Removed legacy optout_check field (#2292)

RSam25 · Release Workflow · web-flow · commit 6bd2d84c31b2 · 2026-02-16T14:31:46.000+11:00
* Added early exit for meetPolicyRequirements and added a counter metric for requests bypassing optout check

* Renamed counter and changed tags

* [CI Pipeline] Released Snapshot version: 5.63.23-alpha-287-SNAPSHOT

* Removed optout policy check and disable optout feature flag

* Removed OptoutCheckPolicy, its references and modified related tests

* Removed reference to getOldestClientKey

* [CI Pipeline] Released Snapshot version: 5.63.24-alpha-289-SNAPSHOT

* [CI Pipeline] Released Snapshot version: 5.64.3-alpha-298-SNAPSHOT

* Updated base alpine image to get rid of CVE

* [CI Pipeline] Released Snapshot version: 5.64.7-alpha-299-SNAPSHOT

---------

Co-authored-by: Release Workflow &lt;unifiedid-admin+release@thetradedesk.com&gt;
diff --git a/conf/docker-config.json b/conf/docker-config.json
@@ -42,7 +42,6 @@
   "salts_expired_shutdown_hours": 12,
   "store_refresh_stale_shutdown_hours": 12,
   "operator_type": "public",
-  "disable_optout_token": true,
   "enable_remote_config": true,
   "uid_instance_id_prefix": "local-operator"
 }
diff --git a/conf/integ-config.json b/conf/integ-config.json
@@ -18,7 +18,6 @@
   "salts_expired_shutdown_hours": 12,
   "store_refresh_stale_shutdown_hours": 12,
   "operator_type": "public",
-  "disable_optout_token": true,
   "enable_remote_config": false,
   "uid_instance_id_prefix": "local-operator"
 }
diff --git a/conf/local-config.json b/conf/local-config.json
@@ -41,7 +41,6 @@
   "store_refresh_stale_shutdown_hours": 12,
   "operator_type": "public",
   "encrypted_files": false,
-  "disable_optout_token": true,
   "enable_remote_config": true,
   "uid_instance_id_prefix": "local-operator"
 }
diff --git a/conf/local-e2e-docker-public-config.json b/conf/local-e2e-docker-public-config.json
@@ -38,7 +38,6 @@
   "salts_expired_shutdown_hours": 12,
   "store_refresh_stale_shutdown_hours": 12,
   "operator_type": "public",
-  "disable_optout_token": true,
   "enable_remote_config": true,
   "uid_instance_id_prefix": "local-public-operator"
 }
diff --git a/conf/local-e2e-public-config.json b/conf/local-e2e-public-config.json
@@ -44,7 +44,7 @@
   "salts_expired_shutdown_hours": 12,
   "store_refresh_stale_shutdown_hours": 12,
   "operator_type": "public",
-  "disable_optout_token": true,
+
   "enable_remote_config": true,
   "uid_instance_id_prefix": "local-public-operator"
 }
diff --git a/conf/validator-latest-e2e-docker-public-config.json b/conf/validator-latest-e2e-docker-public-config.json
@@ -43,7 +43,6 @@
     },
     "config_scan_period_ms": 300000
   },
-  "disable_optout_token": true,
   "enable_remote_config": true,
   "uid_instance_id_prefix": "local-public-operator"
 }
diff --git a/src/main/java/com/uid2/operator/Const.java b/src/main/java/com/uid2/operator/Const.java
@@ -34,7 +34,6 @@ public class Config extends com.uid2.shared.Const.Config {
 
         public static final String ConfigScanPeriodMsProp = "config_scan_period_ms";
         public static final String IdentityV3Prop = "identity_v3";
-        public static final String DisableOptoutTokenProp = "disable_optout_token";
         public static final String EnableRemoteConfigProp = "enable_remote_config";
         public static final String RuntimeConfigMetadataPathProp = "runtime_config_metadata_path";
 
diff --git a/src/main/java/com/uid2/operator/model/IdentityRequest.java b/src/main/java/com/uid2/operator/model/IdentityRequest.java
@@ -3,21 +3,14 @@
 public final class IdentityRequest {
     public final PublisherIdentity publisherIdentity;
     public final UserIdentity userIdentity;
-    public final OptoutCheckPolicy optoutCheckPolicy;
     public final IdentityEnvironment identityEnvironment;
 
     public IdentityRequest(
             PublisherIdentity publisherIdentity,
             UserIdentity userIdentity,
-            OptoutCheckPolicy tokenGeneratePolicy,
             IdentityEnvironment identityEnvironment) {
         this.publisherIdentity = publisherIdentity;
         this.userIdentity = userIdentity;
-        this.optoutCheckPolicy = tokenGeneratePolicy;
         this.identityEnvironment = identityEnvironment;
     }
-
-    public boolean shouldCheckOptOut() {
-        return optoutCheckPolicy.equals(OptoutCheckPolicy.RespectOptOut);
-    }
 }
diff --git a/src/main/java/com/uid2/operator/model/MapRequest.java b/src/main/java/com/uid2/operator/model/MapRequest.java
@@ -4,22 +4,15 @@
 
 public final class MapRequest {
     public final UserIdentity userIdentity;
-    public final OptoutCheckPolicy optoutCheckPolicy;
     public final Instant asOf;
     public final IdentityEnvironment identityEnvironment;
 
     public MapRequest(
             UserIdentity userIdentity,
-            OptoutCheckPolicy optoutCheckPolicy,
             Instant asOf,
             IdentityEnvironment identityEnvironment) {
         this.userIdentity = userIdentity;
-        this.optoutCheckPolicy = optoutCheckPolicy;
         this.asOf = asOf;
         this.identityEnvironment = identityEnvironment;
     }
-
-    public boolean shouldCheckOptOut() {
-        return optoutCheckPolicy.equals(OptoutCheckPolicy.RespectOptOut);
-    }
 }
diff --git a/src/main/java/com/uid2/operator/model/OptoutCheckPolicy.java b/src/main/java/com/uid2/operator/model/OptoutCheckPolicy.java
diff --git a/src/main/java/com/uid2/operator/service/UIDOperatorService.java b/src/main/java/com/uid2/operator/service/UIDOperatorService.java
@@ -102,7 +102,7 @@ public IdentityTokens generateIdentity(IdentityRequest request, Duration refresh
                 request.userIdentity.identityScope, request.userIdentity.identityType, firstLevelHash, request.userIdentity.privacyBits,
                 request.userIdentity.establishedAt, request.userIdentity.refreshedAt);
 
-        if (request.shouldCheckOptOut() && getGlobalOptOutResult(firstLevelHashIdentity, false).isOptedOut()) {
+        if (getGlobalOptOutResult(firstLevelHashIdentity, false).isOptedOut()) {
             return IdentityTokens.LogoutToken;
         } else {
             return this.generateIdentity(request.publisherIdentity, firstLevelHashIdentity, refreshIdentityAfter, refreshExpiresAfter, identityExpiresAfter, request.identityEnvironment);
@@ -153,7 +153,7 @@ public RefreshResponse refreshIdentity(RefreshToken token, Duration refreshIdent
     @Override
     public MappedIdentity mapIdentity(MapRequest request) {
         final UserIdentity firstLevelHashIdentity = getFirstLevelHashIdentity(request.userIdentity, request.asOf);
-        if (request.shouldCheckOptOut() && getGlobalOptOutResult(firstLevelHashIdentity, false).isOptedOut()) {
+        if (getGlobalOptOutResult(firstLevelHashIdentity, false).isOptedOut()) {
             return MappedIdentity.LogoutIdentity;
         } else {
             return getMappedIdentity(firstLevelHashIdentity, request.asOf, request.identityEnvironment);
diff --git a/src/main/java/com/uid2/operator/vertx/UIDOperatorVerticle.java b/src/main/java/com/uid2/operator/vertx/UIDOperatorVerticle.java
@@ -104,14 +104,12 @@ public class UIDOperatorVerticle extends AbstractVerticle {
     private final IClientKeyProvider clientKeyProvider;
     private final Clock clock;
     private final boolean identityV3Enabled;
-    private final boolean disableOptoutToken;
     private final UidInstanceIdProvider uidInstanceIdProvider;
     protected IUIDOperatorService idService;
 
     private final Map<String, DistributionSummary> _identityMapMetricSummaries = new HashMap<>();
     private final Map<Tuple.Tuple2<String, Boolean>, DistributionSummary> _refreshDurationMetricSummaries = new HashMap<>();
     private final Map<Tuple.Tuple3<String, Boolean, Boolean>, Counter> _advertisingTokenExpiryStatus = new HashMap<>();
-    private final Map<Tuple.Tuple3<String, OptoutCheckPolicy, String>, Counter> _tokenGeneratePolicyCounters = new HashMap<>();
     private final Map<String, Counter> _tokenGenerateTCFUsage = new HashMap<>();
     private final Map<String, Tuple.Tuple2<Counter, Counter>> _identityMapUnmappedIdentifiers = new HashMap<>();
     private final Map<String, Counter> _identityMapRequestWithUnmapped = new HashMap<>();
@@ -197,7 +195,6 @@ public UIDOperatorVerticle(IConfigStore configStore,
         this.optOutStatusApiEnabled = config.getBoolean(Const.Config.OptOutStatusApiEnabled, true);
         this.optOutStatusMaxRequestSize = config.getInteger(Const.Config.OptOutStatusMaxRequestSize, 5000);
         this.identityV3Enabled = config.getBoolean(IdentityV3Prop, false);
-        this.disableOptoutToken = config.getBoolean(DisableOptoutTokenProp, false);
         this.uidInstanceIdProvider = uidInstanceIdProvider;
         this.isAsyncBatchRequestsEnabled = config.getBoolean(EnableAsyncBatchRequestProp, false);
     }
@@ -505,7 +502,6 @@ private void handleClientSideTokenGenerateImpl(RoutingContext rc) throws NoSuchA
                     new IdentityRequest(
                             new PublisherIdentity(clientSideKeypair.getSiteId(), 0, 0),
                             input.toUserIdentity(this.identityScope, privacyBits.getAsInt(), Instant.now()),
-                            OptoutCheckPolicy.RespectOptOut,
                             identityEnvironment
                     ),
                     refreshIdentityAfter,
@@ -962,50 +958,18 @@ private void handleTokenGenerateV2(RoutingContext rc) {
                     }
                 }
 
-                final Tuple.Tuple2<OptoutCheckPolicy, String> optoutCheckPolicy = readOptoutCheckPolicy(req);
-                recordTokenGeneratePolicy(apiContact, optoutCheckPolicy.getItem1(), optoutCheckPolicy.getItem2());
-
-                if (!meetPolicyCheckRequirements(rc)) {
-                    SendClientErrorResponseAndRecordStats(ResponseStatus.ClientError, 400, rc, "Required opt-out policy argument for token/generate is missing or not set to 1", siteId, TokenResponseStatsCollector.Endpoint.GenerateV2, TokenResponseStatsCollector.ResponseStatus.BadPayload, siteProvider, platformType);
-                    return;
-                }
-
                 final IdentityTokens t = this.idService.generateIdentity(
                         new IdentityRequest(
                                 new PublisherIdentity(siteId, 0, 0),
                                 input.toUserIdentity(this.identityScope, 1, Instant.now()),
-                                OptoutCheckPolicy.respectOptOut(),
                                 identityEnvironment),
                         refreshIdentityAfter,
                         refreshExpiresAfter,
                         identityExpiresAfter);
 
                 if (t.isEmptyToken()) {
-                    if (optoutCheckPolicy.getItem1() == OptoutCheckPolicy.DoNotRespect && !this.disableOptoutToken) { // only legacy can use this policy
-                        final InputUtil.InputVal optOutTokenInput = input.getIdentityType() == IdentityType.Email
-                                ? InputUtil.InputVal.validEmail(OptOutTokenIdentityForEmail, OptOutTokenIdentityForEmail)
-                                : InputUtil.InputVal.validPhone(OptOutTokenIdentityForPhone, OptOutTokenIdentityForPhone);
-
-                        PrivacyBits pb = new PrivacyBits();
-                        pb.setLegacyBit();
-                        pb.setClientSideTokenGenerateOptout();
-
-                        final IdentityTokens optOutTokens = this.idService.generateIdentity(
-                                new IdentityRequest(
-                                        new PublisherIdentity(siteId, 0, 0),
-                                        optOutTokenInput.toUserIdentity(this.identityScope, pb.getAsInt(), Instant.now()),
-                                        OptoutCheckPolicy.DoNotRespect,
-                                        identityEnvironment),
-                                refreshIdentityAfter,
-                                refreshExpiresAfter,
-                                identityExpiresAfter);
-
-                        ResponseUtil.SuccessV2(rc, toTokenResponseJson(optOutTokens));
-                        recordTokenResponseStats(siteId, TokenResponseStatsCollector.Endpoint.GenerateV2, TokenResponseStatsCollector.ResponseStatus.Success, siteProvider, optOutTokens.getAdvertisingTokenVersion(), platformType);
-                    } else { // new participant, or legacy specified policy/optout_check=1
-                        ResponseUtil.SuccessNoBodyV2("optout", rc);
-                        recordTokenResponseStats(siteId, TokenResponseStatsCollector.Endpoint.GenerateV2, TokenResponseStatsCollector.ResponseStatus.OptOut, siteProvider, null, platformType);
-                    }
+                    ResponseUtil.SuccessNoBodyV2("optout", rc);
+                    recordTokenResponseStats(siteId, TokenResponseStatsCollector.Endpoint.GenerateV2, TokenResponseStatsCollector.ResponseStatus.OptOut, siteProvider, null, platformType);
                 } else {
                     ResponseUtil.SuccessV2(rc, toTokenResponseJson(t));
                     recordTokenResponseStats(siteId, TokenResponseStatsCollector.Endpoint.GenerateV2, TokenResponseStatsCollector.ResponseStatus.Success, siteProvider, t.getAdvertisingTokenVersion(), platformType);
@@ -1149,7 +1113,6 @@ private JsonObject handleIdentityMapCommon(RoutingContext rc, InputUtil.InputVal
                 final MappedIdentity mappedIdentity = idService.mapIdentity(
                         new MapRequest(
                                 input.toUserIdentity(this.identityScope, 0, now),
-                                OptoutCheckPolicy.respectOptOut(),
                                 now,
                                 env));
 
@@ -1204,7 +1167,6 @@ private JsonObject processIdentityMapV3Response(RoutingContext rc, Map<String, I
                     final MappedIdentity mappedId = idService.mapIdentity(
                             new MapRequest(
                                     rawId.toUserIdentity(this.identityScope, 0, now),
-                                    OptoutCheckPolicy.respectOptOut(),
                                     now,
                                     env));
 
@@ -1657,49 +1619,6 @@ private UserConsentStatus validateUserConsent(JsonObject req, String apiContact)
         return UserConsentStatus.SUFFICIENT;
     }
 
-    private static final String POLICY_PARAM = "policy";
-    private static final String OPTOUT_CHECK_POLICY_PARAM = "optout_check";
-
-    private boolean meetPolicyCheckRequirements(RoutingContext rc) {
-        JsonObject requestJsonObject = (JsonObject) rc.data().get(REQUEST);
-        boolean respectOptOut = false;
-        if (requestJsonObject.containsKey(OPTOUT_CHECK_POLICY_PARAM)) {
-            respectOptOut = OptoutCheckPolicy.fromValue(requestJsonObject.getInteger(OPTOUT_CHECK_POLICY_PARAM)) == OptoutCheckPolicy.respectOptOut();
-        } else if (requestJsonObject.containsKey(POLICY_PARAM)) {
-            respectOptOut = OptoutCheckPolicy.fromValue(requestJsonObject.getInteger(POLICY_PARAM)) == OptoutCheckPolicy.respectOptOut();
-        }
-
-        final ClientKey clientKey = (ClientKey) AuthMiddleware.getAuthClient(rc);
-        final ClientKey oldestClientKey = this.clientKeyProvider.getOldestClientKey(clientKey.getSiteId());
-        boolean newClient = oldestClientKey.getCreated() >= OPT_OUT_CHECK_CUTOFF_DATE;
-
-        if (newClient && !respectOptOut) {
-            // log policy violation
-            LOGGER.warn(String.format("Failed to respect opt-out policy: siteId=%d, clientKeyName=%s, clientKeyCreated=%d",
-                    oldestClientKey.getSiteId(), oldestClientKey.getName(), oldestClientKey.getCreated()));
-            return false;
-        }
-        return true;
-    }
-
-    private Tuple.Tuple2<OptoutCheckPolicy, String> readOptoutCheckPolicy(JsonObject req) {
-        if(req.containsKey(OPTOUT_CHECK_POLICY_PARAM)) {
-            return new Tuple.Tuple2<>(OptoutCheckPolicy.fromValue(req.getInteger(OPTOUT_CHECK_POLICY_PARAM)), OPTOUT_CHECK_POLICY_PARAM);
-        } else if(req.containsKey(POLICY_PARAM)) {
-            return new Tuple.Tuple2<>(OptoutCheckPolicy.fromValue(req.getInteger(POLICY_PARAM)), POLICY_PARAM);
-        } else {
-            return new Tuple.Tuple2<>(OptoutCheckPolicy.defaultPolicy(), "null");
-        }
-    }
-
-    private void recordTokenGeneratePolicy(String apiContact, OptoutCheckPolicy policy, String policyParameterKey) {
-        _tokenGeneratePolicyCounters.computeIfAbsent(new Tuple.Tuple3<>(apiContact, policy, policyParameterKey), triple -> Counter
-                .builder("uid2_token_generate_policy_usage_total")
-                .description("Counter for token generate policy usage")
-                .tags("api_contact", triple.getItem1(), "policy", String.valueOf(triple.getItem2()), "policy_parameter", triple.getItem3())
-                .register(Metrics.globalRegistry)).increment();
-    }
-
     private void recordTokenGenerateTCFUsage(String apiContact) {
         _tokenGenerateTCFUsage.computeIfAbsent(apiContact, contact -> Counter
                 .builder("uid2_token_generate_tcf_usage_total")
diff --git a/src/test/java/com/uid2/operator/UIDOperatorServiceTest.java b/src/test/java/com/uid2/operator/UIDOperatorServiceTest.java
diff --git a/src/test/java/com/uid2/operator/UIDOperatorVerticleTest.java b/src/test/java/com/uid2/operator/UIDOperatorVerticleTest.java
diff --git a/src/test/java/com/uid2/operator/benchmark/IdentityMapBenchmark.java b/src/test/java/com/uid2/operator/benchmark/IdentityMapBenchmark.java
diff --git a/src/test/java/com/uid2/operator/benchmark/TokenEndecBenchmark.java b/src/test/java/com/uid2/operator/benchmark/TokenEndecBenchmark.java

Original file line number	Diff line number	Diff line change
`@@ -42,7 +42,6 @@`
`42`	`42`	`"salts_expired_shutdown_hours": 12,`
`43`	`43`	`"store_refresh_stale_shutdown_hours": 12,`
`44`	`44`	`"operator_type": "public",`
`45`		`- "disable_optout_token": true,`
`46`	`45`	`"enable_remote_config": true,`
`47`	`46`	`"uid_instance_id_prefix": "local-operator"`
`48`	`47`	`}`
Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,6 @@`
`18`	`18`	`"salts_expired_shutdown_hours": 12,`
`19`	`19`	`"store_refresh_stale_shutdown_hours": 12,`
`20`	`20`	`"operator_type": "public",`
`21`		`- "disable_optout_token": true,`
`22`	`21`	`"enable_remote_config": false,`
`23`	`22`	`"uid_instance_id_prefix": "local-operator"`
`24`	`23`	`}`
Original file line number	Diff line number	Diff line change
`@@ -41,7 +41,6 @@`
`41`	`41`	`"store_refresh_stale_shutdown_hours": 12,`
`42`	`42`	`"operator_type": "public",`
`43`	`43`	`"encrypted_files": false,`
`44`		`- "disable_optout_token": true,`
`45`	`44`	`"enable_remote_config": true,`
`46`	`45`	`"uid_instance_id_prefix": "local-operator"`
`47`	`46`	`}`
Original file line number	Diff line number	Diff line change
`@@ -38,7 +38,6 @@`
`38`	`38`	`"salts_expired_shutdown_hours": 12,`
`39`	`39`	`"store_refresh_stale_shutdown_hours": 12,`
`40`	`40`	`"operator_type": "public",`
`41`		`- "disable_optout_token": true,`
`42`	`41`	`"enable_remote_config": true,`
`43`	`42`	`"uid_instance_id_prefix": "local-public-operator"`
`44`	`43`	`}`
Original file line number	Diff line number	Diff line change
`@@ -44,7 +44,7 @@`
`44`	`44`	`"salts_expired_shutdown_hours": 12,`
`45`	`45`	`"store_refresh_stale_shutdown_hours": 12,`
`46`	`46`	`"operator_type": "public",`
`47`		`- "disable_optout_token": true,`
	`47`	`+`
`48`	`48`	`"enable_remote_config": true,`
`49`	`49`	`"uid_instance_id_prefix": "local-public-operator"`
`50`	`50`	`}`
Original file line number	Diff line number	Diff line change
`@@ -43,7 +43,6 @@`
`43`	`43`	`},`
`44`	`44`	`"config_scan_period_ms": 300000`
`45`	`45`	`},`
`46`		`- "disable_optout_token": true,`
`47`	`46`	`"enable_remote_config": true,`
`48`	`47`	`"uid_instance_id_prefix": "local-public-operator"`
`49`	`48`	`}`