IAB TCF

IAB Transparency & Consent Framework v2.3 — TCF string parse/encode, vendor list lookup, purpose & special-feature checks.

Required by TCF Policy v2.3 §III.B.5 (CMP MUST signal which vendors received disclosure regardless of consent state). Deadline 2026-02-28 is past — Google Ads + every major DSP rejects v2.2-shaped strings since that date. EU/UK adtech operators that didn't migrate are losing inventory.

Consent-string format (TCF v2.3 spec, §A): base64url-no-pad of segments separated by .: Core | DisclosedVendors | (AllowedVendors) | PublisherTC. Core carries cmpVersion=2, version=4 (TCF v2.3), created/lastUpdated, cmpId, vendorListVersion, policyVersion=4, special-feature-opts-in, purpose-consents, purpose-LIs, vendor-consents bitmap, vendor-LIs bitmap, publisher restrictions. DisclosedVendors is REQUIRED in v2.3.

The framework does NOT bundle the IAB Global Vendor List — operators fetch the versioned JSON from https://vendor-list.consensu.org/v3/vendor-list.json and use parsed.core.vendorListVersion to load the matching cache entry.

b.iabTcf.parseString(tcString) #

Defensively parse a TCF v2.3 consent string (Core + optional DisclosedVendors / AllowedVendors / PublisherTC segments). Refuses non-string input, refuses payloads above 64 KiB, and caps every bit-field to spec-declared widths. Returns a structured object; per-segment decode failures land in errors[] instead of throwing so a partial parse still serves.

var parsed = b.iabTcf.parseString("CPXxRfAPXxRfAAfKABENB-CgAP_AAH_AAA");
parsed.core.version;
// → 4
parsed.errors;
// → []

b.iabTcf.requireV23Disclosed(tcString, opts) #

{
  audit: boolean,   // default true — emit accept/refuse audit events
}

Hard gate the operator wires upstream of every ad-bidder forward. Throws IabTcfError when the core/policy version is not 4 (i.e. a v2.2 string), when the DisclosedVendors segment is absent (mandatory since 2026-02-28 per TCF Policy v2.3 §III.B.5), or when base64url decoding fails. Emits iabtcf.refused / iabtcf.accepted to the audit chain so the regulator-facing record exists per request.

try {
  var parsed = b.iabTcf.requireV23Disclosed("CPXxRfAPXxRfAAfKABENB-CgAP_AAH_AAA");
  parsed.disclosedVendors.present;
  // → true
} catch (e) {
  // refuse the ad request
}

b.iabTcf.checkVendor(parsed, vendorId) #

Lookup a vendor id in a parsed TCF object. Returns three flags: consented (vendor in vendorConsents), legitimate (vendor in vendorLIs), disclosed (vendor in DisclosedVendors). Throws IabTcfError for malformed parsed or non-positive vendorId.

var parsed = b.iabTcf.parseString("CPXxRfAPXxRfAAfKABENB-CgAP_AAH_AAA");
var verdict = b.iabTcf.checkVendor(parsed, 755);
verdict.consented;
// → false
verdict.disclosed;
// → false

b.iabTcf.encode(obj) #

Serialise a TCF object — in the shape parseString returns — back into a TC string. Vendor and purpose collections may be Sets, arrays of ids, or the parsed { ids } / { vendorIds } sections. Vendor sections are written with whichever of the bit-field and range forms is smaller, matching the reference CMP encoders, so a parsed string round-trips to an equivalent signal. Pass disclosedVendors / allowedVendors / publisherTC to append those segments. Throws IabTcfError on a value that does not fit its field.

var s = b.iabTcf.encode({
  core: { version: 2, cmpId: 5, vendorListVersion: 100, consentLanguage: "EN",
          purposesConsent: [1, 2, 3], vendorConsents: [1, 28, 100], publisherCC: "DE" },
  disclosedVendors: [1, 28, 100],
});

b.iabTcf.isValid(tcString) #

Return true if the string parses as a well-formed TCF Core segment, false otherwise. A total predicate — never throws. Note this checks structural validity only; use requireV23Disclosed for the v2.3 policy gate.

b.iabTcf.isValid("CQSbk4AQSbk4ANwAAAENAwCgAAAAAAAAAAYgACPAAAAA");  // → true
b.iabTcf.isValid("nonsense");                                      // → false

Last updated 2026-08-08T16:39:49.652Z by seeder.