Share consents across devices

Introduction

The Didomi CMP supports syncing to allow consent sharing across devices and environments. Consent can be shared between all environments that have syncing enabled in the same organization: multiple websites, multiple apps (same or multiple devices), multiple websites and apps together, etc.

When syncing is enabled and an organization user ID is available, the Didomi CMP will load the previously stored user choices from the Consents API and will apply them locally.

Syncing is currently a premium feature. You can schedule a meeting with our Support team through the console to enable the feature for your account.

Configuration

Setting user organization ID

For the sync process to work properly, an User Organization Id property needs to be set before the Didomi initialization:

Didomi.getInstance().setUser("organization-user-id");

This value represents the unique identifier with which the organization identifies the user for which it wants to sync the consents. This can be an email address, a user ID, etc. We recommend hashing the value to not communicate plain user IDs to Didomi.

Note: This value is not stored in user data and should be set again at each session.

Which organization user ID to share with Didomi?

When the user is identified by the application through a login process or any other authentication method, a unique user ID should be shared with the Didomi SDK through the Didomi.setUser() method. The unique user ID can be any string but we recommend sending a hashed version of your internal user ID to not expose any sensitive data on the page or to Didomi. Avoid sharing plain email addresses, user names, etc. with Didomi.

The same unique user ID will need to be shared in other environments like mobile apps. If you are sending a hashed ID, make sure that you will be able to send exactly the same ID in from environments.

The user ID shared on the website will be used as the organization user ID in our Consents API. If you are accessing the user status or event from the API, you will need to specify the same user ID as what is shared on the website, including any form of anonymization or hashing method in place. The organization user ID must be consistent across your organization and all the other Didomi products you are using (APIs, Privacy Center, etc.).

Authentication with a hash digest

Using a hash digest does not guarantee the confidentiality of the user ID passed to Didomi as it is exposed in clear text on the page.

As the user ID is provided in a public environment (on a webpage), we need to authenticate it to guarantee that users cannot freely read and write consents for any user ID.

To authenticate the user ID and prove that it was authorized by the application, you will need to compute a hash digest of the user ID concatenated with a secret. This digest must be computed directly by your application in an authenticated context and not on the client-side. When it receives a request, Didomi will re-compute the digest with the secret and make sure that it matches the digest that you provided.

The hash digest should be provided in the digest parameter. You will also need to provide the ID of the secret and the hashing algorithm used for generating the hash digest.

Example:

Didomi.getInstance().setUser(new UserAuthWithHashParams(
            "organization-user-id",
            "algorithm",
            "secret_id",
            "digest"
));

Secrets

When computing a hash digest, a secret needs to be used. Secrets can be managed through the Didomi API to obtain an actual secret and its associated ID. Read our documentation to manage secrets for your organizations.

Hashing methods

Didomi supports the following methods for computing a digest:

Algorithm
ID
Description

Hash MD5

hash-md5

Hexadecimal digest computed with the MD5 algorithm

Hash SHA1

hash-sha1

Hexadecimal digest computed with the SHA1 algorithm

Hash SHA256

hash-sha256

Hexadecimal digest computed with the SHA256 algorithm

HMAC SHA1

hmac-sha1

Hexadecimal representation of a HMAC computed with the SHA1 algorithm

HMAC SHA256

hmac-sha256

Hexadecimal representation of a HMAC computed with the SHA256 algorithm

For all methods, the content to compute the digest on and the secret are the same. The method ID must be provided in the algorithm property.

Salting

For increased security, you can use a salt when computing the hash digest. You will need to provide the salt parameter in the configuration so that Didomi can use it when verifying the user ID.

Example:

Didomi.getInstance().setUser(new UserAuthWithHashParams(
            "organization-user-id",
            "algorithm",
            "secret_id",
            "digest",
            "salt"
));

Information expiration

The authentication methods guarantee the integrity of the information (i.e., the information originates from the client and cannot be modified by a third-party) but do not guarantee that that information cannot be reused.

To prevent reusing an encrypted user identifier, we support the addition of expiration information. You can mark the information as having an expiration date so that it cannot be used after a certain date using the expiration parameter. This should be a valid unix timestamp value.

Example:

Didomi.getInstance().setUser(new UserAuthWithHashParams(
            "organization-user-id",
            "algorithm",
            "secret_id",
            "digest",
            "salt", // or null
            10000L
));

The sync process can be enabled with async.enabled configuration option in the Didomi configuration:

{
    "app": {
        ...
    },
    "sync": {
        "enabled": true
    }
}

Behavior

Frequency

By default, the sync process will run once every day. The value in seconds for the sync process can be specified via the frequency configuration option.

{
    "app": {
        ...
    },
    "sync": {
        "enabled": true,
        "frequency": 86400
    }
}

Sync timeout

The maximum time allowed for the syncing process to be completed can be specified with a sync.timeout configuration option in the Didomi configuration:

{
    "app": {
        ...
    },
    "sync": {
        "enabled": true,
        "timeout": 2000
    }
}

The sync.timeout configuration option accepts an integer which represents the maximum time allowed (in milliseconds) for the syncing process to be completed.

If the syncing process takes more time to be completed than it is specified in sync.timeout configuration option, the initialization continues as if there was no data to sync.

Delaying notice showing

On Android and iOS, the delayNotice parameter is ignored. To avoid showing the notice before user is synchronized, the setUser method can be called before the SDK is initialized. In this case, consent synchronization will be performed as part of the initialization process.

It is also possible to call setupUI() only after user was synchronized. Alternatively, current Activity (Android) or ViewController (iOS) can be passed to the setUser method, so if sdk is already initialized, consent will be asked again if user consent is partial after synchronization.

Example:

Didomi.getInstance().setUser(userParams, activity);

Multi-account

After an organization user ID has been set, it is possible to change it or to "remove" it (forget this user ID). This will be interpreted as changing the currently active organization user, and will trigger a new synchronization.

  • If there was an already synchronized user, and the user changed, the existing consents are reset . If this user already gave consent using another device, these consents will be loaded. Otherwise, the user needs to give consent again.

  • When user should not be synchronized anymore, clearUser() should be called. When doing this, the Didomi user ID (UserStatus.userId) assigned to this user will be reset, but current consents will be kept. The call will also trigger a consentChanged event. If you need to reset the consents as well, you can call the reset() method at the same time.

  • By providing the optional parameter activity (Android) / containerController (iOS) to the setUser method, if the sdk is already initialized, setupUI will be automatically called after synchronization is done. So if synchronized user changes and consent is partial for the new user, consent notice will be displayed automatically.

Troubleshooting

  • Android Developers, make sure the device is supporting the selected encryption method. For more information, see the Android documentation.

PreviousThird-party SDKsNextShare consent with WebViews

Last updated