A TC String, short for Transparency and Consent String, is a compact, encoded text value that records what a website or app disclosed to a user about data processing and what that user chose in response. It is the core data object of the IAB Europe Transparency and Consent Framework (TCF), the industry standard designed to help publishers and advertising technology companies comply with the General Data Protection Regulation (GDPR) and the ePrivacy Directive. The string exists because a single page view in programmatic advertising can involve dozens of companies, and each needs a machine-readable answer to one question before touching personal data: did this user agree, or at least not object, to this company processing data for this purpose?

According to the IAB Tech Lab specification, the string's primary purpose is "to encapsulate and encode all the information disclosed to a user and the expression of their preferences for their personal data processing under the GDPR." Vendors decode it to determine whether they hold a legal basis to proceed.

How a TC String is built

Only a consent management platform (CMP) registered with IAB Europe may create a TC String, using its assigned CMP ID. Vendors and other intermediaries are prohibited from creating or altering one. The sequence runs as follows. A user lands on a publisher's page. The CMP downloads the latest Global Vendor List (GVL), a JSON file published by IAB Europe every Thursday at 5:00 PM Central European Time, which lists each registered vendor, its numeric ID and the purposes it declares. The CMP shows the consent interface, records the user's choices and encodes them into the string.

The encoding packs fields into a sequence of bits, read left to right, then converts the result into URL-safe base64 text. The first segment, the core string, holds metadata and choices:

  • Version (6 bits), currently 2, which is why every TCF v2 string begins with the letter "C".
  • Created and LastUpdated (36 bits each), which since December 2021 carry the same day-level timestamp.
  • CmpId, CmpVersion and ConsentScreen, recording which CMP and which screen collected the choice.
  • ConsentLanguage and PublisherCC, two-letter language and country codes.
  • VendorListVersion and TcfPolicyVersion, which tie the string to a specific GVL and policy edition.
  • PurposesConsent and PurposesLITransparency (24 bits each), one bit per purpose for consent and for legitimate interest.
  • SpecialFeatureOptIns (12 bits), covering features such as precise geolocation.
  • Vendor consent and vendor legitimate interest sections, encoded either as a bitfield or as ranges of vendor IDs, whichever is shorter.
  • A publisher restrictions section, letting a publisher bar a vendor from a purpose or force it onto consent rather than legitimate interest.

Segments are joined by a dot. Since TCF v2.3, a Disclosed Vendors segment must follow the core, and an optional Publisher TC segment can carry the publisher's own legal bases. The sample published in the specification, CQSbk4AQSbk4ANwAAAENAwCgAAAAAAAAAAYgACPAAAAA.IDKQA4AAgAKAGQAygAAA, decodes to version 2, a creation date of June 3, 2025, CMP ID 880, English as the interface language and Germany as the publisher's country, with the second segment listing disclosed vendors.

Where the string travels

Storage is left to the CMP: a first-party cookie on the web, or NSUserDefaults on iOS and SharedPreferences on Android under keys prefixed IABTCF_. Page scripts retrieve the string through a JavaScript function named __tcfapi.

From there the string moves through the supply chain. In OpenRTB 2.6, the real-time bidding protocol maintained by IAB Tech Lab, the field regs.gdpr flags whether GDPR applies (0 or 1) and user.consent carries the string itself. Earlier OpenRTB versions placed both in extension objects. Pixels and redirects that cannot run JavaScript receive the string through URL macros: a parameter written as gdpr_consent=${GDPR_CONSENT_123} is replaced by the caller with the actual string for vendor 123. The specification states that strings "must always be propagated as is, and not modified."

Origin and evolution

IAB Europe began the framework's development in February 2017 with more than 70 member companies, as PPC Land reported. Version 1.1 of the consent string specification was released in April 2018, a month before GDPR became enforceable on May 25, 2018. Version 2.0 followed on August 21, 2019, adding publisher restrictions, legitimate interest signals and the Right to Object. Version 1 strings became invalid after September 30, 2020.

Further revisions targeted specific problems. IAB Europe announced on June 22, 2021 the end of global scope, under which strings sat in a third-party cookie on the consensu.org domain and applied across sites; such strings have been invalid since September 1, 2021. TCF v2.2, released in May 2023, removed legitimate interest as a legal basis for purposes 3 to 6, the purposes covering personalised advertising and content profiles. Strings with a policy version below 4 became invalid after September 30, 2023.

Version 2.3 addressed an ambiguity involving vendors that rely only on special purposes such as security and fraud prevention. Previously, an empty field left it unclear whether such a vendor had been shown to the user. The v2.3 draft opened for comment on April 19, 2025 and made Disclosed Vendors mandatory. Under the specification, strings created on or after March 1, 2026 must comply.

Why it matters for marketers

The TC String determines whether personalised advertising can run at all on European inventory. Google, registered as vendor 755 on the GVL, enforced v2.3 from March 1, 2026: non-compliant ad requests default to limited ads or are dropped, and a new error code 1.4 flags a missing or malformed Disclosed Vendors segment or one that omits Google.

Scale makes the signal significant. IAB Europe counted 953 registered vendors and 181 registered CMPs at the end of 2025, and vendor enforcement procedures rose from 269 in 2024 to 587 in 2025, an increase of 118.2 percent. The same report found outdated GVL use in about 14 percent of CMP audits. The string also feeds other systems: Google AdMob's consent syncing feature, launched November 10, 2025, resolves conflicts between apps using the string's LastUpdated timestamp.

The string's legal status has been contested for years. On February 2, 2022, the Belgian Data Protection Authority found that the TCF did not comply with Article 6 of the GDPR, treated the TC String as personal data and fined IAB Europe 250,000 euros. Hielke Hijmans, chairman of the authority's Litigation Chamber, said "the processing of personal data under the current version of the TCF is incompatible with the GDPR."

On March 7, 2024, the Court of Justice of the European Union (CJEU) ruled in Case C-604/22 that a TC String is personal data when it can be combined with identifiers such as an IP address, and that IAB Europe may be a joint controller for creating and using strings. On May 14, 2025, the Belgian Market Court confirmed IAB Europe's joint controllership only for TC String processing, not for downstream OpenRTB processing, and upheld the fine. On January 7, 2026, the same court annulled the authority's validation of IAB Europe's action plan. Townsend Feehan, IAB Europe's chief executive, welcomed "clear confirmation of IAB Europe's limited role in the TCF."

Structural criticisms remain. A string records a signal but cannot prove the interface behind it was fair; IAB Europe's own audits found 53 percent lacked an equally easy withdrawal mechanism. Vendors self-declare purposes. And vendor lists reaching four figures raise questions about informed consent: in a complaint against a non-TCF banner listing 1,741 partners, noyb's Felix Mikolasch said it would take "days or even weeks" to read the policies involved.

What a TC String is not

  • GPP string. The Global Privacy Protocol, from IAB Tech Lab, is a container that bundles multiple jurisdictions' signals in tilde-separated sections. A GPP string begins with "D", and the EU TCF string can sit inside it as section 2. GPP is a transport layer; the TC String is one payload.
  • US Privacy string. A four-character code such as 1YNN, built for the California Consumer Privacy Act opt-out model. IAB Tech Lab deprecated it on January 31, 2024 in favour of GPP. It records opt-outs, not opt-in consent.
  • Consent management platform. The CMP is the software that collects choices and writes the string; the string is its output. PPC Land's CMP explainer covers the platforms themselves.
  • Global Privacy Control. A browser-level signal, covered in PPC Land's GPC explainer, sent as an HTTP header rather than encoded by a publisher's CMP.

Recent developments

The framework is moving to specification v2.4 and policy v5.0.b. IAB Europe and IAB Tech Lab opened the changes for comment on May 29, 2026, covering multi-device consent, renaming Special Feature 2 to "Identify devices based on information actively requested" and removing the legitimate interest workaround for special-purpose-only vendors, now redundant given Disclosed Vendors. According to IAB Europe's confirmation letter of July 16, 2026, the specification and GVL update were published on July 23, 2026. CMPs must implement the new disclosures on the web by October 23, 2026 and in apps and connected TV by February 23, 2027. The changes sit mainly in the GVL, which gains a standardTexts field, rather than in the string's bit layout.

Timeline

  • February 2017 - IAB Europe begins the framework with more than 70 member companies
  • April 2018 - Consent string specification v1.1 released
  • May 25, 2018 - GDPR becomes enforceable
  • August 21, 2019 - TCF v2.0 specifications released
  • September 30, 2020 - TCF v1 strings become invalid
  • June 22, 2021 - Deprecation of global scope announced
  • September 1, 2021 - Global-scope strings become invalid
  • February 2, 2022 - Belgian Data Protection Authority fines IAB Europe 250,000 euros
  • May 2023 - TCF v2.2 removes legitimate interest for purposes 3 to 6
  • September 30, 2023 - Strings with policy version below 4 become invalid
  • January 31, 2024 - IAB Tech Lab deprecates the US Privacy string
  • March 7, 2024 - CJEU rules in Case C-604/22 that TC Strings can be personal data
  • April 19, 2025 - TCF v2.3 opens for public comment
  • May 14, 2025 - Belgian Market Court limits IAB Europe's joint controllership to TC Strings
  • November 10, 2025 - Google AdMob launches TC String consent syncing
  • January 7, 2026 - Market Court annuls validation of IAB Europe's action plan
  • March 1, 2026 - TCF v2.3 becomes mandatory for new strings; Google begins validation
  • May 29, 2026 - TCF v2.4 and Policies v5.0.b open for comment
  • July 23, 2026 - TCF v2.4 specification and GVL update published
  • October 23, 2026 - v2.4 web implementation deadline for CMPs
  • February 23, 2027 - v2.4 app and connected TV deadline for CMPs

Summary

Who: IAB Europe sets the TCF policies, IAB Tech Lab maintains the technical specifications, registered CMPs create TC Strings, and 953 registered vendors (as of end-2025) read them.

What: An encoded, base64 string recording disclosures made to a user and that user's consent and legitimate interest choices, per purpose and per vendor.

When: First specified in April 2018, overhauled as v2.0 in August 2019, revised through v2.2 (2023) and v2.3 (mandatory March 1, 2026), with v2.4 deadlines running from October 23, 2026.

Where: Stored on the user's device by the CMP and passed through OpenRTB bid requests, the __tcfapi JavaScript interface and URL macros across the European programmatic supply chain.

Why: To give every company in an ad transaction a standard, machine-readable signal of its legal basis under GDPR and the ePrivacy Directive, a role that European courts have ruled makes the string itself personal data.