Share consents across devices
The Didomi CMP supports syncing to allow consent sharing across devices and environments. Consent can be shared between all environments that have syncing enabled in the same organization: multiple websites, multiple apps (same or multiple devices), multiple websites and apps together, etc.
When syncing is enabled and an organization user ID is available, the Didomi CMP will load the previously stored user choices from the Consents API and will apply them locally.
Syncing is currently a premium feature. You can schedule a meeting with our Support team through the console to enable the feature for your account.
Please note that the cross-device feature operates exclusively with GDPR consents.
For the sync process to work properly, an
User Organization Id
property needs to be set before the Didomi initialization:Java
Kotlin
Swift
Objective-C
Flutter (Dart)
React-Native (Javascript)
Unity (C#)
Didomi.getInstance().setUser("organization-user-id");
Didomi.getInstance().setUser("organization-user-id");
Didomi.shared.setUser(id: "organization-user-id")
Didomi *didomi = [Didomi shared];
[didomi setUserWithId:@"organization-user-id"];
await DidomiSdk.setUser("organization-user-id");
await Didomi.setUser("organization-user-id");
Didomi.setUser("organization-user-id");
This value represents the unique identifier with which the organization identifies the user for which it wants to sync the consents. This can be an email address, a user ID, etc. We recommend hashing the value to not communicate plain user IDs to Didomi.
Note: This value is not stored in user data and should be set again at each session.
When the user is identified by the application through a login process or any other authentication method, a unique user ID should be shared with the Didomi SDK through the
Didomi.setUser()
method.
The unique user ID can be any string but we recommend sending a hashed version of your internal user ID to not expose any sensitive data on the page or to Didomi. Avoid sharing plain email addresses, user names, etc. with Didomi.The same unique user ID will need to be shared in other environments like mobile apps. If you are sending a hashed ID, make sure that you will be able to send exactly the same ID in from environments.
The user ID shared on the website will be used as the organization user ID in our Consents API. If you are accessing the user status or event from the API, you will need to specify the same user ID as what is shared on the website, including any form of anonymization or hashing method in place.
The organization user ID must be consistent across your organization and all the other Didomi products you are using (APIs, Privacy Center, etc.).
Using a hash digest does not guarantee the confidentiality of the user ID passed to Didomi as it is exposed in clear text on the page.
As the user ID is provided in a public environment (on a webpage), we need to authenticate it to guarantee that users cannot freely read and write consents for any user ID.
To authenticate the user ID and prove that it was authorized by the application, you will need to compute a hash digest of the user ID concatenated with a secret. This digest must be computed directly by your application in an authenticated context and not on the client-side. When it receives a request, Didomi will re-compute the digest with the secret and make sure that it matches the digest that you provided.
The hash digest should be provided in the
digest
parameter. You will also need to provide the ID of the secret and the hashing algorithm used for generating the hash digest.Example:
Java
Kotlin
Swift
Objective-C
Flutter (Dart)
React-Native (Javascript)
Unity (C#)
Didomi.getInstance().setUser(new UserAuthWithHashParams(
"organization-user-id",
"algorithm",
"secret_id",
"digest"
));
Didomi.getInstance().setUser(UserAuthWithHashParams(
id = "organization-user-id",
algorithm = "algorithm",
secretId = "secret_id",
digest = "digest"
));
Didomi.shared.setUser(userAuthParams: UserAuthWithHashParams(
id: "organization-user-id",
algorithm: "algorithm",
secretID: "secret_id",
digest: "digest"
))
[didomi setUserWithUserAuthParams: [[UserAuthWithHashParams alloc]
initWithId:@"organization-user-id"
algorithm: @"algorithm"
secretID: @"secret-id"
digest: @"digest"
salt: NULL]];
await setUserWithAuthParams(new UserAuthWithHashParams(
"organization-user-id",
"algorithm",
"secret_id",
"digest"
));
await Didomi.setUserWithHashAuth(
"organization-user-id",
"algorithm",
"secret_id",
"digest"
);
Didomi.setUserWithHashParams(
"organization-user-id",
"algorithm",
"secret_id",
"digest"
);
When computing a hash digest, a secret needs to be used. Secrets can be managed through the Didomi API to obtain an actual secret and its associated ID. Read our documentation to manage secrets for your organizations.
Didomi supports the following methods for computing a digest:
Algorithm | ID | Description |
Hash MD5 | hash-md5 | Hexadecimal digest computed with the MD5 algorithm |
Hash SHA1 | hash-sha1 | Hexadecimal digest computed with the SHA1 algorithm |
Hash SHA256 | hash-sha256 | Hexadecimal digest computed with the SHA256 algorithm |
HMAC SHA1 | hmac-sha1 | Hexadecimal representation of a HMAC computed with the SHA1 algorithm |
HMAC SHA256 | hmac-sha256 | Hexadecimal representation of a HMAC computed with the SHA256 algorithm |
For all methods, the content to compute the digest on and the secret are the same. The method ID must be provided in the
algorithm
property.For increased security, you can use a salt when computing the hash digest. You will need to provide the
salt
parameter in the configuration so that Didomi can use it when verifying the user ID.Example:
Java
Kotlin
Swift
Objective-C
Flutter (Dart)
React-Native (Javascript)
Unity (C#)
Didomi.getInstance().setUser(new UserAuthWithHashParams(
"organization-user-id",
"algorithm",
"secret_id",
"digest",
"salt"
));
Didomi.getInstance().setUser(UserAuthWithHashParams(
id = "organization-user-id",
algorithm = "algorithm",
secretId = "secret_id",
digest = "digest",
salt = "salt"
));
Didomi.shared.setUser(userAuthParams: UserAuthWithHashParams(
id: "organization-user-id",
algorithm: "algorithm",
secretID: "secret_id",
digest: "digest",
salt: "salt"
))
[didomi setUserWithUserAuthParams: [[UserAuthWithHashParams alloc]
initWithId:@"organization-user-id"
algorithm: @"algorithm"
secretID: @"secret-id"
digest: @"digest"
salt: @"salt"]];
await setUserWithAuthParams(new UserAuthWithHashParams(
"organization-user-id",
"algorithm",
"secret_id",
"digest",
"salt"
));
await Didomi.setUserWithHashAuth(
"organization-user-id",
"algorithm",
"secret_id",
"digest",
"salt"
);
Didomi.setUserWithHashParams("organization-user-id",
"algorithm",
"secret_id",
"digest",
"salt");
The authentication methods guarantee the integrity of the information (i.e., the information originates from the client and cannot be modified by a third-party) but do not guarantee that that information cannot be reused.
To prevent reusing an encrypted user identifier, we support the addition of expiration information. You can mark the information as having an expiration date so that it cannot be used after a certain date using the
expiration
parameter. This should be a valid unix timestamp value.Example:
Java
Kotlin
Swift
Objective-C
Flutter (Dart)
React-Native (Javascript)
Unity (C#)
Didomi.getInstance().setUser(new UserAuthWithHashParams(
"organization-user-id",
"algorithm",
"secret_id",
"digest",
"salt", // or null
10000L
));
Didomi.getInstance().setUser(UserAuthWithHashParams(
id = "organization-user-id",
algorithm = "algorithm",
secretId = "secret_id",
digest = "digest",
salt = "salt", // or null
expiration = 10000L
))
Didomi.shared.setUser(userAuthParams: UserAuthWithHashParams(
id: "organization-user-id",
algorithm: "algorithm",
secretID: "secret_id",
digest: "digest",
salt: "salt", // or nil
expiration: 10000
))
[didomi setUserWithUserAuthParams: [[UserAuthWithHashParams alloc]
initWithId:@"organization-user-id"
algorithm: @"algorithm"
secretID: @"secret-id"
digest: @"digest"
salt: @"salt" // or null
legacyExpiration: 10000.0]];
await setUserWithAuthParams(new UserAuthWithHashParams(
"organization-user-id",
"algorithm",
"secret_id",
"digest",
"salt", // or null
10000
));
Didomi.setUserWithHashAuth(
"organization-user-id",
"algorithm",
"secret_id",
"digest",
"salt", // or null
10000
);
Didomi.setUserWithHashParamsWithExpiration("organization-user-id",
"algorithm",
"secret_id",
"digest",
"salt", // or null
10000);
The sync process can be enabled with a
sync.enabled
configuration option in the Didomi configuration:{
"app": {
...
},
"sync": {
"enabled": true
}
}
By default, the sync process will run once every day. The value in seconds for the sync process can be specified via the
frequency
configuration option.{
"app": {
...
},
"sync": {
"enabled": true,
"frequency": 86400
}
}
The maximum time allowed for the syncing process to be completed can be specified with a
sync.timeout
configuration option in the Didomi configuration:{
"app": {
...
},
"sync": {
"enabled": true,
"timeout": 2000
}
}
The
sync.timeout
configuration option accepts an integer which represents the maximum time allowed (in milliseconds) for the syncing process to be completed.If the syncing process takes more time to be completed than it is specified in
sync.timeout
configuration option, the initialization continues as if there was no data to sync.On Android and iOS, the delayNotice parameter is ignored. To avoid showing the notice before user is synchronized, the
setUser
method can be called before the SDK is initialized. In this case, consent synchronization will be performed as part of the initialization process.It is also possible to call
setupUI()
only after user was synchronized. Alternatively, current Activity
(Android) or ViewController
(iOS) can be passed to the setUser method, so if sdk is already initialized, consent will be asked again if user consent is partial after synchronization.Example:
Java
Kotlin
Swift
Didomi.getInstance().setUser(userParams, activity);
Didomi.getInstance().setUser(userParams = userAuthParams, activity = activity);
Didomi.shared.setUser(userAuthParams: userParams, containerController: viewController)
After an organization user ID has been set, it is possible to change it or to "remove" it (forget this user ID). This will be interpreted as changing the currently active organization user, and will trigger a new synchronization.
- If there was an already synchronized user, and the user changed, the existing consents are
reset
. If this user already gave consent using another device, these consents will be loaded. Otherwise, the user needs to give consent again. - When user should not be synchronized anymore,
clearUser()
should be called. When doing this, the Didomi user ID (UserStatus.userId) assigned to this user will be reset, but current consents will be kept. The call will also trigger a consentChanged event. If you need to reset the consents as well, you can call the reset() method at the same time. - By providing the optional parameter
activity
(Android) /containerController
(iOS) to thesetUser
method, if the sdk is already initialized,setupUI
will be automatically called after synchronization is done. So if synchronized user changes and consent is partial for the new user, consent notice will be displayed automatically.
- Android Developers, make sure the device is supporting the selected encryption method. For more information, see the Android documentation.
Last modified 12d ago