submodule.submodule.domainOverride() : null;
   const name = submodule.config.storage.name;
   return function setCookie(suffix, value, expiration) {
-    coreStorage.setCookie(name + (suffix || ''), value, expiration, 'Lax', domainOverride);
+    storageMgr.setCookie(name + (suffix || ''), value, expiration, 'Lax', domainOverride);
   }
 }
 
@@ -237,6 +250,7 @@ export function setStoredValue(submodule, value) {
    * @type {SubmoduleStorage}
    */
   const storage = submodule.config.storage;
+  const mgr = submodule.storageMgr;
 
   try {
     const expiresStr = (new Date(Date.now() + (storage.expires * (60 * 60 * 24 * 1000)))).toUTCString();
@@ -248,10 +262,10 @@ export function setStoredValue(submodule, value) {
         setCookie('_last', new Date().toUTCString(), expiresStr);
       }
     } else if (storage.type === LOCAL_STORAGE) {
-      coreStorage.setDataInLocalStorage(`${storage.name}_exp`, expiresStr);
-      coreStorage.setDataInLocalStorage(storage.name, encodeURIComponent(valueStr));
+      mgr.setDataInLocalStorage(`${storage.name}_exp`, expiresStr);
+      mgr.setDataInLocalStorage(storage.name, encodeURIComponent(valueStr));
       if (typeof storage.refreshInSeconds === 'number') {
-        coreStorage.setDataInLocalStorage(`${storage.name}_last`, new Date().toUTCString());
+        mgr.setDataInLocalStorage(`${storage.name}_last`, new Date().toUTCString());
       }
     }
   } catch (error) {
@@ -263,7 +277,7 @@ export function deleteStoredValue(submodule) {
   let deleter, suffixes;
   switch (submodule.config?.storage?.type) {
     case COOKIE:
-      const setCookie = cookieSetter(submodule);
+      const setCookie = cookieSetter(submodule, coreStorage);
       const expiry = (new Date(Date.now() - 1000 * 60 * 60 * 24)).toUTCString();
       deleter = (suffix) => setCookie(suffix, '', expiry)
       suffixes = ['', '_last'];
@@ -292,25 +306,26 @@ function setPrebidServerEidPermissions(initializedSubmodules) {
 }
 
 /**
-/**
- * @param {SubmoduleStorage} storage
+ * @param {SubmoduleContainer} submodule
  * @param {String|undefined} key optional key of the value
  * @returns {string}
  */
-function getStoredValue(storage, key = undefined) {
+function getStoredValue(submodule, key = undefined) {
+  const mgr = submodule.storageMgr;
+  const storage = submodule.config.storage;
   const storedKey = key ? `${storage.name}_${key}` : storage.name;
   let storedValue;
   try {
     if (storage.type === COOKIE) {
-      storedValue = coreStorage.getCookie(storedKey);
+      storedValue = mgr.getCookie(storedKey);
     } else if (storage.type === LOCAL_STORAGE) {
-      const storedValueExp = coreStorage.getDataFromLocalStorage(`${storage.name}_exp`);
+      const storedValueExp = mgr.getDataFromLocalStorage(`${storage.name}_exp`);
       // empty string means no expiration set
       if (storedValueExp === '') {
-        storedValue = coreStorage.getDataFromLocalStorage(storedKey);
+        storedValue = mgr.getDataFromLocalStorage(storedKey);
       } else if (storedValueExp) {
         if ((new Date(storedValueExp)).getTime() - Date.now() > 0) {
-          storedValue = decodeURIComponent(coreStorage.getDataFromLocalStorage(storedKey));
+          storedValue = decodeURIComponent(mgr.getDataFromLocalStorage(storedKey));
         }
       }
     }
@@ -415,7 +430,7 @@ function processSubmoduleCallbacks(submodules, cb) {
       moduleDone();
     }
     try {
-      submodule.callback(callbackCompleted, getStoredValue.bind(null, submodule.config?.storage));
+      submodule.callback(callbackCompleted, getStoredValue.bind(null, submodule));
     } catch (e) {
       logError(`Error in userID module '${submodule.submodule.name}':`, e);
       moduleDone();
@@ -773,6 +788,8 @@ function getUserIdsAsync() {
  * This hook returns updated list of submodules which are allowed to do get user id based on TCF 2 enforcement rules configured
  */
 export const validateGdprEnforcement = hook('sync', function (submodules, consentData) {
+  // TODO: remove the `hasValidated` check in v8. Enforcement should be OFF by default.
+  // https://github.com/prebid/Prebid.js/issues/9766
   return { userIdModules: submodules, hasValidated: consentData && consentData.hasValidated };
 }, 'validateGdprEnforcement');
 
@@ -781,12 +798,12 @@ function populateSubmoduleId(submodule, consentData, storedConsentData, forceRef
   // 1. storage: retrieve user id data from cookie/html storage or with the submodule's getId method
   // 2. value: pass directly to bids
   if (submodule.config.storage) {
-    let storedId = getStoredValue(submodule.config.storage);
+    let storedId = getStoredValue(submodule);
     let response;
 
     let refreshNeeded = false;
     if (typeof submodule.config.storage.refreshInSeconds === 'number') {
-      const storedDate = new Date(getStoredValue(submodule.config.storage, 'last'));
+      const storedDate = new Date(getStoredValue(submodule, 'last'));
       refreshNeeded = storedDate && (Date.now() - storedDate.getTime() > submodule.config.storage.refreshInSeconds * 1000);
     }
 
@@ -849,17 +866,23 @@ function initSubmodules(dest, submodules, consentData, forceRefresh = false) {
   return uidMetrics().fork().measureTime('userId.init.modules', function () {
     if (!submodules.length) return []; // to simplify log messages from here on
 
-    // filter out submodules whose storage type is not enabled
-    // this needs to be done here (after consent data has loaded) so that enforcement may disable storage globally
-    const storageTypes = getActiveStorageTypes();
-    submodules = submodules.filter((submod) => !submod.config.storage || storageTypes.has(submod.config.storage.type));
+    /**
+     * filter out submodules that:
+     *
+     *  - cannot use the storage they've been set up with (storage not available / not allowed / disabled)
+     *  - are not allowed to perform the `enrichEids` activity
+     */
+    submodules = submodules.filter((submod) => {
+      return (!submod.config.storage || canUseStorage(submod)) &&
+        dep.isAllowed(ACTIVITY_ENRICH_EIDS, activityParams(MODULE_TYPE_UID, submod.config.name));
+    });
 
     if (!submodules.length) {
-      logWarn(`${MODULE_NAME} - no ID module is configured for one of the available storage types:`, Array.from(storageTypes));
+      logWarn(`${MODULE_NAME} - no ID module configured`);
       return [];
     }
 
-    // another consent check, this time each module is checked for consent with its own gvlid
+    // TODO: remove this check in v8 (https://github.com/prebid/Prebid.js/issues/9766)
     let { userIdModules, hasValidated } = validateGdprEnforcement(submodules, consentData);
     if (!hasValidated && !hasPurpose1Consent(consentData)) {
       logWarn(`${MODULE_NAME} - gdpr permission not valid for local storage or cookies, exit module`);
@@ -940,24 +963,28 @@ function getValidSubmoduleConfigs(configRegistry, submoduleRegistry) {
 
 const ALL_STORAGE_TYPES = new Set([LOCAL_STORAGE, COOKIE]);
 
-function getActiveStorageTypes() {
-  const storageTypes = [];
-  let disabled = false;
-  if (coreStorage.localStorageIsEnabled()) {
-    storageTypes.push(LOCAL_STORAGE);
-    if (coreStorage.getDataFromLocalStorage(PBJS_USER_ID_OPTOUT_NAME)) {
-      logInfo(`${MODULE_NAME} - opt-out localStorage found, storage disabled`);
-      disabled = true;
-    }
-  }
-  if (coreStorage.cookiesAreEnabled()) {
-    storageTypes.push(COOKIE);
-    if (coreStorage.getCookie(PBJS_USER_ID_OPTOUT_NAME)) {
-      logInfo(`${MODULE_NAME} - opt-out cookie found, storage disabled`);
-      disabled = true;
-    }
+function canUseStorage(submodule) {
+  switch (submodule.config?.storage?.type) {
+    case LOCAL_STORAGE:
+      if (submodule.storageMgr.localStorageIsEnabled()) {
+        if (coreStorage.getDataFromLocalStorage(PBJS_USER_ID_OPTOUT_NAME)) {
+          logInfo(`${MODULE_NAME} - opt-out localStorage found, storage disabled`);
+          return false
+        }
+        return true;
+      }
+      break;
+    case COOKIE:
+      if (submodule.storageMgr.cookiesAreEnabled()) {
+        if (coreStorage.getCookie(PBJS_USER_ID_OPTOUT_NAME)) {
+          logInfo(`${MODULE_NAME} - opt-out cookie found, storage disabled`);
+          return false;
+        }
+        return true
+      }
+      break;
   }
-  return new Set(disabled ? [] : storageTypes)
+  return false;
 }
 
 /**
@@ -985,6 +1012,7 @@ function updateSubmodules() {
       config: submoduleConfig,
       callback: undefined,
       idObj: undefined,
+      storageMgr: getStorageManager({moduleType: MODULE_TYPE_UID, moduleName: submoduleConfig.name}),
     } : null;
   }).filter(submodule => submodule !== null)
     .forEach((sm) => submodules.push(sm));

package/modules/yahoosspBidAdapter.js

@@ -101,6 +101,37 @@ function extractUserSyncUrls(syncOptions, pixels) {
   return userSyncObjects;
 }
 
+/**
+ * @param {string} url
+ * @param {object} consentData
+ * @param {object} consentData.gpp
+ * @param {string} consentData.gpp.gppConsent
+ * @param {array} consentData.gpp.applicableSections
+ * @param {object} consentData.gdpr
+ * @param {object} consentData.gdpr.consentString
+ * @param {object} consentData.gdpr.gdprApplies
+ * @param {string} consentData.uspConsent
+ */
+function updateConsentQueryParams(url, consentData) {
+  const parameterMap = {
+    'gdpr_consent': consentData.gdpr.consentString,
+    'gdpr': consentData.gdpr.gdprApplies ? '1' : '0',
+    'us_privacy': consentData.uspConsent,
+    'gpp': consentData.gpp.gppString,
+    'gpp_sid': consentData.gpp.applicableSections ? consentData.gpp.applicableSections.join(',') : ''
+  }
+
+  const existingUrl = new URL(url);
+  const params = existingUrl.searchParams;
+
+  for (const [key, value] of Object.entries(parameterMap)) {
+    params.set(key, value);
+  }
+
+  existingUrl.search = params.toString();
+  return existingUrl.toString();
+};
+
 function getSupportedEids(bid) {
   if (isArray(deepAccess(bid, 'userIdAsEids'))) {
     return bid.userIdAsEids.filter(eid => {
@@ -244,7 +275,9 @@ function generateOpenRtbObject(bidderRequest, bid) {
       regs: {
         ext: {
           'us_privacy': bidderRequest.uspConsent ? bidderRequest.uspConsent : '',
-          gdpr: bidderRequest.gdprConsent && bidderRequest.gdprConsent.gdprApplies ? 1 : 0
+          gdpr: bidderRequest.gdprConsent && bidderRequest.gdprConsent.gdprApplies ? 1 : 0,
+          gpp: bidderRequest.gppConsent.gppString,
+          gpp_sid: bidderRequest.gppConsent.applicableSections
         }
       },
       source: {
@@ -518,6 +551,7 @@ function createRenderer(bidderRequest, bidResponse) {
   }
   return renderer;
 }
+
 /* Utility functions */
 
 export const spec = {
@@ -634,11 +668,19 @@ export const spec = {
     return response;
   },
 
-  getUserSyncs: function(syncOptions, serverResponses, gdprConsent, uspConsent) {
+  getUserSyncs: function(syncOptions, serverResponses, gdprConsent, uspConsent, gppConsent) {
     const bidResponse = !isEmpty(serverResponses) && serverResponses[0].body;
 
     if (bidResponse && bidResponse.ext && bidResponse.ext.pixels) {
-      return extractUserSyncUrls(syncOptions, bidResponse.ext.pixels);
+      const userSyncObjects = extractUserSyncUrls(syncOptions, bidResponse.ext.pixels);
+      userSyncObjects.forEach(userSyncObject => {
+        userSyncObject.url = updateConsentQueryParams(userSyncObject.url, {
+          gpp: gppConsent,
+          gdpr: gdprConsent,
+          uspConsent: uspConsent
+        });
+      });
+      return userSyncObjects;
     }
 
     return [];

package/modules/yahoosspBidAdapter.md

@@ -827,6 +827,6 @@ const adUnits = [{
 This adapter does not support passing legacy overrides via 'bidder.params.ext' since most of the data should be passed using prebid modules (First Party Data, Schain, Price Floors etc.).
 If you do not know how to pass a custom parameter that you previously used, please contact us using the information provided above.
 
-Thanks you,
+Thank you,
 Yahoo SSP
 

package/modules/zeta_global_sspBidAdapter.js

@@ -36,6 +36,7 @@ const VIDEO_CUSTOM_PARAMS = {
   'battr': DATA_TYPES.ARRAY,
   'linearity': DATA_TYPES.NUMBER,
   'placement': DATA_TYPES.NUMBER,
+  'plcmt': DATA_TYPES.NUMBER,
   'minbitrate': DATA_TYPES.NUMBER,
   'maxbitrate': DATA_TYPES.NUMBER,
   'skip': DATA_TYPES.NUMBER

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prebid.js",
-  "version": "7.50.0",
+  "version": "7.52.0",
   "description": "Header Bidding Management Library",
   "main": "src/prebid.js",
   "scripts": {

package/src/activities/activities.js

@@ -0,0 +1,47 @@
+/**
+ * Activity (that are relevant for privacy) definitions
+ *
+ * ref. https://docs.google.com/document/d/1dRxFUFmhh2jGanzGZvfkK_6jtHPpHXWD7Qsi6KEugeE
+ * & https://github.com/prebid/Prebid.js/issues/9546
+ */
+
+/**
+ * accessDevice: some component wants to read or write to localStorage or cookies.
+ */
+export const ACTIVITY_ACCESS_DEVICE = 'accessDevice';
+/**
+ * syncUser: A bid adapter wants to run a user sync.
+ */
+export const ACTIVITY_SYNC_USER = 'syncUser';
+/**
+ * enrichUfpd: some component wants to add user first-party data to bid requests.
+ */
+export const ACTIVITY_ENRICH_UFPD = 'enrichUfpd';
+/**
+ * enrichEids: some component wants to add user IDs to bid requests.
+ */
+export const ACTIVITY_ENRICH_EIDS = 'enrichEids';
+/**
+ * fetchBid: a bidder wants to bid.
+ */
+export const ACTIVITY_FETCH_BIDS = 'fetchBids';
+
+/**
+ * reportAnalytics: some component wants to phone home with analytics data.
+ */
+export const ACTIVITY_REPORT_ANALYTICS = 'reportAnalytics';
+
+/**
+ * some component wants access to (and send along) user IDs
+ */
+export const ACTIVITY_TRANSMIT_EIDS = 'transmitEids'
+
+/**
+ * transmitUfpd: some component wants access to (and send along) user FPD
+ */
+export const ACTIVITY_TRANSMIT_UFPD = 'transmitUfpd';
+
+/**
+ * transmitPreciseGeo: some component wants access to (and send along) geolocation info
+ */
+export const ACTIVITY_TRANSMIT_PRECISE_GEO = 'transmitPreciseGeo';

package/src/activities/activityParams.js

@@ -0,0 +1,8 @@
+import adapterManager from '../adapterManager.js';
+import {activityParamsBuilder} from './params.js';
+
+/**
+ * Utility function for building common activity parameters - broken out to its own
+ * file to avoid circular imports.
+ */
+export const activityParams = activityParamsBuilder((alias) => adapterManager.resolveAlias(alias));

package/src/activities/modules.js

@@ -1,4 +1,4 @@
-export const MODULE_TYPE_CORE = 'core';
+export const MODULE_TYPE_PREBID = 'prebid';
 export const MODULE_TYPE_BIDDER = 'bidder';
 export const MODULE_TYPE_UID = 'userId';
 export const MODULE_TYPE_RTD = 'rtd';

package/src/activities/params.js

@@ -0,0 +1,59 @@
+import {MODULE_TYPE_BIDDER} from './modules.js';
+
+/**
+ * Component ID - who is trying to perform the activity?
+ * Relevant for all activities.
+ */
+export const ACTIVITY_PARAM_COMPONENT = 'component';
+export const ACTIVITY_PARAM_COMPONENT_TYPE = ACTIVITY_PARAM_COMPONENT + 'Type';
+export const ACTIVITY_PARAM_COMPONENT_NAME = ACTIVITY_PARAM_COMPONENT + 'Name';
+
+/**
+ * Code of the bid adapter that `componentName` is an alias of.
+ * May be the same as the component name.
+ *
+ * relevant for all activities, but only when componentType is 'bidder'.
+ */
+export const ACTIVITY_PARAM_ADAPTER_CODE = 'adapterCode';
+
+/**
+ * Storage type - either 'html5' or 'cookie'.
+ * Relevant for: accessDevice
+ */
+export const ACTIVITY_PARAM_STORAGE_TYPE = 'storageType';
+
+/**
+ * s2sConfig[].configName, used to identify a particular s2s instance
+ * relevant for: fetchBids, but only when component is 'prebid.pbsBidAdapter'
+ */
+export const ACTIVITY_PARAM_S2S_NAME = 'configName';
+/**
+ * user sync type - 'iframe' or 'pixel'
+ * relevant for: syncUser
+ */
+export const ACTIVITY_PARAM_SYNC_TYPE = 'syncType'
+/**
+ * user sync URL
+ * relevant for: syncUser
+ */
+export const ACTIVITY_PARAM_SYNC_URL = 'syncUrl';
+/**
+ * @private
+ * configuration options for analytics adapter - the argument passed to `enableAnalytics`.
+ * relevant for: reportAnalytics
+ */
+export const ACTIVITY_PARAM_ANL_CONFIG = '_config';
+
+export function activityParamsBuilder(resolveAlias) {
+  return function activityParams(moduleType, moduleName, params) {
+    const defaults = {
+      [ACTIVITY_PARAM_COMPONENT_TYPE]: moduleType,
+      [ACTIVITY_PARAM_COMPONENT_NAME]: moduleName,
+      [ACTIVITY_PARAM_COMPONENT]: `${moduleType}.${moduleName}`
+    };
+    if (moduleType === MODULE_TYPE_BIDDER) {
+      defaults[ACTIVITY_PARAM_ADAPTER_CODE] = resolveAlias(moduleName);
+    }
+    return Object.assign(defaults, params);
+  }
+}

package/src/activities/redactor.js

@@ -0,0 +1,157 @@
+import {deepAccess} from '../utils.js';
+import {isActivityAllowed} from './rules.js';
+import {ACTIVITY_TRANSMIT_EIDS, ACTIVITY_TRANSMIT_PRECISE_GEO, ACTIVITY_TRANSMIT_UFPD} from './activities.js';
+
+export const ORTB_UFPD_PATHS = ['user.data', 'user.ext.data'];
+export const ORTB_EIDS_PATHS = ['user.eids', 'user.ext.eids'];
+export const ORTB_GEO_PATHS = ['user.geo.lat', 'user.geo.lon', 'device.geo.lat', 'device.geo.lon'];
+
+/**
+ * @typedef TransformationRuleDef
+ * @property {name}
+ * @property {Array[string]} paths dot-separated list of paths that this rule applies to.
+ * @property {function(*): boolean} applies a predicate that should return true if this rule applies
+ * (and the transformation defined herein should be applied). The arguments are those passed to the transformation function.
+ * @property {name} a name for the rule; used to debounce calls to `applies` (and avoid excessive logging):
+ * if a rule with the same name was already found to apply (or not), this one will (or won't) as well.
+ */
+
+/**
+ * @typedef RedactRuleDef A rule that removes, or replaces, values from an object (modifications are done in-place).
+ * @augments TransformationRuleDef
+ * @property {function(*): *} get? substitution functions for values that should be redacted;
+ *  takes in the original (unredacted) value as an input, and returns a substitute to use in the redacted
+ *  version. If it returns undefined, or this option is omitted, protected paths will be removed
+ *  from the redacted object.
+ */
+
+/**
+ * @param {RedactRuleDef} ruleDef
+ * @return {TransformationRule}
+ */
+export function redactRule(ruleDef) {
+  return Object.assign({
+    get() {},
+    run(root, path, object, property, applies) {
+      const val = object && object[property];
+      if (isData(val) && applies()) {
+        const repl = this.get(val);
+        if (repl === undefined) {
+          delete object[property];
+        } else {
+          object[property] = repl;
+        }
+      }
+    }
+  }, ruleDef)
+}
+
+/**
+ * @typedef TransformationRule
+ * @augments TransformationRuleDef
+ * @property {function} run rule logic - see `redactRule` for an example.
+ */
+
+/**
+ * @typedef {Function} TransformationFunction
+ * @param object object to transform
+ * @param ...args arguments to pass down to rule's `apply` methods.
+ */
+
+/**
+ * Return a transformation function that will apply the given rules to an object.
+ *
+ * @param {Array[TransformationRule]} rules
+ * @return {TransformationFunction}
+ */
+export function objectTransformer(rules) {
+  rules.forEach(rule => {
+    rule.paths = rule.paths.map((path) => {
+      const parts = path.split('.');
+      const tail = parts.pop();
+      return [parts.length > 0 ? parts.join('.') : null, tail]
+    })
+  })
+  return function applyTransform(session, obj, ...args) {
+    const result = [];
+    rules.forEach(rule => {
+      if (session[rule.name] === false) return;
+      for (const [head, tail] of rule.paths) {
+        const parent = head == null ? obj : deepAccess(obj, head);
+        result.push(rule.run(obj, head, parent, tail, () => {
+          if (!session.hasOwnProperty(rule.name)) {
+            session[rule.name] = !!rule.applies(...args);
+          }
+          return session[rule.name]
+        }))
+        if (session[rule.name] === false) return;
+      }
+    })
+    return result.filter(el => el != null);
+  }
+}
+
+export function isData(val) {
+  return val != null && (typeof val !== 'object' || Object.keys(val).length > 0)
+}
+
+export function appliesWhenActivityDenied(activity, isAllowed = isActivityAllowed) {
+  return function applies(params) {
+    return !isAllowed(activity, params);
+  };
+}
+
+function bidRequestTransmitRules(isAllowed = isActivityAllowed) {
+  return [
+    {
+      name: ACTIVITY_TRANSMIT_EIDS,
+      paths: ['userId', 'userIdAsEids'],
+      applies: appliesWhenActivityDenied(ACTIVITY_TRANSMIT_EIDS, isAllowed),
+    }
+  ].map(redactRule)
+}
+
+export function ortb2TransmitRules(isAllowed = isActivityAllowed) {
+  return [
+    {
+      name: ACTIVITY_TRANSMIT_UFPD,
+      paths: ORTB_UFPD_PATHS,
+      applies: appliesWhenActivityDenied(ACTIVITY_TRANSMIT_UFPD, isAllowed),
+    },
+    {
+      name: ACTIVITY_TRANSMIT_EIDS,
+      paths: ORTB_EIDS_PATHS,
+      applies: appliesWhenActivityDenied(ACTIVITY_TRANSMIT_EIDS, isAllowed),
+    },
+    {
+      name: ACTIVITY_TRANSMIT_PRECISE_GEO,
+      paths: ORTB_GEO_PATHS,
+      applies: appliesWhenActivityDenied(ACTIVITY_TRANSMIT_PRECISE_GEO, isAllowed),
+      get(val) {
+        return Math.round((val + Number.EPSILON) * 100) / 100;
+      }
+    }
+  ].map(redactRule);
+}
+
+export function redactorFactory(isAllowed = isActivityAllowed) {
+  const redactOrtb2 = objectTransformer(ortb2TransmitRules(isAllowed));
+  const redactBidRequest = objectTransformer(bidRequestTransmitRules(isAllowed));
+  return function redactor(params) {
+    const session = {};
+    return {
+      ortb2(obj) { redactOrtb2(session, obj, params); return obj },
+      bidRequest(obj) { redactBidRequest(session, obj, params); return obj }
+    }
+  }
+}
+
+/**
+ * Returns an object that can redact other privacy-sensitive objects according
+ * to activity rules.
+ *
+ * @param {{}} params activity parameters to use for activity checks
+ * @return {{ortb2: function({}): {}, bidRequest: function({}): {}}} methods
+ *  that can redact disallowed data from ORTB2 and/or bid request objects.
+ */
+export const redactor = redactorFactory();