TCF Consent String

A TCF consent string is an encoded piece of text that records what consent choices a user made, under IAB Europe's Transparency and Consent Framework (TCF), and travels with the bid request so every vendor in the ad supply chain can check what they're allowed to do before they act on that impression.

What's inside the string#

The string encodes, in a compressed base64-style format, which "purposes" (like storing information on a device, or building a personalized ad profile) the user consented to, which specific vendors on IAB Europe's registered vendor list they consented to, and some metadata about when and how consent was captured. It's not human-readable, but it's fully specified: any system that implements the TCF standard can decode it the same way, which is the whole point. A publisher's consent management platform generates the string, and it gets attached to the bid request that flows through header bidding wrappers, supply-side platforms, and ad exchanges on the way to a demand-side platform.

Why the ad supply chain relies on it#

Before TCF standardized this, every vendor had its own ad hoc way of representing consent, or no way at all, which meant a demand partner three hops down the chain from the publisher had no reliable way to confirm consent was actually collected. The TCF string fixed that by giving everyone in the chain the same machine-readable answer to "is this vendor allowed to process this user's data for this purpose." It's the reason a real-time bidding auction covering an EU user can proceed at auction speed, in milliseconds, without every vendor separately querying a consent database.

The practical failure mode is when the string is missing, malformed, or the user's browser blocks the CMP from running at all. Most vendors are built to treat that as "no consent" by default, meaning they won't bid on personalization purposes, which quietly shrinks the addressable pool of a European campaign without throwing an obvious error anywhere in the reporting.

Where it fits with the rest of the stack#

The TCF string doesn't replace ads.txt or sellers.json, which verify who's authorized to sell a publisher's inventory. It solves a different problem: not "who's allowed to sell this," but "what is this specific user's data allowed to be used for." Both checks run independently in a modern programmatic auction, and a gap in either one can quietly suppress fill or bidding without a clear error message pointing to the cause.

If you're auditing how ad tech behaves around consent gates rather than just reading the spec, browsing OpenAdLibrary's ad intelligence index across geos is a fast way to see how creative mix and volume actually shift between consent-heavy and consent-light markets for the same advertiser.