GDPR, ePrivacy and RTB: TCF 2.2 Bid Request Consent Signals

For an EU user, a bid request may contain identifiers, IP address, device IDs and segments only where the TC String shows a legal basis for each purpose and vendor. Reading or storing anything on the device needs ePrivacy consent. Without a valid signal, the request must carry context only. This page walks through every field and signal, with sources.

This page is general information for engineering and privacy teams. It is not legal advice.

Every field in a bid request has to pass two tests.

1. ePrivacy: did you touch the device? Article 5(3) of Directive 2002/58/EC requires consent to store information, or gain access to information already stored, on a user's terminal equipment, unless strictly necessary for a service the user requested (Directive 2002/58/EC). The CJEU confirmed in Planet49 on 1 October 2019 that this applies whether or not the information is personal data, that pre-ticked boxes are not consent, and that users must be told the cookie duration and which third parties may access it (CJEU C-673/17). The EDPB's Guidelines 2/2023, finalized in October 2024, extend "access" to pixels, URL and link tracking, local processing that reports back, and identifiers derived from the device (EDPB, Guidelines 2/2023). Reading a cookie ID, an advertising ID or a fingerprint to populate a bid request is covered.
2. GDPR: do you have a lawful basis for each purpose? Once data is personal, Article 6 applies to every purpose, and Article 9 to special categories. Three routes have been closed for personalized advertising on the open web. Contract: the DPC's Meta decisions of 4 January 2023 (DPC). Legitimate interest: the CJEU in Meta v Bundeskartellamt on 4 July 2023 treated Article 6(1) as "an exhaustive and restrictive list" to be read narrowly, and TCF v2.2 removed the option for purposes 3 to 6 (CJEU C-252/21; IAB Europe). Consent-or-pay without a real alternative: EDPB Opinion 08/2024 of 17 April 2024 and the Commission's €200 million DMA fine on Meta of 23 April 2025 (EDPB; Commission).

The practical result is that, for EU open-web traffic, consent recorded in the TC String is the only basis that reliably supports identifiers in a bid request, and legitimate interest survives only for measurement and non-personalized purposes. The identifiers themselves are compared in the identity and privacy hub; the US rules for regulated data sit in the ad tech compliance hub.

The table maps OpenRTB 2.6 fields to the test each one has to pass. Field names and descriptions are from the IAB Tech Lab specification (OpenRTB 2.6).

Three rules follow. First, context fields are always safe; identifier fields are never safe without a signal. Second, "consent for purpose 1" is the gate for anything read from the device, and it is a separate question from the advertising purposes. Third, the IP address is both an identifier and a routing necessity, which is why truncation, not removal, is the practice.

The TCF is the mechanism that tells each vendor in the chain what it may do. The CMP writes the TC String; the publisher's ad stack passes it in user.consent and in the URL macros gdpr and gdpr_consent; every vendor decodes it before processing (IAB Europe, TCF Implementation Guidelines).

regs.gdpr is 1 if the request is subject to GDPR, 0 if not, and omitted if unknown (OpenRTB 2.6). Older integrations use regs.ext.gdpr and user.ext.consent; most exchanges populate both. An EU-facing stack should treat "omitted" as 1 for traffic geolocated to the EEA or UK.

The core segment is a bit field decoded in order (IAB Tech Lab, Consent string and vendor list formats v2).

Under TCF v2.2 policies the eleven purposes and the bases a vendor may register for them are (IAB Europe, TCF v2.2):

How a vendor reads it, per the implementation guidelines: evaluate publisher restrictions first; then check its own vendor ID in VendorConsent or VendorLegitimateInterest; then the purpose bit. Processing is allowed "only if both signals are positive for the applicable legal basis". A vendor that is not in DisclosedVendors was not shown to the user and may not process (TCF Implementation Guidelines).

The Global Privacy Platform carries the TC String as section 2 inside regs.gpp, with regs.gpp_sid listing the applicable sections. IAB Tech Lab's GPP API v1.1 is the current client-side interface, and the Lab shipped GPP updates with the Data Deletion Request Framework v2 on 23 October 2025 (IAB Tech Lab, GPP; IAB Tech Lab press releases). A bidder should read regs.gpp first and fall back to user.consent and regs.gdpr.

The TCF itself has been litigated for four years. The outcome defines who is responsible for what.

What this means in practice: IAB Europe answers for the consent string; publishers, CMPs, SSPs and DSPs answer for what they do with it and with the bid request. Nobody in the chain can point to the framework as their legal basis.

The direction of travel is clear. The 2021 cases were about banner design. The 2023 cases were about legal basis and transfers. The 2025 and 2026 cases are about what travels in the request and who in the chain is accountable for it.

The example is OpenRTB 2.6 with inline comments (strip the comments before use; JSON does not allow them). It shows an EU user who has consented to purposes 1, 2, 3, 4 and 7 for vendor 999 (the receiving DSP) and vendor 21 (the exchange).

{
  "id": "4f2a9c1e-7b3d-4e2f-9a1c-5d6e7f8a9b0c",
  "tmax": 120,
  "imp": [{
    "id": "1",
    "banner": { "w": 300, "h": 250, "pos": 1 },
    "secure": 1,
    "pmp": { "private_auction": 1, "deals": [{ "id": "eu-only-deal-42", "bidfloor": 1.20 }] }
  }],
  "site": {
    "id": "site-77", "domain": "example.de", "page": "https://example.de/wirtschaft/artikel",
    "cat": ["IAB13"],                       // context: no legal basis needed
    "publisher": { "id": "pub-7" }
  },
  "device": {
    "ua": "Mozilla/5.0 ...",                // keep; no fingerprinting without purpose 1
    "ip": "203.0.113.0",                    // truncated last octet; full IP only with consent
    "geo": { "country": "DEU", "type": 2 }, // coarse; precise geo needs special feature 1
    "ifa": "",                              // empty: web traffic; in-app only with purpose 1 consent
    "lmt": 0, "dnt": 0                      // honour if set to 1
  },
  "user": {
    "id": "exch-cookie-9f8e...",            // present only because purpose 1 consent for vendor 21 is set
    "buyeruid": "dsp-sync-3c2b...",         // present only because vendor 999 has purposes 1 to 4
    "consent": "CQAbcDEFAbcDEFAAAAENCZCAAAAAAAAAAAAAAAAAAAAA...",  // TC String, v2.3 with DisclosedVendors
    "eids": [{
      "source": "euid.eu",                  // EUID token; vendor must be in VendorConsent
      "uids": [{ "id": "A4...", "atype": 3 }]
    }]
  },
  "regs": {
    "gdpr": 1,                              // GDPR applies
    "gpp": "DBABMA~CQAbcDEFAbcDEF...",      // GPP string; section 2 = TCF EU v2
    "gpp_sid": [2],
    "ext": { "gdpr": 1 }                    // legacy field for 2.5 consumers
  },
  "source": { "ext": { "schain": { "ver": "1.0", "complete": 1, "nodes": [{ "asi": "exchange.example", "sid": "pub-7", "hp": 1 }] } } },
  "ext": { "consent_audit_id": "cmp-log-2026-10-17T10:04:11Z-8812" }   // optional: your own pointer to the consent record
}

Field semantics are from the IAB Tech Lab specification (OpenRTB 2.6). The consent_audit_id extension is not standard; it illustrates the practice of keeping a pointer from every request to the consent record that justified it, which is what the Xandr decision implies a platform must be able to produce.

Apply these steps at the SSP or exchange edge, before the request leaves your control. They assume regs.gdpr is 1 (or omitted with EU geolocation).

1. No TC String, or a TC String with no purpose 1 consent: remove user.id, user.buyeruid, user.eids, user.data, device.ifa; truncate device.ip; reduce device.geo to country; keep site, app, imp, regs, source. Send a context-only request or no request.
2. Purpose 1 present, but the receiving vendor is not in VendorConsent for purposes 2 to 4: remove user.id, user.buyeruid, user.eids for that buyer; keep the TC String so the buyer can verify.
3. Vendor has purposes 2 and 7 only (non-personalized ads and measurement): send the request without user.eids and user.data; buyer may bid on context and measure.
4. DisclosedVendors missing (pre-v2.3 string): treat as v2.2 until 28 February 2026; after that date treat the string as non-compliant and fall back to step 1 (IAB Europe).
5. Special feature 1 not opted in: never send precise device.geo (lat/long, type 1).
6. Sensitive app or content category: drop identifiers regardless of consent unless you hold an explicit Article 9(2)(a) consent for that category; the Grindr chain shows why (EDPB, 16 October 2026).
7. Buyer outside the EEA: apply steps 1 to 6 and, in addition, record the transfer mechanism; the sovereignty side of this is in EU sovereign ad tech.
8. Log the decision. Store the request ID, the TC String hash, the vendor IDs evaluated and the stripping outcome, so that an audit can reconstruct the chain.

A bidder on the buy side should apply the mirror image: decode before bidding, bid on context only when the signals are absent, and never write a cookie or sync an ID on the win notification without purpose 1 consent. The identity side of the question is in Identity after Privacy Sandbox; the architecture of the request path is in RTB architecture explained and the bidstream flow diagram.

The UK kept GDPR as UK GDPR and the ePrivacy rules as PECR. The TCF is used in the UK under the same v2.2 and v2.3 policies, with PublisherCC set to GB. Four things differ.

The Act received Royal Assent on 19 June 2025 (Clyde & Co, July 2025); the cookie and enforcement provisions commenced on 5 February 2026 under SI 2026/82, which also says breaches before that date are enforced under the old rules (SI 2026/82). For the bidstream the net effect is small: advertising identifiers still need consent, the statistical exception does not cover ad measurement that identifies users, and the penalty for a non-compliant banner is now forty times higher.

Is a bid request personal data under GDPR? Usually yes. It carries an IP address, often a cookie or advertising ID, and the TC String, which the CJEU held on 7 March 2024 is itself personal data when linkable to an IP address (CJEU C-604/22). A request reduced to context and a truncated IP can fall outside the definition, which is the point of the strip list above.

What is the difference between TCF 2.2 and TCF 2.3? v2.2 (launched 16 May 2023, mandatory 20 November 2023) removed legitimate interest for purposes 3 to 6, rewrote purpose texts, required vendor counts on the first layer and introduced GVL v3 (IAB Europe). v2.3 (launched April 2025, deadline 28 February 2026) made the Disclosed Vendors segment mandatory in every TC String so vendors declaring only special purposes can prove they were shown (IAB Europe).

Can I use legitimate interest for programmatic advertising? Not for personalized advertising inside the TCF: purposes 3 to 6 are consent-only since v2.2 (IAB Europe). Legitimate interest remains available for purposes 2, 7, 8, 9, 10 and 11, subject to a balancing test and publisher restrictions. Outside the TCF, the CJEU's Meta judgment of 4 July 2023 reads Article 6(1) narrowly (CJEU C-252/21).

What happens if gdpr=1 and there is no consent string? The implementation guidelines say that if transparency or consent information is unavailable where the TCF applies, "you may not be able to process the user's data" (TCF Implementation Guidelines). In practice: strip every identifier, truncate the IP, and send a context-only request or none. The Xandr decision of 2 October 2026 confirms that relying on an upstream party's claim of consent is not a defence (EDPB).

Does TCF apply in the UK after Brexit? The TCF is an industry framework, not a law, and UK publishers use it under UK GDPR and PECR with PublisherCC set to GB. The legal rule changed on 5 February 2026 when PECR regulation 6 was substituted under the Data (Use and Access) Act 2025, adding exceptions for statistics and appearance and raising fines to UK GDPR levels (legislation.gov.uk; SI 2026/82). Advertising identifiers still need consent.

1. Directive 2002/58/EC (ePrivacy Directive), Article 5(3). https://eur-lex.europa.eu/eli/dir/2002/58/oj
2. Regulation (EU) 2016/679 (GDPR), Articles 4(11), 6, 7, 9, 26, 44 to 49. https://eur-lex.europa.eu/eli/reg/2016/679/oj
3. CJEU, Case C-673/17, Planet49 (1 October 2019). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0673
4. EDPB, "Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive", final version (October 2024). https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22023-technical-scope-art-53-eprivacy-directive_en
5. CJEU, Case C-252/21, Meta Platforms v Bundeskartellamt (4 July 2023). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252
6. Irish Data Protection Commission, "Data Protection Commission announces conclusion of two inquiries into Meta Ireland" (4 January 2023). https://www.dataprotection.ie/en/news-media/data-protection-commission-announces-conclusion-two-inquiries-meta-ireland
7. Irish Data Protection Commission, "Data Protection Commission announces conclusion of inquiry into Meta Ireland" (22 May 2023). https://www.dataprotection.ie/en/news-media/press-releases/Data-Protection-Commission-announces-conclusion-of-inquiry-into-Meta-Ireland
8. EDPB, "EDPB: 'Consent or Pay' models should offer real choice" (17 April 2024). https://www.edpb.europa.eu/news/news/2024/edpb-consent-or-pay-models-should-offer-real-choice_en
9. European Commission, "Commission finds Apple and Meta in breach of the Digital Markets Act", IP/25/1085 (23 April 2025). https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1085
10. Belgian Data Protection Authority, "IAB Europe held responsible for a mechanism that infringes the GDPR" (2 February 2022; action plan 11 January 2023). https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr
11. CJEU, Case C-604/22, IAB Europe v Gegevensbeschermingsautoriteit (7 March 2024). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0604
12. DLA Piper Privacy Matters, "EU: Brussels Court of Appeal rules on IAB Europe and the TC String" (11 June 2025; judgment 14 May 2025). https://privacymatters.dlapiper.com/2025/06/eu-brussels-court-of-appeal-rules-on-iab-europe-and-the-tc-string-implications-for-gdpr-compliance/
13. IAB Europe, "TCF v2.2" (launched 16 May 2023; deadline 20 November 2023). https://iabeurope.eu/tcf-2-2/
14. IAB Europe, "Transparency & Consent Framework" (v2.3 launched April 2025; deadline 28 February 2026). https://iabeurope.eu/transparency-consent-framework/
15. IAB Tech Lab, "Consent string and vendor list formats v2" (TCF v2.x string specification; DisclosedVendors mandatory in v2.3). https://raw.githubusercontent.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/master/TCFv2/IAB%20Tech%20Lab%20-%20Consent%20string%20and%20vendor%20list%20formats%20v2.md
16. IAB Europe and IAB Tech Lab, "TCF Implementation Guidelines". https://raw.githubusercontent.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/master/TCFv2/TCF-Implementation-Guidelines.md
17. IAB Tech Lab, OpenRTB 2.6 specification. https://raw.githubusercontent.com/InteractiveAdvertisingBureau/openrtb2.x/main/2.6.md
18. IAB Tech Lab, "Global Privacy Platform" (GPP API v1.1). https://iabtechlab.com/standards/global-privacy-platform/
19. IAB Tech Lab, press releases (GPP updates and DDRF v2, 23 October 2025). https://iabtechlab.com/press-releases/
20. CNIL, "Sanctions issued by the CNIL" (Google and Facebook 31 December 2021; Criteo 15 June 2023; Shein 1 September 2025). https://www.cnil.fr/en/sanctions-issued-cnil
21. Privacy Laws & Business, "CNIL fines Google €325 million and Shein €150 million" (4 September 2025). https://www.privacylaws.com/news/cnil-fines-google-325-million-and-shein-150-million/
22. CNIL, "Closure of the injunction against Google" (decision 23 September 2026; published 14 October 2026). https://www.cnil.fr/en/closure-injunction-google
23. EDPB, "Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data" (16 October 2026; decision 2 October 2026). https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en
24. legislation.gov.uk, Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6 (as substituted 5 February 2026). https://www.legislation.gov.uk/uksi/2003/2426/regulation/6
25. legislation.gov.uk, The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, SI 2026/82 (made 29 January 2026). https://www.legislation.gov.uk/uksi/2026/82/made
26. Clyde & Co, "The Data (Use and Access) Act 2025" (July 2025; Royal Assent 19 June 2025). https://www.clydeco.com/en/insights/2025/07/the-data-use-and-access-act-2025
27. Mayer Brown, "PECR Reform: Rules relating to electronic marketing and cookies in the UK" (1 July 2025). https://www.mayerbrown.com/en/insights/publications/2025/06/the-data-use-and-access-act-pecr-reform-rules-relating-to-electronic-marketing-and-cookies-in-the-uk
28. ICO, "Guidance on the use of storage and access technologies" (published 20 December 2024; updated 29 April 2026). https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/

• 18 October 2026: aligned the title and heading and applied recorded source-URL corrections where needed. Factual research cutoff remains 17 October 2026.

• 17 October 2026. First edition. Covers TCF v2.2 and v2.3, the Market Court judgment of 14 May 2025, the CNIL decisions of 1 September 2025 and closure of 23 September 2026, the Xandr decision of 2 October 2026, and PECR as amended on 5 February 2026. Next review 15 January 2027.