Privacy & regulation · also called TC String, GPP string
Consent string
A consent string is a compact encoded value recording a user's privacy choices, such as the TCF TC String or a GPP string, that travels with ad requests to vendors.
When you make a choice in a consent banner, the CMP needs a way to tell dozens of downstream companies what you decided. It writes the choice into a consent string: a short piece of encoded text containing which purposes you allowed, which vendors you permitted, and metadata such as when and through which CMP.
The best-known version is the TC String in the IAB IAB TCF, used across Europe. The IAB Global Privacy Platform string generalises the idea to many jurisdictions, including US state opt-outs. The string is stored in the browser and passed in bid requests via OpenRTB fields, so every SSP, DSP and measurement vendor can check it before processing personal data.
A consent string is only as good as the chain that respects it. Vendors must actually read it, apply it, and pass it on unaltered. The EU Court of Justice held in 2024 that a TC String can itself be personal data when it can be linked to a user. Missing, malformed or ignored strings are a common compliance finding in audits.
Think of it like this
A consent string is like a barcode on your visitor pass that every door scanner reads to know which rooms you have agreed to enter.
An example
A user in Sweden refuses personalised ads. The TC String in the bid request shows purpose 4 (use profiles to select personalised ads) as not consented, so a DSP bids only with contextual data.
Related terms
IAB TCF (Transparency & Consent Framework)
The IAB TCF (Transparency & Consent Framework) is IAB Europe's standard for collecting users' GDPR consent and objections through CMPs and passing those choices to ad tech vendors in a consent string.
IAB Global Privacy Platform (GPP)
The IAB Global Privacy Platform (GPP) is an IAB Tech Lab standard that packages privacy and consent signals for many jurisdictions, like US states and the EU, into one string.
CMP (consent management platform)
A CMP (consent management platform) is software that shows users privacy choices, such as a cookie banner, records their consent or opt-outs, and passes them to the site's partners.
GDPR
The GDPR (General Data Protection Regulation) is the European Union's data protection law, applying since May 2018, which governs how organisations collect and use personal data about people in the EU.
Bid request
A bid request is the message an SSP or exchange sends to potential buyers describing an available ad impression, inviting them to bid on it in a real-time auction.
Sources: IAB Tech Lab TCF technical specifications, IAB Tech Lab Global Privacy Platform, IAB Tech Lab OpenRTB