TCF legitimate interest fields

CHANGELOG.md

@@ -17,6 +17,9 @@ The types of changes are:
 
 ## [Unreleased](https://github.com/ethyca/fides/compare/2.19.0...main)
 
+### Added
+- TCF modal now supports setting legitimate interest fields [#4037](https://github.com/ethyca/fides/pull/4037)
+
 ## [2.19.0](https://github.com/ethyca/fides/compare/2.18.0...2.19.0)
 
 ### Added

clients/fides-js/src/components/tcf/TcfOverlay.tsx

@@ -136,6 +136,18 @@ const createTcfSavePayload = ({
   }) as TCFVendorSave[],
 });
 
+const updateCookie = async (
+  oldCookie: FidesCookie,
+  tcf: TcfSavePreferences,
+  experience: PrivacyExperience
+) => {
+  const tcString = await generateTcString({
+    tcStringPreferences: tcf,
+    experience,
+  });
+  return { ...oldCookie, tcString };
+};
+
 const TcfOverlay: FunctionComponent<OverlayProps> = ({
   fidesRegionString,
   experience,
@@ -177,14 +189,6 @@ const TcfOverlay: FunctionComponent<OverlayProps> = ({
     [draftIds]
   );
 
-  const updateCookie = async (
-    oldCookie: FidesCookie,
-    tcf: TcfSavePreferences
-  ) => {
-    const tcString = await generateTcString(tcf);
-    return { ...oldCookie, tcString };
-  };
-
   const handleUpdateAllPreferences = useCallback(
     (enabledIds: EnabledIds) => {
       const tcf = createTcfSavePayload({ experience, enabledIds });
@@ -198,7 +202,7 @@ const TcfOverlay: FunctionComponent<OverlayProps> = ({
         debug: options.debug,
         servedNotices: null, // TODO: served notices
         tcf,
-        updateCookie: (oldCookie) => updateCookie(oldCookie, tcf),
+        updateCookie: (oldCookie) => updateCookie(oldCookie, tcf, experience),
       });
       setDraftIds(enabledIds);
     },

clients/fides-js/src/fides-tcf.ts

@@ -64,7 +64,11 @@ import {
 } from "./lib/initialize";
 import type { Fides } from "./lib/initialize";
 import { dispatchFidesEvent } from "./lib/events";
-import { FidesCookie, hasSavedTcfPreferences, isNewFidesCookie } from "./fides";
+import {
+  FidesCookie,
+  hasNoSavedTcfPreferences,
+  isNewFidesCookie,
+} from "./fides";
 import { renderOverlay } from "./lib/tcf/renderOverlay";
 import { TCFPurposeRecord, TcfSavePreferences } from "./lib/tcf/types";
 
@@ -100,11 +104,11 @@ const updateCookie = async (
   experience: PrivacyExperience
 ) => {
   // First check if the user has never consented before
-  if (!hasSavedTcfPreferences(experience)) {
+  if (!hasNoSavedTcfPreferences(experience)) {
     return { ...oldCookie, tcString: "" };
   }
 
-  const tcSavePrefs: TcfSavePreferences = {
+  const tcStringPreferences: TcfSavePreferences = {
     purpose_preferences: experience.tcf_purposes?.map((purpose) => ({
       id: purpose.id,
       preference: getInitialPreference(purpose),
@@ -129,9 +133,13 @@ const updateCookie = async (
       id: vendor.id,
       preference: getInitialPreference(vendor),
     })),
+    system_preferences: experience.tcf_systems?.map((system) => ({
+      id: system.id,
+      preference: getInitialPreference(system),
+    })),
   };
 
-  const tcString = await generateTcString(tcSavePrefs);
+  const tcString = await generateTcString({ tcStringPreferences, experience });
   return { ...oldCookie, tcString };
 };
 

clients/fides-js/src/lib/consent-utils.ts

@@ -197,22 +197,40 @@ const hasCurrentPreference = (
   return records.some((record) => record.current_preference);
 };
 
+const hasActionNeededTcfPreference = (
+  records: Pick<TCFPurposeRecord, "current_preference">[] | undefined
+) => {
+  if (!records || records.length === 0) {
+    return false;
+  }
+  return records.some((record) => record.current_preference == null);
+};
+
 /**
  * Returns true if the user has any saved TCF preferences
  */
-export const hasSavedTcfPreferences = (experience: PrivacyExperience) =>
+export const hasNoSavedTcfPreferences = (experience: PrivacyExperience) =>
   hasCurrentPreference(experience.tcf_purposes) ||
   hasCurrentPreference(experience.tcf_special_purposes) ||
   hasCurrentPreference(experience.tcf_features) ||
   hasCurrentPreference(experience.tcf_special_features) ||
-  hasCurrentPreference(experience.tcf_vendors);
+  hasCurrentPreference(experience.tcf_vendors) ||
+  hasCurrentPreference(experience.tcf_systems);
+
+export const hasActionNeededTcfPreferences = (experience: PrivacyExperience) =>
+  hasActionNeededTcfPreference(experience.tcf_purposes) ||
+  hasActionNeededTcfPreference(experience.tcf_special_purposes) ||
+  hasActionNeededTcfPreference(experience.tcf_features) ||
+  hasActionNeededTcfPreference(experience.tcf_special_features) ||
+  hasActionNeededTcfPreference(experience.tcf_vendors) ||
+  hasActionNeededTcfPreference(experience.tcf_systems);
 
 /**
  * Returns true if there are notices in the experience that require a user preference
  */
 export const hasActionNeededNotices = (experience: PrivacyExperience) => {
   if (experience.component === ComponentType.TCF_OVERLAY) {
-    return !hasSavedTcfPreferences(experience);
+    return hasActionNeededTcfPreferences(experience);
   }
   return Boolean(
     experience?.privacy_notices?.some(

clients/fides-js/src/lib/tcf.ts

@@ -15,19 +15,48 @@ import {
 import { makeStub } from "./tcf/stub";
 import { transformUserPreferenceToBoolean } from "./consent-utils";
 import gvlJson from "./tcf/gvl.json";
-import { TcfSavePreferences } from "./tcf/types";
+import {
+  LegalBasisForProcessingEnum,
+  TCFPurposeRecord,
+  TcfSavePreferences,
+} from "./tcf/types";
 import { vendorIsGvl } from "./tcf/vendors";
+import { PrivacyExperience } from "./consent-types";
 
 const CMP_ID = 12; // TODO: hardcode our unique CMP ID after certification
 const CMP_VERSION = 1;
+const FORBIDDEN_LEGITIMATE_INTEREST_PURPOSE_IDS = [1, 3, 4, 5, 6];
+
+const purposeHasLegalBasis = ({
+  id,
+  purposes,
+  legalBasis,
+}: {
+  id: number;
+  purposes: TCFPurposeRecord[] | undefined;
+  legalBasis: LegalBasisForProcessingEnum;
+}) => {
+  if (!purposes) {
+    return false;
+  }
+  const purpose = purposes.filter((p) => p.id === id)[0];
+  if (!purpose) {
+    return false;
+  }
+  return purpose.legal_bases?.includes(legalBasis);
+};
 
 /**
  * Generate TC String based on TCF-related info from privacy experience.
  * Called when there is either a FidesInitialized or FidesUpdated event
  */
-export const generateTcString = async (
-  tcStringPreferences?: TcfSavePreferences
-): Promise<string> => {
+export const generateTcString = async ({
+  experience,
+  tcStringPreferences,
+}: {
+  tcStringPreferences?: TcfSavePreferences;
+  experience: PrivacyExperience;
+}): Promise<string> => {
   // Creates a new TC string based on an old GVL version
   // (https://vendor-list.consensu.org/v2/archives/vendor-list-v1.json)
   // due to TCF library not yet supporting latest GVL (https://vendor-list.consensu.org/v3/vendor-list.json).
@@ -45,7 +74,6 @@ export const generateTcString = async (
   tcModel.consentScreen = 1; // todo- On which 'screen' consent was captured; this is a CMP proprietary number encoded into the TC string
 
   if (tcStringPreferences) {
-    // todo- when we set vendorLegitimateInterests, make sure we never set purposes 1, 3, 4, 5 and 6
     if (
       tcStringPreferences.vendor_preferences &&
       tcStringPreferences.vendor_preferences.length > 0
@@ -56,6 +84,31 @@ export const generateTcString = async (
         );
         if (consented && vendorIsGvl(vendorPreference)) {
           tcModel.vendorConsents.set(+vendorPreference.id);
+          const thisVendor = experience.tcf_vendors?.filter(
+            (v) => v.id === vendorPreference.id
+          )[0];
+          const vendorPurposes = thisVendor?.purposes;
+          // Handle the case where a vendor has forbidden legint purposes set
+          let skipSetLegInt = false;
+          if (vendorPurposes) {
+            const legIntPurposeIds = vendorPurposes
+              .filter((p) =>
+                p.legal_bases?.includes(
+                  LegalBasisForProcessingEnum.LEGITIMATE_INTERESTS
+                )
+              )
+              .map((p) => p.id);
+            if (
+              legIntPurposeIds.filter((id) =>
+                FORBIDDEN_LEGITIMATE_INTEREST_PURPOSE_IDS.includes(id)
+              ).length
+            ) {
+              skipSetLegInt = true;
+            }
+          }
+          if (!skipSetLegInt) {
+            tcModel.vendorLegitimateInterests.set(+vendorPreference.id);
+          }
         }
       });
     }
@@ -70,7 +123,27 @@ export const generateTcString = async (
           purposePreference.preference
         );
         if (consented) {
-          tcModel.purposeConsents.set(+purposePreference.id);
+          const id = +purposePreference.id;
+          if (
+            purposeHasLegalBasis({
+              id,
+              purposes: experience.tcf_purposes,
+              legalBasis: LegalBasisForProcessingEnum.CONSENT,
+            })
+          ) {
+            tcModel.purposeConsents.set(id);
+          }
+          if (
+            purposeHasLegalBasis({
+              id,
+              purposes: experience.tcf_purposes,
+              legalBasis: LegalBasisForProcessingEnum.LEGITIMATE_INTERESTS,
+            }) &&
+            // per the IAB, make sure we never set purposes 1, 3, 4, 5, or 6
+            !FORBIDDEN_LEGITIMATE_INTEREST_PURPOSE_IDS.includes(id)
+          ) {
+            tcModel.purposeLegitimateInterests.set(id);
+          }
         }
       });
     }