Privacy manager for connected tv and over-the-top applications
A system for processing privacy permissions for consumers utilizing vendor applications allows for recording, storing, and retrieving consent transactions performed by the users (data subjects) in data schemas. The system uses a number of hash-generated IDs, such that when a request is received to retrieve subject data, an organization ID (associated with the vendor or application) and identifying value (associated with the subject) are hashed to create a subject ID. The subject ID, organization ID, and a schema ID for the schema associated with the subject are hashed to create a subject data ID, which is then used to retrieve consent transactions and permissions associated with the subject.
1 . A method for managing privacy for a subject accessing an application on a consent-activated device without the capability of storing local data, the method comprising the steps of:
receiving at a provider server a request message through a vendor application programming interface (API) gateway for determining permissions for a subject using the consent-activated device, wherein the request message comprises an organization ID and at least one identifying value associated with the subject;
hashing the organization ID and the identifying value to create a subject ID;
based on values stored in a subject table associating a number of subjects each with a subject ID, determine the corresponding subject for the created subject ID;
for the subject affiliated with the subject ID, identifying one or more data schemas corresponding to the subject, wherein the data schemas comprise a schema ID;
hashing the subject ID, organization ID, and schema ID to create a subject data ID;
retrieving from an authorized API keys database one or more consent records associated with the subject data ID, wherein the one or more consent records comprises permissions for the subject; and
provide access at the consent-activated device based on the permissions in the one or more consent records.
2 . The method of claim 1 , wherein the consent-activated device is a connected tv (CTV) device.
3 . The method of claim 1 , wherein the consent-activated device is an over-the-top (OTT) device.
4 . A system for determining permissions allowances for a subject accessing an application, the system comprising:
a consent-activated device;
a subject table stored in a subject database;
a schema table stored in a schema database;
an authorized application programming interface (API) keys database;
a provider server in communication with the transactions database, the subject database, the schema database, and the consent-activated device, wherein the provider server comprises a vendor API gateway, a processor, and a memory, the memory containing instructions that, when executed by the processor, cause the processor to:
receive a request message through the vendor API gateway, the request message comprising an organization ID and at least one identifying value associated with the subject;
hash the organization ID and the identifying value to create a subject ID;
based on values stored in the subject table associating a number of subjects each with a subject ID, determine the corresponding subject for the created subject ID;
for the subject affiliated with the subject ID, identify one or more data schemas corresponding to the subject in the schema table, wherein the data schemas comprise a schema ID;
hash the subject ID, organization ID, and schema ID to create a subject data ID;
retrieve from the authorized API keys database one or more consent records associated with the subject data ID, wherein the one or more consent records comprises permissions for the subject; and
provide access at the consent-activated device based on the permissions in the one or more consent records in the authorized API keys database.
5 . The system of claim 4 , wherein the consent-activated device is a connected television (CTV) device.
6 . The system of claim 4 , wherein the consent-activated device is an over-the-top (OTT) device.
7 . The system of claim 4 , further comprising a management user interface (UI) providing customer access to the provider server.
8 . The system of claim 7 , further comprising a management API in communication between the management UI and the provider server.
9 . The system of claim 8 , further comprising a management API authentication between the management Ul and the provider server.