prebid.js 7.51.0 → 7.53.0

package/src/activities/redactor.js

@@ -0,0 +1,157 @@
+import {deepAccess} from '../utils.js';
+import {isActivityAllowed} from './rules.js';
+import {ACTIVITY_TRANSMIT_EIDS, ACTIVITY_TRANSMIT_PRECISE_GEO, ACTIVITY_TRANSMIT_UFPD} from './activities.js';
+
+export const ORTB_UFPD_PATHS = ['user.data', 'user.ext.data'];
+export const ORTB_EIDS_PATHS = ['user.eids', 'user.ext.eids'];
+export const ORTB_GEO_PATHS = ['user.geo.lat', 'user.geo.lon', 'device.geo.lat', 'device.geo.lon'];
+
+/**
+ * @typedef TransformationRuleDef
+ * @property {name}
+ * @property {Array[string]} paths dot-separated list of paths that this rule applies to.
+ * @property {function(*): boolean} applies a predicate that should return true if this rule applies
+ * (and the transformation defined herein should be applied). The arguments are those passed to the transformation function.
+ * @property {name} a name for the rule; used to debounce calls to `applies` (and avoid excessive logging):
+ * if a rule with the same name was already found to apply (or not), this one will (or won't) as well.
+ */
+
+/**
+ * @typedef RedactRuleDef A rule that removes, or replaces, values from an object (modifications are done in-place).
+ * @augments TransformationRuleDef
+ * @property {function(*): *} get? substitution functions for values that should be redacted;
+ *  takes in the original (unredacted) value as an input, and returns a substitute to use in the redacted
+ *  version. If it returns undefined, or this option is omitted, protected paths will be removed
+ *  from the redacted object.
+ */
+
+/**
+ * @param {RedactRuleDef} ruleDef
+ * @return {TransformationRule}
+ */
+export function redactRule(ruleDef) {
+  return Object.assign({
+    get() {},
+    run(root, path, object, property, applies) {
+      const val = object && object[property];
+      if (isData(val) && applies()) {
+        const repl = this.get(val);
+        if (repl === undefined) {
+          delete object[property];
+        } else {
+          object[property] = repl;
+        }
+      }
+    }
+  }, ruleDef)
+}
+
+/**
+ * @typedef TransformationRule
+ * @augments TransformationRuleDef
+ * @property {function} run rule logic - see `redactRule` for an example.
+ */
+
+/**
+ * @typedef {Function} TransformationFunction
+ * @param object object to transform
+ * @param ...args arguments to pass down to rule's `apply` methods.
+ */
+
+/**
+ * Return a transformation function that will apply the given rules to an object.
+ *
+ * @param {Array[TransformationRule]} rules
+ * @return {TransformationFunction}
+ */
+export function objectTransformer(rules) {
+  rules.forEach(rule => {
+    rule.paths = rule.paths.map((path) => {
+      const parts = path.split('.');
+      const tail = parts.pop();
+      return [parts.length > 0 ? parts.join('.') : null, tail]
+    })
+  })
+  return function applyTransform(session, obj, ...args) {
+    const result = [];
+    rules.forEach(rule => {
+      if (session[rule.name] === false) return;
+      for (const [head, tail] of rule.paths) {
+        const parent = head == null ? obj : deepAccess(obj, head);
+        result.push(rule.run(obj, head, parent, tail, () => {
+          if (!session.hasOwnProperty(rule.name)) {
+            session[rule.name] = !!rule.applies(...args);
+          }
+          return session[rule.name]
+        }))
+        if (session[rule.name] === false) return;
+      }
+    })
+    return result.filter(el => el != null);
+  }
+}
+
+export function isData(val) {
+  return val != null && (typeof val !== 'object' || Object.keys(val).length > 0)
+}
+
+export function appliesWhenActivityDenied(activity, isAllowed = isActivityAllowed) {
+  return function applies(params) {
+    return !isAllowed(activity, params);
+  };
+}
+
+function bidRequestTransmitRules(isAllowed = isActivityAllowed) {
+  return [
+    {
+      name: ACTIVITY_TRANSMIT_EIDS,
+      paths: ['userId', 'userIdAsEids'],
+      applies: appliesWhenActivityDenied(ACTIVITY_TRANSMIT_EIDS, isAllowed),
+    }
+  ].map(redactRule)
+}
+
+export function ortb2TransmitRules(isAllowed = isActivityAllowed) {
+  return [
+    {
+      name: ACTIVITY_TRANSMIT_UFPD,
+      paths: ORTB_UFPD_PATHS,
+      applies: appliesWhenActivityDenied(ACTIVITY_TRANSMIT_UFPD, isAllowed),
+    },
+    {
+      name: ACTIVITY_TRANSMIT_EIDS,
+      paths: ORTB_EIDS_PATHS,
+      applies: appliesWhenActivityDenied(ACTIVITY_TRANSMIT_EIDS, isAllowed),
+    },
+    {
+      name: ACTIVITY_TRANSMIT_PRECISE_GEO,
+      paths: ORTB_GEO_PATHS,
+      applies: appliesWhenActivityDenied(ACTIVITY_TRANSMIT_PRECISE_GEO, isAllowed),
+      get(val) {
+        return Math.round((val + Number.EPSILON) * 100) / 100;
+      }
+    }
+  ].map(redactRule);
+}
+
+export function redactorFactory(isAllowed = isActivityAllowed) {
+  const redactOrtb2 = objectTransformer(ortb2TransmitRules(isAllowed));
+  const redactBidRequest = objectTransformer(bidRequestTransmitRules(isAllowed));
+  return function redactor(params) {
+    const session = {};
+    return {
+      ortb2(obj) { redactOrtb2(session, obj, params); return obj },
+      bidRequest(obj) { redactBidRequest(session, obj, params); return obj }
+    }
+  }
+}
+
+/**
+ * Returns an object that can redact other privacy-sensitive objects according
+ * to activity rules.
+ *
+ * @param {{}} params activity parameters to use for activity checks
+ * @return {{ortb2: function({}): {}, bidRequest: function({}): {}}} methods
+ *  that can redact disallowed data from ORTB2 and/or bid request objects.
+ */
+export const redactor = redactorFactory();

package/src/activities/rules.js

@@ -0,0 +1,95 @@
+import {prefixLog} from '../utils.js';
+import {ACTIVITY_PARAM_COMPONENT} from './params.js';
+
+export function ruleRegistry(logger = prefixLog('Activity control:')) {
+  const registry = {};
+
+  function getRules(activity) {
+    return registry[activity] = registry[activity] || [];
+  }
+
+  function runRule(activity, name, rule, params) {
+    let res;
+    try {
+      res = rule(params);
+    } catch (e) {
+      logger.logError(`Exception in rule ${name} for '${activity}'`, e);
+      res = {allow: false, reason: e};
+    }
+    return res && Object.assign({activity, name, component: params[ACTIVITY_PARAM_COMPONENT]}, res);
+  }
+
+  const dupes = {};
+  const DEDUPE_INTERVAL = 1000;
+
+  function logResult({activity, name, allow, reason, component}) {
+    const msg = `${name} ${allow ? 'allowed' : 'denied'} '${activity}' for '${component}'${reason ? ':' : ''}`;
+    const deduping = dupes.hasOwnProperty(msg);
+    if (deduping) {
+      clearTimeout(dupes[msg]);
+    }
+    dupes[msg] = setTimeout(() => delete dupes[msg], DEDUPE_INTERVAL);
+    if (!deduping) {
+      const parts = [msg];
+      reason && parts.push(reason);
+      (allow ? logger.logInfo : logger.logWarn).apply(logger, parts);
+    }
+  }
+
+  return [
+    /**
+     * Register an activity control rule.
+     *
+     * @param {string} activity activity name - set is defined in `activities.js`
+     * @param {string} ruleName a name for this rule; used for logging.
+     * @param {function({}): {allow: boolean, reason?: string}} rule definition function. Takes in activity
+     *        parameters as a single map; MAY return an object {allow, reason}, where allow is true/false,
+     *        and reason is an optional message used for logging.
+     *
+     *        {allow: true} will allow this activity AS LONG AS no other rules with same or higher priority return {allow: false};
+     *        {allow: false} will deny this activity AS LONG AS no other rules with higher priority return {allow: true};
+     *        returning null/undefined has no effect - the decision is left to other rules.
+     *        If no rule returns an allow value, the default is to allow the activity.
+     *
+     * @param {number} priority rule priority; lower number means higher priority
+     * @returns {function(void): void} a function that unregisters the rule when called.
+     */
+    function registerActivityControl(activity, ruleName, rule, priority = 10) {
+      const rules = getRules(activity);
+      const pos = rules.findIndex(([itemPriority]) => priority < itemPriority);
+      const entry = [priority, ruleName, rule];
+      rules.splice(pos < 0 ? rules.length : pos, 0, entry);
+      return function () {
+        const idx = rules.indexOf(entry);
+        if (idx >= 0) rules.splice(idx, 1);
+      }
+    },
+    /**
+     * Test whether an activity is allowed.
+     *
+     * @param {string} activity activity name
+     * @param {{}} params activity parameters; should be generated through the `activityParams` utility.
+     * @return {boolean} true for allow, false for deny.
+     */
+    function isActivityAllowed(activity, params) {
+      let lastPriority, foundAllow;
+      for (const [priority, name, rule] of getRules(activity)) {
+        if (lastPriority !== priority && foundAllow) break;
+        lastPriority = priority;
+        const ruleResult = runRule(activity, name, rule, params);
+        if (ruleResult) {
+          if (!ruleResult.allow) {
+            logResult(ruleResult);
+            return false;
+          } else {
+            foundAllow = ruleResult;
+          }
+        }
+      }
+      foundAllow && logResult(foundAllow);
+      return true;
+    }
+  ];
+}
+
+export const [registerActivityControl, isActivityAllowed] = ruleRegistry();

package/src/adapterManager.js

@@ -31,18 +31,28 @@ import {hook} from './hook.js';
 import {find, includes} from './polyfill.js';
 import {adunitCounter} from './adUnits.js';
 import {getRefererInfo} from './refererDetection.js';
-import {GdprConsentHandler, UspConsentHandler, GppConsentHandler, GDPR_GVLIDS} from './consentHandler.js';
+import {GDPR_GVLIDS, GdprConsentHandler, GppConsentHandler, UspConsentHandler} from './consentHandler.js';
 import * as events from './events.js';
 import CONSTANTS from './constants.json';
 import {useMetrics} from './utils/perfMetrics.js';
 import {auctionManager} from './auctionManager.js';
-import {MODULE_TYPE_ANALYTICS, MODULE_TYPE_BIDDER} from './activities/modules.js';
+import {MODULE_TYPE_ANALYTICS, MODULE_TYPE_BIDDER, MODULE_TYPE_PREBID} from './activities/modules.js';
+import {isActivityAllowed} from './activities/rules.js';
+import {ACTIVITY_FETCH_BIDS, ACTIVITY_REPORT_ANALYTICS} from './activities/activities.js';
+import {ACTIVITY_PARAM_ANL_CONFIG, ACTIVITY_PARAM_S2S_NAME, activityParamsBuilder} from './activities/params.js';
+import {redactor} from './activities/redactor.js';
 
+const PBS_ADAPTER_NAME = 'pbsBidAdapter';
 export const PARTITIONS = {
   CLIENT: 'client',
   SERVER: 'server'
 }
 
+export const dep = {
+  isAllowed: isActivityAllowed,
+  redact: redactor
+}
+
 let adapterManager = {};
 
 let _bidderRegistry = adapterManager.bidderRegistry = {};
@@ -57,6 +67,8 @@ config.getConfig('s2sConfig', config => {
 
 var _analyticsRegistry = {};
 
+const activityParams = activityParamsBuilder((alias) => adapterManager.resolveAlias(alias));
+
 /**
  * @typedef {object} LabelDescriptor
  * @property {boolean} labelAll describes whether or not this object expects all labels to match, or any label to match
@@ -139,7 +151,7 @@ function getAdUnitCopyForPrebidServer(adUnits, s2sConfig) {
 
   adUnitsCopy.forEach((adUnit) => {
     // filter out client side bids
-    const s2sBids = adUnit.bids.filter((b) => b.module === 'pbsBidAdapter' && b.params?.configName === s2sConfig.configName);
+    const s2sBids = adUnit.bids.filter((b) => b.module === PBS_ADAPTER_NAME && b.params?.configName === s2sConfig.configName);
     if (s2sBids.length === 1) {
       adUnit.s2sBid = s2sBids[0];
       hasModuleBids = true;
@@ -237,6 +249,10 @@ adapterManager.makeBidRequests = hook('sync', function (adUnits, auctionStart, a
   if (FEATURES.NATIVE) {
     decorateAdUnitsWithNativeParams(adUnits);
   }
+
+  // filter out bidders that cannot participate in the auction
+  adUnits.forEach(au => au.bids = au.bids.filter((bid) => !bid.bidder || dep.isAllowed(ACTIVITY_FETCH_BIDS, activityParams(MODULE_TYPE_BIDDER, bid.bidder))))
+
   adUnits = setupAdUnitMediaTypes(adUnits, labels);
 
   let {[PARTITIONS.CLIENT]: clientBidders, [PARTITIONS.SERVER]: serverBidders} = partitionBidders(adUnits, _s2sConfigs);
@@ -252,14 +268,24 @@ adapterManager.makeBidRequests = hook('sync', function (adUnits, auctionStart, a
   const bidderOrtb2 = ortb2Fragments.bidder || {};
 
   function addOrtb2(bidderRequest) {
-    const fpd = Object.freeze(mergeDeep({}, ortb2, bidderOrtb2[bidderRequest.bidderCode]));
+    const redact = dep.redact(activityParams(MODULE_TYPE_BIDDER, bidderRequest.bidderCode));
+    const fpd = Object.freeze(redact.ortb2(mergeDeep({}, ortb2, bidderOrtb2[bidderRequest.bidderCode])));
     bidderRequest.ortb2 = fpd;
-    bidderRequest.bids.forEach((bid) => bid.ortb2 = fpd);
+    bidderRequest.bids = bidderRequest.bids.map((bid) => {
+      bid.ortb2 = fpd;
+      return redact.bidRequest(bid);
+    })
     return bidderRequest;
   }
 
+  function isS2SAllowed(s2sConfig) {
+    return dep.isAllowed(ACTIVITY_FETCH_BIDS, activityParams(MODULE_TYPE_PREBID, PBS_ADAPTER_NAME, {
+      [ACTIVITY_PARAM_S2S_NAME]: s2sConfig.configName
+    }));
+  }
+
   _s2sConfigs.forEach(s2sConfig => {
-    if (s2sConfig && s2sConfig.enabled) {
+    if (s2sConfig && s2sConfig.enabled && isS2SAllowed(s2sConfig)) {
       let {adUnits: adUnitsS2SCopy, hasModuleBids} = getAdUnitCopyForPrebidServer(adUnits, s2sConfig);
 
       // uniquePbsTid is so we know which server to send which bids to during the callBids function
@@ -338,7 +364,6 @@ adapterManager.makeBidRequests = hook('sync', function (adUnits, auctionStart, a
       bidRequest['gppConsent'] = gppDataHandler.getConsentData();
     }
   });
-
   return bidRequests;
 }, 'makeBidRequests');
 
@@ -529,6 +554,16 @@ adapterManager.aliasBidAdapter = function (bidderCode, alias, options) {
   }
 };
 
+adapterManager.resolveAlias = function (alias) {
+  let code = alias;
+  let visited;
+  while (_aliasRegistry[code] && (!visited || !visited.has(code))) {
+    code = _aliasRegistry[code];
+    (visited = visited || new Set()).add(code);
+  }
+  return code;
+}
+
 adapterManager.registerAnalyticsAdapter = function ({adapter, code, gvlid}) {
   if (adapter && code) {
     if (typeof adapter.enableAnalytics === 'function') {
@@ -552,7 +587,9 @@ adapterManager.enableAnalytics = function (config) {
   _each(config, adapterConfig => {
     const entry = _analyticsRegistry[adapterConfig.provider];
     if (entry && entry.adapter) {
-      entry.adapter.enableAnalytics(adapterConfig);
+      if (dep.isAllowed(ACTIVITY_REPORT_ANALYTICS, activityParams(MODULE_TYPE_ANALYTICS, adapterConfig.provider, {[ACTIVITY_PARAM_ANL_CONFIG]: adapterConfig}))) {
+        entry.adapter.enableAnalytics(adapterConfig);
+      }
     } else {
       logError(`Prebid Error: no analytics adapter found in registry for '${adapterConfig.provider}'.`);
     }

package/src/adloader.js

@@ -23,6 +23,7 @@ const _approvedLoadExternalJSList = [
   'aaxBlockmeter',
   'confiant',
   'arcspan',
+  'airgrid',
   'clean.io'
 ]
 

package/src/fpd/rootDomain.js

@@ -1,7 +1,7 @@
 import {memoize, timestamp} from '../utils.js';
 import {getCoreStorageManager} from '../storageManager.js';
 
-export const coreStorage = getCoreStorageManager();
+export const coreStorage = getCoreStorageManager('fpdEnrichment');
 
 /**
  * Find the root domain by testing for the topmost domain that will allow setting cookies.

package/src/prebid.js

@@ -1004,7 +1004,7 @@ if (FEATURES.VIDEO) {
     const bids = fetchReceivedBids(markBidRequest, 'Improper use of markWinningBidAsUsed. It needs an adUnitCode or an adId to function.');
 
     if (bids.length > 0) {
-      bids[0].status = CONSTANTS.BID_STATUS.RENDERED;
+      auctionManager.addWinningBid(bids[0]);
     }
   }
 }

package/src/storageManager.js

@@ -1,7 +1,17 @@
-import {hook} from './hook.js';
-import {checkCookieSupport, hasDeviceAccess, logError, logInfo} from './utils.js';
-import {bidderSettings as defaultBidderSettings} from './bidderSettings.js';
-import {MODULE_TYPE_BIDDER, MODULE_TYPE_CORE} from './activities/modules.js';
+import {checkCookieSupport, hasDeviceAccess, logError} from './utils.js';
+import {bidderSettings} from './bidderSettings.js';
+import {MODULE_TYPE_BIDDER, MODULE_TYPE_PREBID} from './activities/modules.js';
+import {isActivityAllowed, registerActivityControl} from './activities/rules.js';
+import {
+  ACTIVITY_PARAM_ADAPTER_CODE,
+  ACTIVITY_PARAM_COMPONENT_TYPE,
+  ACTIVITY_PARAM_STORAGE_TYPE
+} from './activities/params.js';
+
+import {ACTIVITY_ACCESS_DEVICE} from './activities/activities.js';
+import {config} from './config.js';
+import adapterManager from './adapterManager.js';
+import {activityParams} from './activities/activityParams.js';
 
 export const STORAGE_TYPE_LOCALSTORAGE = 'html5';
 export const STORAGE_TYPE_COOKIES = 'cookie';
@@ -11,40 +21,19 @@ export let storageCallbacks = [];
 /*
  *  Storage manager constructor. Consumers should prefer one of `getStorageManager` or `getCoreStorageManager`.
  */
-export function newStorageManager({moduleName, moduleType} = {}, {bidderSettings = defaultBidderSettings} = {}) {
-  function isBidderAllowed(storageType) {
-    if (moduleType !== MODULE_TYPE_BIDDER) {
-      return true;
-    }
-    const storageAllowed = bidderSettings.get(moduleName, 'storageAllowed');
-    if (!storageAllowed || storageAllowed === true) return !!storageAllowed;
-    if (Array.isArray(storageAllowed)) return storageAllowed.some((e) => e === storageType);
-    return storageAllowed === storageType;
-  }
-
+export function newStorageManager({moduleName, moduleType} = {}, {isAllowed = isActivityAllowed} = {}) {
   function isValid(cb, storageType) {
-    if (!isBidderAllowed(storageType)) {
-      logInfo(`bidderSettings denied access to device storage for bidder '${moduleName}'`);
-      const result = {valid: false};
-      return cb(result);
-    } else {
-      let value;
-      let hookDetails = {
-        hasEnforcementHook: false
-      }
-      validateStorageEnforcement(moduleType, moduleName, hookDetails, function(result) {
-        if (result && result.hasEnforcementHook) {
-          value = cb(result);
-        } else {
-          let result = {
-            hasEnforcementHook: false,
-            valid: hasDeviceAccess()
-          }
-          value = cb(result);
-        }
-      });
-      return value;
+    let mod = moduleName;
+    const curBidder = config.getCurrentBidder();
+    if (curBidder && moduleType === MODULE_TYPE_BIDDER && adapterManager.aliasRegistry[curBidder] === moduleName) {
+      mod = curBidder;
     }
+    const result = {
+      valid: isAllowed(ACTIVITY_ACCESS_DEVICE, activityParams(moduleType, mod, {
+        [ACTIVITY_PARAM_STORAGE_TYPE]: storageType
+      }))
+    };
+    return cb(result);
   }
 
   function schedule(operation, storageType, done) {
@@ -228,13 +217,6 @@ export function newStorageManager({moduleName, moduleType} = {}, {bidderSettings
   }
 }
 
-/**
- * This hook validates the storage enforcement if gdprEnforcement module is included
- */
-export const validateStorageEnforcement = hook('async', function(moduleType, moduleName, hookDetails, callback) {
-  callback(hookDetails);
-}, 'validateStorageEnforcement');
-
 /**
  * Get a storage manager for a particular module.
  *
@@ -262,9 +244,40 @@ export function getStorageManager({moduleType, moduleName, bidderCode} = {}) {
  * @param {string} moduleName Module name
  */
 export function getCoreStorageManager(moduleName) {
-  return newStorageManager({moduleName: moduleName, moduleType: MODULE_TYPE_CORE});
+  return newStorageManager({moduleName: moduleName, moduleType: MODULE_TYPE_PREBID});
 }
 
+/**
+ * Block all access to storage when deviceAccess = false
+ */
+export function deviceAccessRule() {
+  if (!hasDeviceAccess()) {
+    return {allow: false}
+  }
+}
+registerActivityControl(ACTIVITY_ACCESS_DEVICE, 'deviceAccess config', deviceAccessRule);
+
+/**
+ * By default, deny bidders accessDevice unless they enable it through bidderSettings
+ *
+ * // TODO: for backwards compat, the check is done on the adapter - rather than bidder's code.
+ */
+export function storageAllowedRule(params, bs = bidderSettings) {
+  if (params[ACTIVITY_PARAM_COMPONENT_TYPE] !== MODULE_TYPE_BIDDER) return;
+  let allow = bs.get(params[ACTIVITY_PARAM_ADAPTER_CODE], 'storageAllowed');
+  if (!allow || allow === true) {
+    allow = !!allow
+  } else {
+    const storageType = params[ACTIVITY_PARAM_STORAGE_TYPE];
+    allow = Array.isArray(allow) ? allow.some((e) => e === storageType) : allow === storageType;
+  }
+  if (!allow) {
+    return {allow};
+  }
+}
+
+registerActivityControl(ACTIVITY_ACCESS_DEVICE, 'bidderSettings.*.storageAllowed', storageAllowedRule);
+
 export function resetData() {
   storageCallbacks = [];
 }

package/src/userSync.js

@@ -5,6 +5,15 @@ import {
 import { config } from './config.js';
 import {includes} from './polyfill.js';
 import { getCoreStorageManager } from './storageManager.js';
+import {isActivityAllowed, registerActivityControl} from './activities/rules.js';
+import {ACTIVITY_SYNC_USER} from './activities/activities.js';
+import {
+  ACTIVITY_PARAM_COMPONENT_NAME,
+  ACTIVITY_PARAM_COMPONENT_TYPE,
+  ACTIVITY_PARAM_SYNC_TYPE, ACTIVITY_PARAM_SYNC_URL
+} from './activities/params.js';
+import {MODULE_TYPE_BIDDER} from './activities/modules.js';
+import {activityParams} from './activities/activityParams.js';
 
 export const USERSYNC_DEFAULT_CONFIG = {
   syncEnabled: true,
@@ -29,10 +38,10 @@ const storage = getCoreStorageManager('usersync');
 /**
  * Factory function which creates a new UserSyncPool.
  *
- * @param {UserSyncDependencies} userSyncDependencies Configuration options and dependencies which the
+ * @param {} deps Configuration options and dependencies which the
  *   UserSync object needs in order to behave properly.
  */
-export function newUserSync(userSyncDependencies) {
+export function newUserSync(deps) {
   let publicApi = {};
   // A queue of user syncs for each adapter
   // Let getDefaultQueue() set the defaults
@@ -50,7 +59,7 @@ export function newUserSync(userSyncDependencies) {
   };
 
   // Use what is in config by default
-  let usConfig = userSyncDependencies.config;
+  let usConfig = deps.config;
   // Update if it's (re)set
   config.getConfig('userSync', (conf) => {
     // Added this logic for https://github.com/prebid/Prebid.js/issues/4864
@@ -70,6 +79,19 @@ export function newUserSync(userSyncDependencies) {
     usConfig = Object.assign(usConfig, conf.userSync);
   });
 
+  deps.regRule(ACTIVITY_SYNC_USER, 'userSync config', (params) => {
+    if (!usConfig.syncEnabled) {
+      return {allow: false, reason: 'syncs are disabled'}
+    }
+    if (params[ACTIVITY_PARAM_COMPONENT_TYPE] === MODULE_TYPE_BIDDER) {
+      const syncType = params[ACTIVITY_PARAM_SYNC_TYPE];
+      const bidder = params[ACTIVITY_PARAM_COMPONENT_NAME];
+      if (!publicApi.canBidderRegisterSync(syncType, bidder)) {
+        return {allow: false, reason: `${syncType} syncs are not enabled for ${bidder}`}
+      }
+    }
+  });
+
   /**
    * @function getDefaultQueue
    * @summary Returns the default empty queue
@@ -89,7 +111,7 @@ export function newUserSync(userSyncDependencies) {
    * @private
    */
   function fireSyncs() {
-    if (!usConfig.syncEnabled || !userSyncDependencies.browserSupportsCookies) {
+    if (!usConfig.syncEnabled || !deps.browserSupportsCookies) {
       return;
     }
 
@@ -199,14 +221,14 @@ export function newUserSync(userSyncDependencies) {
       return logWarn(`Number of user syncs exceeded for "${bidder}"`);
     }
 
-    const canBidderRegisterSync = publicApi.canBidderRegisterSync(type, bidder);
-    if (!canBidderRegisterSync) {
-      return logWarn(`Bidder "${bidder}" not permitted to register their "${type}" userSync pixels.`);
+    if (deps.isAllowed(ACTIVITY_SYNC_USER, activityParams(MODULE_TYPE_BIDDER, bidder, {
+      [ACTIVITY_PARAM_SYNC_TYPE]: type,
+      [ACTIVITY_PARAM_SYNC_URL]: url
+    }))) {
+      // the bidder's pixel has passed all checks and is allowed to register
+      queue[type].push([bidder, url]);
+      numAdapterBids = incrementAdapterBids(numAdapterBids, bidder);
     }
-
-    // the bidder's pixel has passed all checks and is allowed to register
-    queue[type].push([bidder, url]);
-    numAdapterBids = incrementAdapterBids(numAdapterBids, bidder);
   };
 
   /**
@@ -320,6 +342,8 @@ export function newUserSync(userSyncDependencies) {
 
 export const userSync = newUserSync(Object.defineProperties({
   config: config.getConfig('userSync'),
+  isAllowed: isActivityAllowed,
+  regRule: registerActivityControl,
 }, {
   browserSupportsCookies: {
     get: function() {
@@ -329,13 +353,6 @@ export const userSync = newUserSync(Object.defineProperties({
   }
 }));
 
-/**
- * @typedef {Object} UserSyncDependencies
- *
- * @property {UserSyncConfig} config
- * @property {boolean} browserSupportsCookies True if the current browser supports cookies, and false otherwise.
- */
-
 /**
  * @typedef {Object} UserSyncConfig
  *