TCF, Consent Mode & GPP
Derive a TC string, Consent Mode signals, GPP string and Google Additional Consent from the subject's state.
When someone consents, Croombit translates that decision into the machine-readable strings ad-tech vendors read as standard — you configure your CMP’s metadata in the console once, and the API handles the encoding. You never implement TCF or GPP yourself.
IAB TCF v2.2
IAB Europe’s Transparency & Consent Framework is the standard hundreds of ad-tech vendors (Google, Meta, Criteo…) use to read your site’s consent. When someone consents, Croombit encodes their choices into a TC string — a compact binary blob. Your site’s scripts read it via window.__tcfapi; compliant vendors won’t process personal data without valid consent in that string.
TCF configuration in the console
Go to Site → Consent signals → IAB TCF v2.2.
| Field | What to put |
|---|---|
| CMP ID | Your numeric ID from the IAB Europe CMP registry (iabeurope.eu/cmp-list). Required — vendors reject TC strings with no registered CMP. Your legal or ad-ops team has it; it looks like 42 or 187. |
| CMP version | An integer you bump each time you make a material change to your implementation. Start at 1. |
| Vendor list version | The GVL (Global Vendor List) version your TC string is built against. Must match the latest one you loaded from vendor-list.consensu.org. |
| Publisher country | ISO 3166-1 alpha-2 code for your company's country (not your visitors'). E.g. ES, DE, GB. |
| Disclosed vendor IDs | Comma-separated GVL numeric IDs for every vendor your site uses. Only declared vendors appear in the TC string. Common ones: Google Ads = 755, Meta = 25, Criteo = 91, Amazon = 793. |
| Google AC provider IDs | IDs from Google's Additional Consent (ATP) extension, for vendors outside the GVL. Only needed if you use Google Ad Manager or AdSense. |
API — TC string
GET /v1/consent/tcstring?subject=email:user@example.com
→ { "tcString": "CQ…", "tcfPolicyVersion": 4, "purposesConsent": [2,7], "cmpId": 300 }API — Google Consent Mode v2
GET /v1/consent/google-consent-mode?subject=email:user@example.com
→ { "signals": { "ad_storage": "granted", "analytics_storage": "denied",
"ad_user_data": "granted", "security_storage": "granted", … } }The SDK applies it for you: await tc.applyConsentMode(subject, gtag).
Global Vendor List (GVL)
GET /v1/tcf/vendor-list returns the cached GVL — the same object that __tcfapi("getVendorList", 2, cb) must provide. Wire it to your __tcfapi implementation or let the CMP bundle handle it. The GVL is refreshed weekly.
API — Google Additional Consent (AC string)
For Google ad-tech vendors that are outside the IAB GVL, Google defines a separate AC string. Pass it alongside the TC string when calling Google tags.
GET /v1/consent/google-additional-consent?subject=email:user@example.com
→ { "acString": "1~1.35.41.101" }US privacy · GPP usnat
IAB’s Global Privacy Platform is the US equivalent of TCF. Its usnat section encodes your privacy notices and opt-out signals into a compact string ad-tech vendors read. It covers CCPA (California), VCDPA (Virginia), CPA (Colorado) and other US state laws in one unified signal.
Unlike TCF (opt-in), US laws use an opt-out model: you disclose to users, they can decline, and vendors read the GPP string to know whether they may process data. Per-visitor opt-out bits are computed automatically from consent state on every request — you only configure the static notice flags below.
GPP configuration in the console
Go to Site → Consent signals → US privacy · GPP usnat.
Notice flags (Notice/Opt-out fields): the value says whether you've shown that notice to users. Use 1 (Provided) if your consent UI or privacy notice includes that disclosure. Use 2 (Not provided) if you don't show it. Use 0 (Not applicable) only if that category is legally irrelevant to your entire business.
| Field | When to set 1 (Provided) |
|---|---|
| Emit usnat section | On if you have US visitors. Off produces a GPP string with no usnat section — vendors that require it may treat that as opt-out. |
| Sharing notice | Your privacy notice discloses that data may be shared with third parties. |
| Sale opt-out notice | Your site shows a "Do Not Sell My Personal Information" notice or link (CCPA). |
| Sharing opt-out notice | Your site offers a "Do Not Share" option (distinct from sale, under CPRA/California). |
| Targeted advertising opt-out notice | You show some "opt out of personalized ads" notice. |
| Sensitive data opt-out notice | Your site processes sensitive data (health, biometric, precise location) and tells users they can opt out. |
| Sensitive data limit-use notice | You notify users they can request their sensitive data use be limited. |
| Personal data consents | Your UI collects explicit opt-in consent for personal data (uncommon under opt-out-based US laws). Most sites leave this at 0. |
MSPA section: the Multi-State Privacy Agreement is a voluntary contract businesses sign with IAB. Most sites haven’t signed the MSPA — if that’s you, set "Covered transaction" to 2 (No) and leave the others at 0 (Not applicable).
| MSPA field | What to put |
|---|---|
| MSPA covered transaction | 1 (Yes) only if your legal team has signed the MSPA with IAB. Otherwise 2 (No). |
| MSPA opt-out option mode | Only relevant if Covered = Yes. Whether you operate in opt-out mode under the MSPA framework. |
| MSPA service-provider mode | Only relevant if Covered = Yes. 1 if you act purely as a data processor under the MSPA and don’t sell or share data on your own account. |
API — GPP string
GET /v1/consent/gpp?subject=email:user@example.com
→ { "gppString": "DBAB…", "sectionIds": [7], "usnat": { "SharingNotice": 1,
"SaleOptOut": 0, "SharingOptOut": 0, "TargetedAdvertisingOptOut": 0, … } }