The Global Vendor List (GVL) is a machine-readable file, published by IAB Europe, that names every company approved to take part in the Transparency and Consent Framework (TCF) and records what each one says it does with personal data. Every registered vendor receives a permanent numeric ID and declares, purpose by purpose, whether it relies on consent or on legitimate interest under the General Data Protection Regulation (GDPR). The list exists because a European consent banner must tell users which companies want their data and why. Centralising those disclosures means every consent management platform (CMP) shows the same declarations, and every vendor checks the same reference when deciding whether it holds a legal basis.

According to the IAB Tech Lab specification, the GVL "lists all registered and approved Vendors, as well as standard Purposes, Special Purposes, Features, Special Features, Stacks, and categories of data collected in conjunction with the purposes."

What the file contains

The GVL is a single JSON document. Its header carries four values that govern how everything else is read. gvlSpecificationVersion identifies the file format, currently 3. vendorListVersion is a counter that rises by one with each weekly release. tcfPolicyVersion identifies the edition of the TCF Policies in force, and lastUpdated records the publication timestamp. The live file published on October 15, 2026 reported specification version 3, list version 181 and policy version 5.

Below the header sit the shared definitions. As of October 2026 the list defines 11 purposes, from Purpose 1 ("Store and/or access information on a device") through personalised advertising profiles (Purposes 3 and 4) to Purpose 11 ("Use limited data to select content"). It also defines three special purposes, such as security and fraud prevention, which users cannot refuse; three features and two special features, the latter covering precise geolocation and active device identification; 11 categories of data, such as IP addresses; and 45 stacks, pre-written combinations of purposes that let a CMP compress its first screen.

The bulk of the file is the vendor section. Each entry holds:

  • id and name. IDs are assigned incrementally and never reused; a departing vendor receives a deletedDate rather than being removed.
  • purposes and legIntPurposes, listing purposes claimed under consent and under legitimate interest respectively. A purpose cannot sit in both.
  • flexiblePurposes, where the vendor accepts either legal basis and lets a publisher choose.
  • specialPurposes, features, specialFeatures, dataDeclaration and dataRetention, the last giving retention in days per purpose.
  • urls, privacy policy and legitimate interest claim links, in up to 40 languages.
  • usesCookies, cookieMaxAgeSeconds, cookieRefresh and usesNonCookieAccess, storage disclosures added after the 2019 Planet49 ruling of the Court of Justice of the European Union (CJEU).
  • deviceStorageDisclosureUrl, a link to a vendor-hosted JSON file listing each cookie and storage key.

A vendor declaring a 90-day cookie, for example, enters cookieMaxAgeSeconds as 7776000 and sets cookieRefresh to true if the countdown restarts on each visit.

How CMPs and vendors use it

IAB Europe publishes a new version every Thursday at 5:00 PM Central European Time, according to the specification. The file sits at vendor-list.consensu.org/v3/vendor-list.json, and earlier releases are archived under numbered URLs.

A CMP must show users the latest version whenever its interface appears, whether for a first visit, a renewal or a settings review. When the user makes choices, the CMP writes the version number into the VendorListVersion field of the TC String it creates.

Vendors work backwards from that number. Under the specification, a vendor must use "the version of the GVL encoded in the TC String received" to decide whether it has a legal basis to process data and whether a partner it is about to pass data to has one too. A vendor that joined the list after the user chose was never shown to that user.

Since TCF v2.0, browsers may not fetch the GVL directly; CMPs and vendors must retrieve it server-side and honour its cache-control headers. When IAB Europe raises tcfPolicyVersion in a way that invalidates existing strings, CMPs must ask users again.

Origin and evolution

IAB Europe opened vendor registration in April 2018, weeks before the GDPR became enforceable on May 25, 2018. The first list lived at vendorlist.consensu.org. The TCF v2.0 specification, released on August 21, 2019, introduced the GVL version 2 format, with separate consent and legitimate interest declarations and flexible purposes. Google, listed on the GVL as vendor 755, integrated TCF v2.0 by August 15, 2020 for Ad Manager, AdSense and AdMob. The original vendorlist.consensu.org was decommissioned on January 31, 2021.

TCF v2.2 brought the largest structural change. The GVL version 3 format added retention periods, data categories and legitimate interest claim URLs, and dropped legitimate interest for Purposes 3 to 6. IAB Europe's archive shows version 1 of the new list published on May 18, 2023 with 10 vendors, as vendors re-registered. According to IAB Europe's v2.2 FAQ, the version 2 list stopped being published after November 20, 2023. Policy version 5, which CMP provider Didomi links to the March 2024 CJEU ruling, added Special Purpose 3 ("Save and communicate privacy choices") and first appears in list version 62, dated July 18, 2024.

Why it matters for marketers

The GVL decides which companies can be named on a European consent banner, and therefore which can bid on European inventory with a valid signal. A demand-side platform absent from the list receives no usable consent signal, whatever the user clicked. Google's March 2026 TCF v2.3 enforcement illustrates the dependency: TC Strings generated against a GVL version that predated Google's listing trigger an error requiring consent to be collected again, and strings whose Disclosed Vendors segment omits ID 755 are flagged with error code 1.4.

Removal from the list is also IAB Europe's main sanction. Under the vendor compliance programme launched in August 2021, a vendor that fails to fix a breach within 28 days is suspended and removed from the GVL; a fourth breach within 12 months brings immediate suspension for at least 14 days.

Researchers Paulina Jo Pesch and Cristiana Santos counted about 780 vendors in January 2022. IAB Europe's 2025 compliance report put the figure at 885 at the end of 2024 and 953 at the end of 2025, with vendor enforcement procedures up 118.2 percent to 587. Outdated GVL use was the most common technical failure among CMPs, at about 14 percent of audits.

Criticisms and limitations

The GVL is built on self-declaration. Vendors state their own purposes, retention periods and legal bases, and IAB Europe checks a sample. In 2025 it reviewed 180 compliance forms, selected at random at a rate of 15 vendors a month. The same report found 180 of 953 vendors, or 19 percent, declaring no advertising purposes at all.

Scale is a second objection. A banner that discloses the full list asks users to evaluate close to a thousand companies. Privacy advocates have argued that consent cannot be informed at that size; noyb's Felix Mikolasch said it would take "days or even weeks" to read the policies behind a non-TCF banner listing 1,741 partners.

Legal uncertainty runs through the framework. The Belgian Data Protection Authority found on February 2, 2022 that the TCF breached Article 6 of the GDPR. The CJEU later held that IAB Europe can be a joint controller for TC String processing, though the Belgian Market Court in May 2025 limited that role to the strings rather than downstream bidding. Legitimate interest declarations remain contested: a 2023 study by Victor Morel, Cristiana Santos and others found every TCF cookie paywall it examined also recorded legitimate interest purposes once a visitor clicked accept.

What the Global Vendor List is not

  • TC String. The string is a user-level record of choices; the GVL is the shared reference that gives the string's vendor IDs and purpose bits their meaning. PPC Land's TC String explainer covers the encoding.
  • Google's Ad Tech Providers list. Google publishes its own list of providers not registered on the GVL. Consent for them travels in a separate Additional Consent string (version 2 since December 2023), and Google ignores entries for any provider that the GVL already covers.
  • Global CMP List. IAB Europe publishes a parallel registry of CMPs. TC Strings from a CMP with a deletedDate must be discarded.
  • A publisher's vendor selection. The list is the full catalogue. Each consent management platform lets a publisher choose a subset to disclose, and the TC String's Disclosed Vendors segment records which were shown.

Recent developments

The GVL is at the centre of TCF specification v2.4 and Policies v5.0.b, which IAB Europe and IAB Tech Lab opened for comment on May 29, 2026. The specification adds a standardTexts field holding a mandatory explanation that features "can be used solely in pursuit of one or several purposes," and renames Special Feature 2 from "Actively scan device characteristics for identification" to "Identify devices based on information actively requested," to reflect device identification through browser Client Hints. During review, an IAB Tech Lab contributor suggested the new field would require gvlSpecificationVersion 4. The published file did not follow: list version 169, released on July 23, 2026, carried the new field and the new name while still reporting specification version 3.

According to IAB Europe's letter of July 16, 2026, CMPs must implement the new disclosures on the web by October 23, 2026 and in mobile apps and connected TV by February 23, 2027. The update also stops listing special-purpose-only vendors under legitimate interest, since the mandatory Disclosed Vendors segment introduced in v2.3 now records them.

Timeline

  • April 2018 - IAB Europe opens vendor registration for the GVL
  • May 25, 2018 - GDPR becomes enforceable
  • August 21, 2019 - TCF v2.0 specification introduces GVL version 2 format
  • August 15, 2020 - TCF v1 to v2 switchover; Google integrates TCF v2.0
  • January 31, 2021 - Original vendorlist.consensu.org domain decommissioned
  • August 2021 - IAB Europe launches vendor compliance programme with GVL suspensions
  • January 2022 - About 780 vendors registered, per Pesch and Santos
  • February 2, 2022 - Belgian Data Protection Authority rules against the TCF
  • May 18, 2023 - First GVL version 3 file published for TCF v2.2
  • November 20, 2023 - GVL version 2 format stops being published
  • March 7, 2024 - CJEU ruling on TC Strings and joint controllership
  • July 18, 2024 - Policy version 5 appears in the GVL (list version 62)
  • December 31, 2025 - 953 vendors registered
  • May 29, 2026 - TCF v2.4 and Policies v5.0.b open for comment
  • July 23, 2026 - GVL list version 169 adds standardTexts and renames Special Feature 2
  • October 15, 2026 - GVL list version 181 published
  • October 23, 2026 - Web deadline for CMPs to implement v2.4 disclosures
  • February 23, 2027 - App and connected TV deadline for v2.4 disclosures

Summary

Who: IAB Europe publishes and polices the list, IAB Tech Lab maintains its technical format, 953 vendors were registered at the end of 2025, and registered CMPs display it to users.

What: A weekly JSON file defining the TCF's purposes, features, stacks and data categories, and recording each vendor's ID, legal bases, retention periods and device storage practices.

When: Registration opened in April 2018; the format was rebuilt for TCF v2.0 in 2019 and v2.2 in 2023, and updated for v2.4 on July 23, 2026, with CMP deadlines of October 23, 2026 and February 23, 2027.

Where: Hosted at vendor-list.consensu.org, fetched server-side by CMPs and vendors, and applied wherever TCF consent governs advertising in Europe.

Why: To give every consent banner the same vendor disclosures and every vendor the same reference for checking its legal basis, a design that critics say rests on self-declaration and overwhelms users with scale.