Repository navigation
Sourcepoint
A new family: sourcepoint-reject.js, standing in for
cdn.privacy-mgmt.com/unified/wrapperMessagingWithoutDetection.js.
One rule takes the whole CMP. That file is a webpack bundle whose campaign
modules are chunks it fetches itself, off its own publicPath - ccpa, ccpa-gpp,
custom, gdpr, gdpr-tcf, globalcmp, hbbtv, preferences, usnat, usnat-uspapi.
Nothing else ever asks for them, so replacing it takes the message iframe, the
privacy manager and the consent call with it, and there is no banner left to
hide: their banner is one of those iframes.
/wrapperMessagingWithoutDetection.js$script,important,redirect=sourcepoint-reject.js
important is earned here. __tcfapi is not in the wrapper at all - the
string does not appear in it - it is in the gdpr-tcf chunk. So blocking the
file leaves every vendor waiting on a CMP that is never coming, which is why
the big lists carry a pile of @@||privacy-mgmt.com^$script exceptions for the
sites that wall off behind it. Those are there because the page needs an
answer, and an answer is what this gives it. A site-wide allowlist of your own
still wins.
What the page sees is the state their own script reaches on a property with
nothing to show, measured in build 4.40.3 and in each campaign chunk: the
_sp_ surface, their _sp_queue hand-off, the page's config.events fired in
their order, and __tcfapi refusing as cmpId 6, cmpVersion 1, service
specific, policy version 5, apiVersion the string "2", granting nothing in
any set the string carries. Their five custom commands answer too.
Two things worth knowing if you read their docs rather than their dispatcher:
their callbacks are called (campaign, ...args), campaign first; and their
campaigns do not answer alike - gdpr sends {addtlConsent, applies, consentedToAll}, ccpa, usnat and globalcmp send {applies, gpcEnabled}, and
custom and preferences fire onMessageReceiveData and nothing else.
The refusal is euconsent-v2 and nothing else of theirs: their own script
writes no consent cookie directly - the campaign response carries a cookies
array their setCookiesAction applies - so consentUUID and gdprApplies are
their consent service's to mint. A record a visitor accepted before this was
installed is cleared, localStorage and consentUUID both.
No accept and no unblock resource: nothing is parked for this CMP to free, so
blocking is what keeps a tracker out. No __gpp or __uspapi - their US
refusal payloads are minted server side - and wrapperMessagingWithDetection.js
is left alone.
Filters: filters/sourcepoint.txt. README has the
measured detail and the deliberate gaps.
35 tests for the family, 1099 in the suite, 22 mutations run against the new
tests and all 22 killed.