> For the complete documentation index, see [llms.txt](https://docs.didomi.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.didomi.io/regulations-manager/manage-regulations/configure-regulation-by-vendor.md). # Configure regulation (by vendor) {% hint style="success" %} **Access Type**: Regulations Manager - Editor {% endhint %} A regulation is a configuration of data collection practices by your organization which includes aspects such as vendors and purposes used, applicable regions, industry and legislative frameworks, etc... The regulation is used in conjunction with a widget when publishing a privacy flow to your website or application. In this article, we provide an overview of the configuration steps available when setting up a regulation that uses the vendor as the data collection scope. * [Data collection scope by vendor overview](#data-collection-scope-by-vendor-overview) * [Global settings](#global-settings) * [Vendors & Purposes](#vendors-and-purposes) * [Frameworks](#vendors-and-purposes) * [Tag managers](#tag-managers) {% hint style="info" %} For your convenience, Didomi provides dedicated resources for each supported framework (TCF, Google Consent Mode v2, etc...). [Click here](/regulations-manager/frameworks.md) for more information. {% endhint %} To start, click **Regulations Manager** on the left-hand panel.

Select **Create regulation**.

*** ### Data collection scope by vendor overview The data collection scope refers to the entity that determines the entity that is determining the processing rules for the collection of end-user data. By selecting vendor as the data collection scope your organization sets/confirms the processing rule for every purpose within the regulation using a vendor x purpose matrix. This option gives your organization vendor-by-vendor control over what and how end-user data is processed and is tailored for the General Data Protection Regulation (GDPR), the IAB Trasparency and Consent Framework (TCF), and other EU-style markets. {% hint style="warning" %} **Note**: By default, the regulation will have the [IAB TCF](/regulations-manager/frameworks/iab-tcf.md) and [Google Consent Mode v2](/regulations-manager/frameworks/google-consent-mode-v2.md) frameworks enabled. {% endhint %} On the subsequent page, select the radio button within the ***By vendor*** card and click **Create regulation**.

A new regulation will be generated using a data collection scope by vendor. Use the provided field to edit the name of the regulation.

*** ### Global settings The global settings of the regulation manager enables your organization to set applicable regions, consent settings, and frameworks for the regulation. * [Regions](#regions) * [Consent settings](#consent-settings) * [Legitimate interest (opt-out)](#legitimate-interest-opt-out) * [Frameworks](#frameworks-1) {% hint style="info" %} If your organization has subscribed to the Didomi cross-device consent premium feature, you will also have access to the **Cross-device consent** section that will allow you to enable the premium feature and set the timeout for syncing. [Click here](https://developers.didomi.io/cmp/web-sdk/share-consents-across-devices) for more information {% endhint %} #### Regions The regions section of the global settings page allows your organization to set the country/region/state where the regulation is applicable. By including a country/region/state in this section your organization will show end-user's in these locations a widget and collect their consent for data processing. Manage the countries/regions/states for a regulation by clicking **Select Countries/Regions**.

Expand the accordions and select the country/region/states that should be included in the regulation. Selected regions will be highlighted. Click **Add Selection** when finished.

#### Consent settings The consent settings section of the global settings page is where your organization configures the duration and frequency in which end-user consent is stored and collected. Use the provided fields for each setting to configure the duration or frequency.

Setting	Description
Generic Duration	Length of the time your organization will store an end-user's consent If the end-user's consent is re-collected (e.g. the duration for window for re-collecting has triggered) then the clock for generic duration will reset.
Denied Consent Duration	Length of time your organization will wait to re-collect end-user consent when they deny all purposes and vendors that utilize consent as a processing rule
Recollect After a Date	Specify a date after which the widget will be re-displayed to the end-user and their consent re-collected
Window for Re-collecting	Number of days after a vendor or purpose is added to the regulation and the flow republished that the widget will be re-displayed to the end-user again and their consent re-collected

#### Legitimate interest (opt-out) The legitimate interest (opt-out) section of the global settings page is where you organization configures how it handles purposes and/or vendors that utilize legitimate interest/opt-out as a processing rule when the end-user performs various disagree actions.

Setting	Description
Keep legitimate interest (opt-out) enabled when the user disagrees in the notice	Purposes and vendors that utilize legitimate interest/opt-out as a processing rule will remain enabled when the end-user selects a Disagree and close button or Continue without agreeing link.
Keep legitimate interest (opt-out) enabled when the user clicks on "disagree to all" in the preferences	Purposes and vendors that utilize legitimate interest/opt-out as a processing rule will remain enabled when the end-user selects the Disagree to all button on the second layer of the widget.

{% hint style="warning" %} **Note**: Vendors who utilize a combination of consent and legitimate interest/opt-out as processing rules for purposes will not be enabled/allowed unless all purposes are enabled either via consent or legitimate interest. {% endhint %}

#### Frameworks Use the frameworks section of the global settings page to select all the industry frameworks that will be included in the regulation. Depending on the frameworks added to the regulation, Didomi will add the required vendors and/or make available settings that are included in the framework. Please see the table below for more information. {% hint style="warning" %} **Note**: By default, a regulation with a data collection scope by vendor will have the [IAB TCF](/regulations-manager/frameworks/iab-tcf.md) and [Google Consent Mode v2](/regulations-manager/frameworks/google-consent-mode-v2.md) frameworks enabled. {% endhint %}

Framework
IAB TCF	Enables the IAB Transparency and Consent Framework for the regulation. Once enabled, the IAB's Global Vendor List constraints will be applied to IAB vendors.
Google Consent Mode	Enables Google Consent Mode v2 for the regulation. The vendors Google Advertising Products (API ID: `google`) and Google Analytics Products (API ID: `googleana-4TXnJigR)` will be added automatically to your vendor list.
Amazon Consent Signal	Enables Amazon Consent Signal for the regulation. The vendor Amazon Ads (API ID: `amazonadv-U9UXjWkj`) will be added automatically to your vendor list.
GPC	Enables the Global Privacy Control for the regulation. Global Privacy Control (GPC) is a technical specification for transmitting universal opt-out signals. When enabled on a regulation, Didomi will detect whether the end-user's browser has the GPC signal and apply it to the end-user's consent record accordingly.
Microsoft Consent Mode	Enables Microsoft Consent Mode for the regulation. The vendor Microsoft Advertising (API ID: `microsoft-6zPzfpLt`) will be added automatically to your vendor list.
WordPress Consent API	Enables WordPress Consent API for the regulation.

### Vendors & Purposes The vendors and purposes page of the regulation manager provides your organization with a matrix to add vendors and assign the legal bases for purposes. In this section, we will cover how to: * [Add vendor to vendor list](#add-vendor-to-vendor-list) * [Remove vendor from vendor list](#remove-vendor-from-vendor-list) * [Configure purpose processing rule](#configure-purpose-processing-rule) {% hint style="info" %} [Click here](/regulations-manager/manage-regulations/configure-regulation-by-vendor/configure-categories-for-regulation-by-vendor.md) for additional information on managing categories (custom grouping of purposes). {% endhint %} #### Add vendor to vendor list Click **Manage Vendors**.

Use the provided filter and/or search fields in the subsequent modal to locate your desired vendor(s). Select a vendor by clicking the checkbox to the left of the vendor's name and click **Save selection** when finished.

The vendor(s) will be added to your regulation and the processing rules for each purpose defaulted to what is configured for the [vendor in your data manager](/data-manager/vendors.md).

#### Remove vendor from vendor list Click **Manage Vendors**.

Use the provided filter and click **Selected vendors** from the drop-down menu.

The list of vendors in the modal will reflect all vendors that are currently added to the regulation. Deselect any vendor that should be removed from the regulation and click **Save selection**.

The vendor will be removed from the regulation. #### Configure purpose processing rule {% hint style="warning" %} **Note**: The section below primarily deals with configuring processing rules when the IAB TCF is **not enabled** for the regulation. As there are rules and considerations to keep in mind for IAB vendors when the IAB TCF is enabled for a regulation, Didomi has a dedicated resource to assist your organization when configuring processing rules for IAB vendors (publisher restrictions). [Click here](/regulations-manager/frameworks/iab-tcf/publisher-restrictions.md) for more information. {% endhint %} Vendors added to your regulation will have the processing rules for each purpose defaulted to what is configured for the [vendor in your data manager](/data-manager/vendors.md). If a vendor does not have a processing rule for a purpose that was added to the matrix from a different vendor then the processing rule for that purpose will default to **Not Applicable**. The vendor and purpose matrix is where your organization can configure the processing rule for each purpose on a vendor by vendor basis. In this section, we will cover how to edit the processing rule for a purpose. {% hint style="info" %} Any edits made to the processing rule for a purpose is only applicable to the regulation and will not impact the configuration for the vendor in your organization's data manager. {% endhint %} Refer to the table below for the available processing rules

Processing rule	Description
Allowed	Allow the vendor to process data for the specified purpose Note: Only available for IAB vendors when configuring processing rules for IAB purposes when the IAB TCF is enabled for the regulation.
Not Allowed	Do not allow the vendor to process data for the specified purpose Note: Only available for IAB vendors when configuring processing rules for IAB purposes when the IAB TCF is enabled for the regulation.
Opt-in	Only allow the selected purpose to be processed with consent as a processing rule for the specified vendor
Opt-out	Only allow the selected purpose to be processed with legitimate interest as a processing rule for the specified vendor
Not applicable	The vendor does not process end-user data for the purpose

In order to configure/edit a processing rule, navigate to the vendor and purpose matrix and click the cell at the intersection of a vendor and purpose. Use the provided drop-down menu to select a processing rule. Repeat as necessary for other vendors and/or purposes.

### Frameworks {% hint style="info" %} Framework configuration is only available when one or more frameworks has been added to the regulation in the [Global settings](#global-settings) step. {% endhint %} The frameworks page of the regulation manager is where your organization can configure any optional or required settings for frameworks enabled for the regulation. For your convenience, Didomi has dedicated resources for [implementing frameworks](/regulations-manager/frameworks.md).

### Tag managers The tag manager page of the regulation manager is where your organization can enable any tag management platform you may use for the regulation. When enabled for a regulation, the Didomi SDK will push the end-user's consent status to the tag management platform.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.didomi.io/regulations-manager/manage-regulations/configure-regulation-by-vendor.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.