{"page":"/blog/gdpr-eprivacy-bidstream-tcf","modified":"2026-10-18","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Field","What it carries","Personal data?","ePrivacy access?","Basis needed (EU)","Treatment without a valid signal"],"rows":[["imp, imp.banner, imp.video, imp.pmp","Ad slot, sizes, deal IDs","No","No","None","Keep"],["site.domain, site.page, site.cat, site.content","Page and content context","Usually no (watch sensitive content categories)","No","None for context; Article 9 care if content reveals health, politics, sexuality","Keep; suppress sensitive categories"],["app.bundle, app.name","App identity","No, but the app itself can be sensitive (the Grindr case)","No","None; Article 9 if the app reveals a special category","Keep unless the app is sensitive"],["device.ua, device.sua","User agent","Yes, in combination","Reading is passive, but fingerprinting is Article 5(3) access per EDPB 2/2023","Consent for profiling uses; purpose 1 for fingerprinting","Pass a reduced UA; no fingerprinting"],["device.ip, device.ipv6","IP address","Yes (CJEU C-604/22)","Not itself access, but used to link","Consent for identification; truncate otherwise","Truncate (drop last octet, or the IPv6 interface identifier)"],["device.geo","Location","Yes; precise location is TCF special feature 1","GPS read is access","Consent (special feature 1) for precise; coarse is context","Reduce to country or region"],["device.ifa","Advertising ID (IDFA, GAID)","Yes","Yes (reading an on-device identifier)","Purpose 1 consent plus purposes 2 to 4 for use","Remove"],["device.lmt, device.dnt","Limit-ad-tracking and Do Not Track flags","No","No","None; must be honored","Keep and honor"],["user.id, user.buyeruid","Exchange cookie ID; buyer's synced ID","Yes","Yes (cookie read)","Purpose 1 consent plus purposes 2 to 4","Remove"],["user.eids","Extended IDs (EUID, UID2, ID5, RampID)","Yes","Depends on source; a hashed email is personal data","Consent for the ID provider's vendor ID and purposes","Remove any ID whose vendor lacks consent"],["user.data","Segments from data providers","Yes; may reveal special categories","No","Consent for the provider and purposes 3 and 4","Remove"],["user.yob, user.gender","Demographics","Yes","No","Deprecated as of OpenRTB 2.6","Remove"],["user.consent","The TC String","Yes (CJEU C-604/22)","No","Needed to pass signals; its own processing is purpose 1 and the CMP's basis","Keep"],["regs.gdpr","1 if GDPR applies, 0 if not, omitted if unknown","No","No","n/a","Keep; treat omitted as 1 for EU geo"],["regs.gpp, regs.gpp_sid","Global Privacy Platform string and applicable sections","Contains the TC String when section 2 applies","No","n/a","Keep"],["source.schain, source.ext.schain","Supply chain","No","No","None","Keep"]],"sourceUrls":[[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[]]}