Identity Context & Consent

Understand which PII fields are forwarded, how they are hashed, and where consent responsibility lies.

When you call identify() or pass an identityContext with an event, the SDK forwards certain fields to the Rovenue API server for fan-out to downstream ad-attribution integrations (Meta CAPI, TikTok Events API, etc.). This guide explains which fields are forwarded, how each is handled, and where consent responsibility lies.

You must obtain end-user consent before passing any personally identifiable information in identityContext. Rovenue is a data processor — the consent obligation rests with you, the data controller.

Types on this page

The identityContext object is the only input type in this guide. It is called identityContext (camelCase) in the React Native SDK and IdentityContext (PascalCase) in the Swift and Kotlin SDKs; the fields and semantics are identical across all three platforms.

// React Native
type identityContext = {
  email?: string;       // PII — SHA-256 hashed before forwarding
  phone?: string;       // PII — SHA-256 hashed before forwarding
  externalId?: string;  // PII — SHA-256 hashed before forwarding
  ip?: string;          // PII — forwarded verbatim, not hashed
  userAgent?: string;   // forwarded verbatim, not hashed
  fbp?: string;         // Meta click ID — forwarded verbatim
  fbc?: string;         // Meta browser ID — forwarded verbatim
  ttclid?: string;      // TikTok click ID — forwarded verbatim
  ttp?: string;         // TikTok pixel ID — forwarded verbatim
};

Fields marked PII must only be populated after obtaining the required consent. See Consent is your responsibility below.

Understand how each field is handled

The table below describes exactly what Rovenue does with each field. "Hashed" means the raw value is never sent over the wire or stored — only its SHA-256 digest is forwarded.

Field	Forwarded as	Handling
`email`	`user_data.em`	SHA-256 — lowercased and trimmed before hashing
`phone`	`user_data.ph`	SHA-256 — digits only extracted before hashing
`externalId`	`user_data.external_id`	SHA-256 — trimmed before hashing
`ip`	`user_data.client_ip_address` / `context.ip`	Forwarded verbatim — not hashed
`userAgent`	`user_data.client_user_agent` / `context.user_agent`	Forwarded verbatim — not hashed
`fbp`	`user_data.fbp`	Forwarded verbatim — not hashed
`fbc`	`user_data.fbc`	Forwarded verbatim — not hashed
`ttclid`	`context.ttclid`	Forwarded verbatim — not hashed
`ttp`	`properties.ttp`	Forwarded verbatim — not hashed

ip, userAgent, fbp, fbc, ttclid, and ttp are not hashed. They are forwarded verbatim to downstream networks. Only collect and pass these fields after the user has given explicit, informed consent.

Only populate identityContext fields once your consent gate has been accepted. Below is the pattern for each platform.

import { Rovenue } from '@rovenue/react-native-sdk';

// Only call after the user has accepted your privacy/consent prompt
await Rovenue.identify('user_123', {
  email: 'user@example.com',   // hashed before forwarding
  phone: '+15555550100',        // hashed before forwarding
  ip: requestIp,                // forwarded verbatim — consent required
});

import Rovenue

// Only call after the user has accepted your privacy/consent prompt
try await Rovenue.shared.identify(
  "user_123",
  identityContext: IdentityContext(
    email: "user@example.com",   // hashed before forwarding
    phone: "+15555550100",        // hashed before forwarding
    ip: requestIp                 // forwarded verbatim — consent required
  )
)

import dev.rovenue.sdk.Rovenue
import dev.rovenue.sdk.IdentityContext

// Only call after the user has accepted your privacy/consent prompt
Rovenue.shared.identify(
  "user_123",
  identityContext = IdentityContext(
    email = "user@example.com",   // hashed before forwarding
    phone = "+15555550100",        // hashed before forwarding
    ip = requestIp                 // forwarded verbatim — consent required
  )
)

Rovenue acts as a data processor. Your application is the data controller. You must obtain informed consent from the end-user before passing any PII in identityContext. This obligation applies regardless of jurisdiction — GDPR, CCPA, KVKK, PDPA, and similar regulations all place the consent responsibility on the controller, not the processor.

Do not pass PII in identityContext without collecting the required consent. The fields are forwarded to third-party attribution networks (Meta, TikTok). Once sent, Rovenue cannot recall them on your behalf.

Practical checklist before passing any PII field:

You have a privacy policy that discloses the use of ad-attribution networks.
The user has been shown a consent prompt and actively accepted it.
Your consent record is tied to the user session and survives app restarts.
You have a mechanism to withdraw consent and stop forwarding PII if the user opts out.

See also: Identifying users for the full identify() flow, and Meta CAPI / TikTok Events for integration-specific consent requirements.

Additional data-handling guarantees

Rovenue never persists identityContext fields at rest. PII is hashed in-process and only the hash is forwarded downstream; raw values are not written to any database.
response_body from downstream providers is stored but truncated to 4096 bytes to prevent inadvertent PII capture in error messages.
The wire format uses camelCase JSON; each envelope carries a numeric version field (currently 1) and a stable eventId, both stamped by the SDK. Do not construct envelope JSON manually — use the SDK methods, which enforce the schema and set the version.

Identity Context & Consent

Types on this page

Understand how each field is handled

Pass identityContext after consent is collected

Consent is your responsibility

Additional data-handling guarantees

On this page