Didomi - Developers documentation
  • Introduction
  • SDKs
    • Introduction
    • Web SDK
      • Getting started
      • Tags and vendors management
        • Tags management
          • Events & Variables
            • Deprecated
            • Custom events
          • Tag managers
            • Adobe Launch/DTM
            • Eulerian
            • Google Tag Manager
              • Configure the Didomi / GTM integration
              • Didomi's GTM template
            • Tealium
            • Other tag managers
        • Custom Didomi <script> tags
        • Third-party integrations
          • Google Ad Manager / AdSense
            • GDPR via Non-Personalized Ads
              • Share consent and load/refresh ads
              • Share consent without loading or refreshing ads
            • US states laws
          • Google Consent Mode V2
          • Kameleoon
          • Piano Analytics (AT Internet)
          • Prebid
            • GDPR via IAB TCF
            • US states laws
          • Salesforce DMP (Krux)
        • IAB frameworks
        • Programmatic API
      • Configuration
        • Bots (SEO & Performance tools)
        • Configuration by URL
        • Cookies and storage
        • Custom domains for events
        • Notice
          • Behavior
          • Interactions
          • Look and feel
        • Preferences
        • Theme
      • AB tests
      • Custom domain
        • Domain delegation
        • Reverse proxy
      • Share consents between domains
      • Share consents across devices
      • Pass user choices in query string
      • Serve Didomi assets from your domain
      • Reference
        • API
          • Deprecated
        • Events
      • Performance
      • Versions
    • Mobile and TV SDKs
      • Android and Android TV
        • Setup
        • Logging
        • Reference
          • API
            • Deprecated
          • Events
        • Versions
      • iOS and tvOS
        • Setup
        • Logging
        • App Tracking Transparency (iOS 14.5+)
        • Reference
          • API
            • Deprecated
          • Events
        • Versions
      • Unity
        • Setup
        • Reference
        • Versions
        • Troubleshooting
      • React Native
        • Setup
        • Reference
          • Deprecated
        • Versions
      • Flutter
        • Setup
        • Reference
        • Versions
      • Consent notice
        • Getting started
        • Customize the notice
        • Customize the preferences popup
        • Customize the theme & UI
        • Load notice by ID
      • Third-party SDKs
      • Share consents across devices
      • Share consent with WebViews
      • Google Consent Mode v2
      • FAQ
    • AMP SDK
      • Blocking Behaviors
        • Load immediately on page load
        • Load only after consent (positive or negative)
        • Load only after positive consent
      • Consent status for vendors
    • Help & Support
  • API
    • Introduction
      • Authentication
      • Errors
      • Pagination
      • Filters
      • Caching
      • Rate limiting
      • Quotas
      • Translations
    • Data Manager
      • Regulations
      • Configuration Tree
      • Purposes
        • Purposes & Vendors Numerical IDs
      • Preferences Library
      • User Rights
    • Widgets
      • Consent notices
        • Notices
        • Configurations
        • Multi-Regulation Configurations
          • Migration of Existing Notices and API Updates
        • Deployments
        • Tutorials
          • Create and publish a consent notice
          • Create and publish a multi-regulation consent notice
      • Privacy widgets
        • Create a widget
        • Retrieve widgets
        • Edit a widget
          • Content & Design
            • Themes & Shapes
            • Components
              • auth
              • dsar_form
              • footer
              • header
              • preference
              • preference_value
              • save
              • section
              • sections
            • Options
          • Purposes & preferences
          • Settings
        • Deploy a Widget
          • Use your own subdomain
          • Use your own domain
          • Implement an embeddable widget on your website
        • Authentication
          • Manage authentication providers
          • Authenticate your end-user
        • Archive a widget
        • Headless widgets
          • Public Methods
          • Custom elements
          • Custom events
          • Event listeners
        • Tutorial
          • Launch a Preference Center from a mobile app
    • Compliance Reports
      • Properties
      • Reports
      • CSV format reference
      • Websites
    • Consents and Preferences
      • Events
        • Generate IAB TCF consent string
      • Links
      • Proofs
      • Tokens
      • Secrets
      • Users
      • Tutorial
        • Collect and operate data
    • Privacy Requests
      • Requests
      • Notes
      • Links
      • Emails
  • Integrations
    • Introduction
      • Quotas
    • Generic integrations
      • Batch export
        • Destinations
          • AWS S3 Bucket (owned by Didomi)
          • GCP Storage Bucket
        • Exported data
          • Notices consents
        • Logs
      • Webhooks
      • Batch import
      • Analytics export
        • Destinations
          • AWS S3 Bucket (owned by Didomi)
          • GCP Storage Bucket
    • Third-party apps
      • CMP integrations
        • Didomi-mParticle integration for your CMP
        • Deploy Didomi’s SDK for your Adobe Commerce website
      • Preference Management Platform integrations
        • Actito
        • Adobe Campaign Classic
        • Adobe Experience Cloud
        • Adobe Marketo Engage
        • Adobe Source Connector
        • Braze
        • Dotdigital
        • Hubspot
        • Mailchimp
        • Microsoft Dynamics 365
        • Salesforce Marketing Cloud
        • Salesforce Sales & Service Cloud
        • Selligent
        • Brevo (ex Sendinblue)
    • Tutorials
      • Configure a HTTP webhook
      • Configure a batch export
      • Configure an analytics export
    • Emailing
      • Configurations
        • Actito Email
        • Actito SMS
        • Adobe Campaign Classic
        • Adobe Campaign Standard
      • Emails
        • Templates
        • Manage your templates
Powered by GitBook
On this page
  • Introduction
  • Configuration
  • How to share an organization user ID with Didomi?
  • Which user organization ID to share with Didomi?
  • Authentication with a hash digest
  • Enabling sync
  • Behavior
  • Frequency
  • Sync timeout
  • Delaying notice showing
  • Summary
  1. SDKs
  2. Web SDK

Share consents across devices

PreviousShare consents between domainsNextPass user choices in query string

Last updated 9 months ago

Introduction

The Didomi CMP supports syncing to allow consent sharing across devices and environments. Consent can be shared between all environments that have syncing enabled in the same organization: multiple websites, multiple apps (same or multiple devices), multiple websites and apps together, etc.

When syncing is enabled and an organization user ID is available, if the user is visiting the page for the first time and no sync has taken place, the Didomi CMP will load the previously stored user choices from the Consents API and will apply them locally. In the case the user had already received data from the sync process, their local data will be updated from the server after the duration of time defined by the sync frequency has elapsed relative to the last time sync was completed.

If the sync request duration exceeds the timeout setting we use the local consent and will attempt to sync on the next SDK initialization (page reload).

Syncing is currently a premium feature. You can schedule a meeting with our Support team to enable the feature for your account. See article for more information.

We do not support the cross device feature for AMP sites due to the single consent status limitation of the .

Configuration

How to share an organization user ID with Didomi?

For the sync process to work properly, a user.organizationUserId property needs to be set in the Didomi configuration object:

window.didomiConfig = {
  user: {
    organizationUserId: 'organization-user-id',
  }
};

This value represents the unique identifier with which the organization identifies the user for which it wants to sync the consents. This can be an email address, a user ID, etc. We recommend hashing the value to not communicate plain user IDs to Didomi.

This must be set before the Didomi Web SDK is embedded onto the page.

You need extra steps to authenticate the user ID on the Didomi side so please read on to complete your configuration.

Which user organization ID to share with Didomi?

When the user is identified by the website through a login process or any other authentication method, a unique user ID should be shared with the Didomi SDK through the window.didomiConfig object. The unique user ID can be any string but we recommend sending a hashed version of your internal user ID to not expose any sensitive data on the page or to Didomi. Avoid sharing plain email addresses, user names, etc. with Didomi.

The same unique user ID will need to be shared in other environments like mobile apps. If you are sending a hashed ID, make sure that you will be able to send exactly the same ID across all environments.

Authentication with a hash digest

Using a hash digest does not guarantee the confidentiality of the user ID passed to Didomi as it is exposed in clear text on the page.

As the user ID is provided in a public environment (on a webpage), we need to authenticate it to guarantee that users cannot freely read and write consents for any user ID.

To authenticate the user ID and prove that it was authorized by the website, you will need to compute a hash digest of the user ID concatenated with a secret. This digest must be computed directly by your server in an authenticated context and not on the client-side. When it receives a request, Didomi will re-compute the digest with the secret and make sure that it matches the digest that you provided.

The hash digest should be provided in the user.organizationUserIdAuthDigest property. You will also need to provide the ID of the secret and the hashing algorithm used for generating the hash digest.

Example:

<script type="text/javascript">
window.didomiConfig = {
  user: {
    organizationUserId: 'organization_user_id',
    organizationUserIdAuthDigest: MD5('organization_user_id' + 'secret'),
    organizationUserIdAuthSid: 'secret_id',
    organizationUserIdAuthAlgorithm: 'hash-md5'
  }
};
</script>

Note that the digest is computed on the concatenation of the user ID and the secret, without any extra space added. Example: organization_user_idsecret

Secrets

Hashing methods

Didomi supports the following methods for computing a digest:

Algorithm
ID
Description

Hash MD5

hash-md5

Hexadecimal digest computed with the MD5 algorithm

Hash SHA1

hash-sha1

Hexadecimal digest computed with the SHA1 algorithm

Hash SHA256

hash-sha256

Hexadecimal digest computed with the SHA256 algorithm

HMAC SHA1

hmac-sha1

Hexadecimal representation of a HMAC computed with the SHA1 algorithm

HMAC SHA256

hmac-sha256

Hexadecimal representation of a HMAC computed with the SHA256 algorithm

For all methods, the content to compute the digest on and the secret are the same. The method ID must be provided in the organizationUserIdAuthAlgorithm property.

Salting

For increased security, you can use a salt when computing the hash digest. You will need to provide the salt in the configuration so that Didomi can use it when verifying the user ID.

Example:

<script type="text/javascript">
window.didomiConfig = {
  user: {
    organizationUserId: 'organization_user_id',
    organizationUserIdAuthDigest: MD5('organization_user_id' + 'secret'),
    organizationUserIdAuthSid: 'secret_id',
    organizationUserIdAuthAlgorithm: 'hash-md5'
    organizationUserIdAuthSalt: 'salt'
  }
};
</script>

Information expiration

The authentication methods guarantee the integrity of the information (i.e., the information originates from the client and cannot be modified by a third-party) but do not guarantee that that information cannot be reused.

To prevent reusing an encrypted user identifier, we support the addition of expiration information. You can mark the information as having an expiration date so that it cannot be used after a certain date using the organizationUserIdExp parameter. This should be a valid unix timestamp value.

Example:

<script type="text/javascript">
window.didomiConfig = {
  user: {
    organizationUserId: 'organization_user_id',
    organizationUserIdAuthDigest: MD5('organization_user_id' + 'secret' + 'salt'),
    organizationUserIdAuthSid: 'secret_id',
    organizationUserIdAuthAlgorithm: 'hash-md5',
    organizationUserIdAuthSalt: 'salt',
    organizationUserIdExp: 1628714229
  }
};
</script>

The rules for hashing/encrypting are:

If using a hash algorithm, the digest is computed as hash('organization_user_id' + 'secret' + 'salt' + expiration), where salt and expiration are optional values.

If using an HMAC algorithm, the digest is computed as hmac('organization_user_id' + 'salt' + expiration, 'secret'), where salt and expiration are optional values. The secret is not part of the digest, although it is used in the HMAC process.

Enabling sync

The sync process can be enabled with async.enabled configuration option in the Didomi configuration object:

window.didomiConfig = {
  user: {
    organizationUserId: 'organization-user-id',
  },
  sync: {
    enabled: true
  }
};

Behavior

Frequency

By default, the sync process will run once every day. The value in seconds for the sync process can be specified via the frequency configuration option.

window.didomiConfig = {
  user: {
    organizationUserId: 'organization-user-id',
  },
  sync: {
    enabled: true,
    frequency: 86400
  }
};

n.b.: The frequency interval is 24 hours by default (86,400 seconds). It should not be necessary to set this to a lower threshold. Lower settings can create a reduced user experience as page load times would be impacted by syncing intervals being too low and sync occurring when unnecessary.

The minimum frequency interval is 6 hours (21,600 seconds). If you set the frequency interval to a lower value, it will be overridden to 6 hours.

Sync timeout

The maximum time allowed for the syncing process to be completed can be specified with a sync.timeout configuration option in the Didomi configuration object:

window.didomiConfig = {
  user: {
    organizationUserId: 'organization-user-id',
  },
  sync: {
    enabled: true,
    timeout: 2000
  }
};

The sync.timeout configuration option accepts an integer which represents the maximum time allowed (in milliseconds) for the syncing process to be completed.

If the syncing process takes more time to be completed than it is specified in sync.timeout configuration option, the initialization continues as if there was no data to sync.

Delaying notice showing

The Didomi CMP enables delaying notice showing while the sync is in progress. This ensures that the user never sees the consent notice if sync is possible.

The sync.delayNotice configuration option can be used for delaying the notice showing until the sync is complete:

window.didomiConfig = {
  user: {
    organizationUserId: 'organization-user-id',
  },
  sync: {
    enabled: true,
    delayNotice: true
  }
};

Summary

Given the information above, assuming that:

  • the organization_user_id is set;

  • the sync.enabled is true; and,

  • the user is not a bot

If the sync is not completed within the timeout interval, the Web SDK does not store the sync timestamp in the Didomi token (cookie).

On the next page load, the SDK will try to sync again. If the sync is not successful, the Web SDK will continue based on the current state and will not show the notice if the consent was previously given and stored in the cookies.

We will re-sync under the following conditions:

  • If the sync timestamp and frequency are both present, we sync if the sync date is older than the frequency (in seconds); or

  • If the sync timestamp or the frequency is missing (undefined).

The user ID shared on the website will be used as the organization user ID in our . If you are accessing the user status or event from the API, you will need to specify the same user ID as what is shared on the website, including any form of anonymization or hashing method in place. The organization user ID must be consistent across your organization and all the other Didomi products you are using (APIs, Privacy Center, etc.).

When computing a hash digest, a secret needs to be used. Secrets can be managed through the Didomi API to obtain an actual secret and its associated ID. to manage secrets for your organizations.

Consents API
Read our documentation
through the console
this
framework