GPP and TCF implementation for engineers: how consent travels from the CMP to the bid request

The table follows one page view from the consent banner to the buyer. Field names are exact; check your logs against them.

Sources: TCF CMP API v2, GPP CMP API, Prebid TCF module, Prebid GPP module, Prebid Server privacy features, TCF string specification, GPP string specification.

Both APIs are global JavaScript functions that a CMP stub must define before any vendor script runs. Neither returns a value; each answers through a callback. Wait for a final status before you read a string, or you will read an empty or stale one.

For the TCF, getTCData was deprecated in TCF v2.2. Register a listener instead and act on tcloaded (a stored string loaded with no banner) or useractioncomplete (the user just confirmed), as the CMP API v2 requires:

For GPP, CMP API 1.1 (June 2023) removed return values and the getGPPData command. Listen for the signalStatus event and read only when it says ready. The CMP must set not ready before it changes any section and ready once it is done.

Two details cause most bugs here. A value of [-1] in applicableSections means no section applies, so do not forward it as gpp_sid. And gdprApplies can be undefined while the CMP is still deciding, which is not the same as false.

Prebid.js ships two modules for this hop: consentManagementTcf and consentManagementGpp. Both call the CMP APIs above, wait up to a timeout, then write the result into the auction. The current release line is 11.x; version 11.47.0 was published on 4 November 2026 (Prebid.js releases).

Build both into your package with gulp build --modules=consentManagementTcf,tcfControl,consentManagementGpp plus your bidder adapters. The optional tcfControl module enforces purposes inside Prebid.js, for example blocking storage without purpose 1 consent (Prebid TCF control module).

Where the values land matters for every adapter. The TCF module writes regs.ext.gdpr and user.ext.consent, the OpenRTB 2.5 locations. The GPP module writes regs.gpp and regs.gpp_sid, the 2.6 locations. Google's Additional Consent string goes to user.ext.ConsentedProvidersSettings.consented_providers, a non-standard path (consentManagementTcf.ts; consentManagementGpp.ts). Adapters can also read bidderRequest.gdprConsent and bidderRequest.gppConsent.

Since Prebid.js 11.14, a failed CMP lookup stops the User ID module from running; a timeout does not (Prebid GPP module). Header bidding setup in general is covered in header bidding explained.

OpenRTB 2.6 promoted the GDPR flag and the TC String out of ext and added gpp and gpp_sid in release 2.6-202211 (OpenRTB 2.6, Object: Regs). Many systems still read the old paths, so most exchanges send both.

Sources: OpenRTB 2.6, Prebid Server convert_down.go, TCF string specification, URL macros, GPP string specification, URL macros, Google Authorized Buyers OpenRTB guide, Google Additional Consent spec, US Privacy String specification.

Prebid Server sits in the middle of this. It passes regs.gpp and regs.gpp_sid through, and it "parses the GPP container for TCF2 and USP strings, extracting them to the original ORTB location" (Prebid Server privacy features). For each bidder that does not declare OpenRTB 2.6, it moves regs.gdpr, user.consent and regs.us_privacy back into ext. In Prebid Server Go on 30 October 2026, 58 of 281 bidder adapters declared 2.6 (our count; method in OpenRTB versions compared). Running your own instance is covered in the Prebid Server self-hosting guide.

This OpenRTB 2.6 request comes from a German news site. The user consented on a TCF 2.3 banner, and the CMP also exposes GPP. Field meanings are in the table below the JSON; the full 2.6 field guide is OpenRTB 2.6 explained.

The TC String was generated for this page with CMP ID 0, the placeholder that IAB Tech Lab's own library tests use, so a strict decoder will flag it. Paste it into the TCF consent string decoder or the whole regs.gpp value into the GPP consent string decoder to see every field. Vendor ID 755 is Google Advertising Products on the vendor list (GVL v3).

When Prebid Server forwards this request to an adapter without an OpenRTB 2.6 flag, it moves the GDPR flag and the TC String into ext. It keeps gpp and gpp_sid, which have no 2.5 home (convert_down.go).

A bidder that reads only regs.gdpr would see this request as "GDPR unknown". That is why the read rule in the common mistakes below says to check both places.

This request comes from a weather app in California. The publisher uses the MSPA US National section, and the user opted out of sharing and targeted advertising. The string uses the version 2 layout, the one in force before the November 2026 revision.

The field values follow the version 2 text (US National specification, June 2026). We encoded the string for this page and checked our encoder against the reference library's test string DBABLA~CAAAVVVVVVRA.QA (iabgpp-es GppModel tests). A buyer reading this string sees an opt-out of targeted advertising, so the usual practice is to bid on context and keep the advertising ID out of profiling.

TCF 2.3 changed one thing in the string: the Disclosed Vendors segment, once optional, became mandatory. Before 2.3, a vendor that relied only on special purposes could not tell "not shown to the user" from "user objected" when its legitimate interest bit was 0. The segment answers that with one bit per vendor (IAB Europe). The core segment layout did not change. The decoded fields are listed in our TCF consent string decoder, and the purposes and legal bases in GDPR, ePrivacy and the bidstream.

The "deadline conflict" is a difference of framing, not of rule. IAB Europe says the transition "concludes on 28th February, 2026" and that the rule applies "starting 1st March, 2026". Google calls 1 March 2026 the "mandatory deadline". Both mean the same check:

Sources: IAB Europe, updated 15 December 2025; Google Ad Manager Help; Google AdSense Help.

So the rule your validator should apply is: read the Created field; if it is 1 March 2026 or later and the Disclosed Vendors segment is missing, treat the string as invalid. The Created field holds a day-level timestamp, so the boundary is clean (TCF string specification). Third-party guides that quote 28 February are describing the end of the transition, not a different rule.

TCF 2.4 followed in 2026 without touching the string. It adds a standardTexts field and feature illustrations to the Global Vendor List, and renames special feature 2 (IAB Europe letter, 16 July 2026). Web CMPs had to comply by 23 October 2026; app and CTV CMPs have until 23 February 2027. A v2.4 string decodes exactly like a v2.3 string.

Google sets rules on top of the TCF for publishers using Ad Manager, AdSense and AdMob. Four matter for engineers.

1. A Google-certified CMP. Personalised ads to users in the EEA and UK have needed a certified CMP integrated with the TCF since 16 January 2024, and in Switzerland since 31 July 2024 (Google Ad Manager Help). Google's list showed 145 certified CMPs when we checked on 9 November 2026.
2. The TCF 2.3 rule above. New strings without Disclosed Vendors, or without Google disclosed, can fall back to Limited Ads (Ad Manager Help; AdSense Help).
3. Google's own legal bases. Google says it is "not flexibly registered for purposes 1, 3, and 4" and "always requires consent" for them. It registered purposes 2, 7, 9 and 10 as flexible, defaulting to legitimate interest (Ad Manager Help). The vendor list matches: vendor 755 lists consent purposes 1, 3 and 4 and legitimate interest purposes 2, 7, 9 and 10 (GVL v3, version 184).
4. Additional Consent for vendors outside the GVL. Google's AC string covers ad tech providers that are not on the vendor list. Version 2, the standard since December 2023, adds a disclosed list after dv., for example 2~1.10~dv.2.3.4 (Google Additional Consent spec).

On the buy side, Google's OpenRTB implementation sends the TC String in both user.consent and user.ext.consent. It sets the boolean regs.ext.gdpr to true in two cases. Either the CMP sends a valid string and says GDPR applies, or no string arrives and Google's own data places the impression in the EEA (Google Authorized Buyers OpenRTB guide).

For US traffic, GPP replaced the four-character US Privacy String, now marked deprecated as section 6 (GPP Section Information). The publisher chooses between one national section and per-state sections, and gpp_sid tells the buyer which one governs the transaction.

Sources: GPP Section Information; IAB Tech Lab GPP page.

That makes 20 state sections. The GPP decoder explains every field and value code. Which states treat which data as sensitive is tracked in our state health privacy laws tracker.

Support for state sections varies by tool. Prebid Server documents two modules for sections 7 to 12: one applies default interpretations, the other lets publishers write their own logic. Its privacy page does not mention sections 13 and higher (Prebid Server privacy features). Prebid.js adapters declare supported sections with the names tcfeu, tcfca, usnat, usstate_all and usp (Prebid GPP module). Check your stack against the full ID range before you rely on it.

IAB Tech Lab opened changes to the US sections for public comment on 11 August 2026, with comments due by 11 September. The changes support the Fifth Amended and Restated MSPA. They remove MSPA coverage for the state-by-state approach, end Service Provider and Opt-Out Option modes, and simplify notice and choice fields (IAB Tech Lab press release, 11 August 2026). Commits on 4 November 2026 merged them into the specification files (commit b997269).

Sources: US National specification, November 2026; version 2 text, June 2026. Version 1 lengths are from IAB Tech Lab's reference library, which reads 12 sensitive categories and 2 child bands for version 1 strings (iabgpp-es UsNatCoreSegment).

State sections keep their layout, but now say the MSPA fields "should not be used". The California section, for example, says MspaCoveredTransaction "must always be set to 2" and both mode fields to 0 (California section).

Treat version 3.0 as merged, not final. IAB Tech Lab's GPP page, last updated 12 August 2026, still described the update as in public comment on 9 November 2026, and we found no release announcement (IAB Tech Lab, GPP). The safe engineering move is to read the version field of every US National payload and branch on it. Version 1 and 2 strings will keep arriving from CMPs for months, and a parser that assumes one layout will misread the other two.

1. Reading the string before the CMP is ready. Act only on tcloaded or useractioncomplete for the TCF and on signalStatus ready for GPP. An early read returns an empty or old string.
2. Treating gdprApplies: undefined as false. Undefined means the CMP has not decided. Prebid's defaultGdprScope setting exists for exactly this case.
3. Sending gpp without gpp_sid. The string alone does not say which section governs the transaction, and a buyer will guess. Send both, and never send -1.
4. Reading only regs.gdpr or only regs.ext.gdpr. Prebid.js writes the ext form, Prebid Server may move it, and Google sends both. Read the core field first and fall back to ext.
5. Rewriting the string on the way through. The GPP specification says strings "must always be propagated as is, and not modified". Re-encoding to strip a section breaks decoding downstream.
6. Creating new TC Strings without Disclosed Vendors. Since 1 March 2026 they are invalid, and Google may serve Limited Ads. Check the CMP version, not only the banner.
7. Forgetting Google in Disclosed Vendors. AdSense's error code 1.4 fires when the segment "does not include Google". If you work with Google, vendor 755 must be disclosed.
8. Hard-coding one US National layout. Versions 1, 2 and 3.0 coexist in November 2026. Branch on the version field.
9. Assuming every tool covers all 27 sections. Some modules interpret only sections 7 to 12. Test with a string for each state you serve.
10. Dropping the URL macros on syncs. Pixels need ${GDPR_CONSENT_XXXXX} or ${GPP_STRING_XXXXX} with your own vendor ID, or the receiving server cannot check consent.

Test strings for each case can be decoded in the TCF decoder and the GPP decoder. UK specifics after the Data (Use and Access) Act are covered in UK Data (Use and Access) Act and advertising. The identity and privacy hub and the RTB architecture hub collect the related pages.

1. IAB Europe, "All You Need to Know About the Transition to TCF v2.3" (updated 15 December 2025). https://iabeurope.eu/all-you-need-to-know-about-the-transition-to-tcf-v2-3/
2. IAB Europe, "TCF Policies v5.0.b and Specifications v2.4: confirmation of the timeline" (letter dated 16 July 2026). https://iabeurope.eu/wp-content/uploads/TCF_V-CMP_comms_TCFpoliciesV5.0.bAndSpecificationsV2.4ConfirmationOf-theTimeline_160726_IABEurope.pdf
3. IAB Tech Lab and IAB Europe, "Consent string and vendor list formats v2" (version history to May 2026, v2.4). https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20-%20Consent%20string%20and%20vendor%20list%20formats%20v2.md
4. IAB Tech Lab, "CMP API v2" for the TCF (version history to February 2026). https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20-%20CMP%20API%20v2.md
5. IAB Europe, Global Vendor List v3 (vendorListVersion 184, tcfPolicyVersion 5, last updated 5 November 2026). https://vendor-list.consensu.org/v3/vendor-list.json
6. IAB Tech Lab, "Global Privacy Protocol String" specification (version 1, 28 September 2022; clarifications 3 November 2023). https://github.com/InteractiveAdvertisingBureau/Global-Privacy-Platform/blob/main/Core/Consent%20String%20Specification.md
7. IAB Tech Lab, GPP "Consent Management Platform API" (version 1.1, June 2023). https://github.com/InteractiveAdvertisingBureau/Global-Privacy-Platform/blob/main/Core/CMP%20API%20Specification.md
8. IAB Tech Lab, GPP Section Information (accessed 9 November 2026). https://github.com/InteractiveAdvertisingBureau/Global-Privacy-Platform/blob/main/Sections/Section%20Information.md
9. IAB Tech Lab and IAB Privacy, MSPA US National Technical Specification (version 3.0, November 2026). https://github.com/InteractiveAdvertisingBureau/Global-Privacy-Platform/blob/main/Sections/US-National/IAB%20Privacy%E2%80%99s%20Multi-State%20Privacy%20Agreement%20%28MSPA%29%20US%20National%20Technical%20Specification.md
10. Same specification, version 2 text (commit 00ffaef, 19 June 2026). https://github.com/InteractiveAdvertisingBureau/Global-Privacy-Platform/blob/00ffaefe91513785e886c83877e9b56a4ec8e88c/Sections/US-National/IAB%20Privacy%E2%80%99s%20Multi-State%20Privacy%20Agreement%20%28MSPA%29%20US%20National%20Technical%20Specification.md