TCF string decoder

What a TC string holds

A TC string is the IAB Transparency and Consent Framework’s record of one visitor’s choice, written by the consent management platform and read by every vendor that takes part. Its core segment is a run of bits, base64url-encoded: when it was created and updated, which CMP wrote it and against which version of the Global Vendor List, then the purposes consented, the purposes allowed on legitimate interest, the special features, and the two vendor lists. The layout is the IAB’s own consent string specification.

The eleven purposes

Names as the Global Vendor List (version 181) gives them. Purpose 1 is the one everything else leans on: without consent to store or read information on the device, no vendor may set or read a cookie, whatever else was agreed.

TCF and Google Consent Mode are two signals

Google’s tags read both, and they can disagree. Consent Mode is the page telling Google’s tag what it may do — gcs and gcd on the request, which the Consent Mode decoder reads. The TC string is the CMP’s record for every IAB vendor, Google among them as vendor 755, and it travels as gdpr_consent. A visitor can be granted in one and absent from the other when the CMP’s Google integration is set up halfway. Debugging Consent Mode from the requests covers the Google side.

What the decoder flags

• No consent for purpose 1 — vendors may not use cookies for this visitor.
• Google (#755) is not in the string — neither consent nor legitimate interest.
• Nothing consented — what a reject-all leaves, with any legitimate interest listed apart.
• A TCF v1 string — a framework version retired in 2020.

Questions

What is a TC string?

The Transparency and Consent string of the IAB’s TCF v2: one base64url value in which a consent management platform records which purposes and which vendors a visitor agreed to, or allowed on legitimate interest. Vendors read it instead of asking the CMP.

Where do I find the TC string?

On the requests themselves, as gdpr_consent (Google, Criteo, Adform and most ad tags carry it); in the euconsent-v2 cookie most CMPs write; or as tcString in the answer to __tcfapi('getTCData', 2, callback) in the console. Paste any of the three.

Why does the string on a hit differ from the CMP’s?

A hit carries the string the tag had when it left. If the visitor changed their choice afterwards, or a tag read the cookie before the CMP updated it, the platform was told something the CMP no longer holds. Decode both and compare.

Does this decoder read the whole string?

The core segment: the CMP and vendor list it was written against, the purposes, special features, and the vendor consent and legitimate interest lists. Segments after the first dot — disclosed vendors, publisher purposes — are counted but not read, as in the extension.

Is what I paste sent anywhere?

No. It is read in your browser and never put in the page address.