Introduction

A regulation is a configuration of data collection practices by your organization which includes aspects such as vendors and purposes used, applicable regions, industry and legislative frameworks, etc...

Overview

The regulation is used in conjunction with a widget when publishing a privacy flow to your website or application.

While the widget determines much of what the end-user sees and experiences on your property, the regulation controls the compliance logic and how their choices are recorded and passed to vendors.

Data Collection Scope

When your organization creates a new regulation in Didomi you will need to define the data collection scope for the regulation. The data collection scope refers to the entity that determines the entity that is determining the processing rules for the collection of end-user data. See the table below for more information on each option.

Data Collection Scope	Description
By vendor	For each vendor, your organization sets/confirms the processing rule for every purpose within the regulation using a vendor x purpose matrix. This option gives your organization vendor-by-vendor control over what and how end-user data is processed and is tailored for the General Data Protection Regulation (GDPR), the IAB Trasparency and Consent Framework (TCF), and other EU-style markets. Note: By default, the regulation will have the IAB TCF and Google Consent Mode v2 frameworks enabled.
By country or region	The processing rule for a given purpose is defined based on the end-user's location and all vendors will follow the same rule in the country/region/state. This enables your organization to set different processing rules for the same purpose across multiple jurisdictions using a territory x purpose matrix. This option is tailored for U.S. state privacy laws (e.g. CPRA) or anywhere the law itself sets the rule for everyone. Note: By default, the regulation will have the Google Consent Mode v2 enabled.