TCF 2.3 decoder: read any TC String, including the Disclosed Vendors segment

Paste a string from the user.consent field of a bid request, from a gdpr_consent URL parameter, or from your consent management platform's API output. The decoder names each purpose and vendor from the current Global Vendor List and tells you which checks the string fails.

1. Paste the string. Any TC String works, with or without its optional segments. If you paste a Global Privacy Protocol string (it starts with D and contains ~), the decoder offers to open section 2 here or send you to the GPP consent string decoder.
2. Read the summary card. It shows the version, the CMP, the dates, the policy version and a pass, warning or error badge for each check.
3. Open the segments. Each segment lists its fields in order, with the raw bits on hover and a plain-English label for every purpose and special feature.
4. Look up a vendor. Type a vendor ID or name to see its consent bit, its legitimate interest bit, whether the CMP disclosed it, and any publisher restriction that names it.
5. Copy or share. Copy the decoded JSON, or copy a link. The link keeps the string in the URL fragment, which browsers do not send to our server.

A TC String is a compact record that a consent management platform (CMP) writes after a user makes choices in a banner. It follows the IAB Europe Transparency and Consent Framework (TCF). Vendors decode it to learn what the user agreed to, and the string travels with the ad request as a consent string.

The string is URL-safe base64. Each character carries six bits, and the fields are read left to right in a fixed order (TC String specification). Segments are joined with a dot. The core segment always comes first; the other segments carry a three-bit type so that they can appear in any order.

The core segment holds 16 fixed fields before the vendor sections. The table below lists them in decoding order, which is the order the decoder shows.

Before version 2.3, a vendor that relied only on special purposes could not tell two cases apart. A zero in its legitimate interest bit might mean the CMP never showed it, or it might mean the user objected. IAB Europe fixed the ambiguity by making the Disclosed Vendors segment mandatory (IAB Europe, updated 15 December 2025).

The rule now has three parts. Strings created after 28 February 2026 without the segment are invalid. Strings created before 1 March 2026 without it remain valid until users renew or change their choices. Vendors must check their own bit in the segment before processing for special purposes. The specification adds that the old workaround, setting the legitimate interest bit for special-purpose-only vendors, was removed in April 2026 (IAB Tech Lab, TC String specification).

The decoder applies the date rule automatically. It reads the Created field, compares it with 1 March 2026, and reports the result in the summary card. A string without the segment and created on 13 January 2026 gets a note. The same string created on 13 March 2026 gets an error.

The IAB Tech Lab specification shows this three-segment example (TC String specification, "TC String Format"):

Two things stand out. The structure is a clean TCF 2.3 string, with the Disclosed Vendors segment present and every consented vendor disclosed. But the policy version is 2, so the decoder marks the string invalid under the 30 September 2023 rule. The specification uses it to show the format, not as a live consent record. That is a useful habit to copy: decode first, then read the warnings.

Every string below comes from the IAB Tech Lab specification or from IAB test code on GitHub. Paste any of them to see the full decode.

The fifth string is the most instructive. Four vendors have consent, yet the CMP disclosed none of them. A vendor that reads only its consent bit would process; a vendor that also reads the Disclosed Vendors bit would stop. The decoder reports the mismatch for each vendor.

The decoder separates errors, warnings and notes. An error means the string cannot be read or the specification calls it invalid. A warning means a vendor that follows the specification should not rely on the string as it stands. A note is information.

The decoder does not decide whether you have a legal basis to process data. It reports signals. What those signals allow under the GDPR and the ePrivacy Directive is covered in GDPR, ePrivacy and the bidstream. How to wire the string through OpenRTB, Prebid and GPP is covered in GPP and TCF implementation for engineers and in OpenRTB 2.6 explained.

The decoder follows the IAB Tech Lab TC String specification as published on GitHub on 9 November 2026. Purpose, feature and vendor names come from the GVL version the string names when that file is still published, and from the current GVL otherwise. The decoder tells you which one it used.

It checks only what the specification defines. It cannot tell whether the CMP showed a fair banner, whether the user saw the vendors it lists, or whether a country's rules on cookie banners differ. For those questions, see cookie banner rules by country and the EU Digital Omnibus tracker, which follows proposed changes to the consent rules themselves.

The hub for consent, identity and legitimate interest topics is identity and privacy.

1. IAB Tech Lab, "Transparency and Consent String with Global Vendor & CMP List Formats" (TCF specification, version history through May 2026; accessed 9 November 2026). https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20-%20Consent%20string%20and%20vendor%20list%20formats%20v2.md
2. IAB Europe, "All You Need to Know About the Transition to TCF v2.3" (updated 15 December 2025). https://iabeurope.eu/all-you-need-to-know-about-the-transition-to-tcf-v2-3/
3. IAB Europe, "TCF Policies v5.0.b and Specifications v2.4: confirmation of the timeline" (letter, 16 July 2026). https://iabeurope.eu/wp-content/uploads/TCF_V-CMP_comms_TCFpoliciesV5.0.bAndSpecificationsV2.4ConfirmationOf-theTimeline_160726_IABEurope.pdf
4. IAB Europe, Global Vendor List v3 (vendorListVersion 184, lastUpdated 5 November 2026; fetched 9 November 2026). https://vendor-list.consensu.org/v3/vendor-list.json
5. IAB Tech Lab, TCF Implementation Guidelines ("What changed in v2.3?"; accessed 9 November 2026). https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/TCF-Implementation-Guidelines.md
6. IAB Tech Lab, iabtcf-es reference library, core test file ReportedIssues.test.ts (repository state of 1 September 2026). https://github.com/InteractiveAdvertisingBureau/iabtcf-es/blob/master/modules/core/test/ReportedIssues.test.ts
7. IAB Tech Lab, iabtcf-es CLI README (accessed 9 November 2026). https://github.com/InteractiveAdvertisingBureau/iabtcf-es/blob/master/modules/cli/README.md
8. IAB Tech Lab, iabtcf-es CMP API test file ReportedIssues.test.ts (accessed 9 November 2026). https://github.com/InteractiveAdvertisingBureau/iabtcf-es/blob/master/modules/cmpapi/test/ReportedIssues.test.ts
9. IAB Tech Lab, iabgpp-es reference library, GppModel.test.ts (repository state of 3 August 2026). https://github.com/IABTechLab/iabgpp-es/blob/master/modules/cmpapi/test/GppModel.test.ts
10. Court of Justice of the European Union, Case C-604/22, IAB Europe (judgment of 7 March 2024). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0604