Publisher integration with the IAB Europe TCF

To integrate with the IAB Europe TCF, a publisher must implement an IAB registered TCF CMP on their site or app. The CMP creates and sends the Transparency and Consent (TC) string. Then, Google’s ad tags and SDKs consume the TC string they receive from the CMP.

Tip: Learn more about the new Google consent management requirements for serving ads in the EEA, the UK and Switzerland.

Included in this article are:

• General guidance
• Requirements for personalized and non-personalized ads
• Flexible vendor registration and publisher restrictions
• Additional Consent Mode
• Real-time bidding and Open Bidding
• Reservations
• Mediation
• Cookie matching

General guidance

If you have implemented an IAB Europe registered TCF CMP on your site or app, Ad Manager automatically consumes the TC string from the CMP.

Note: If you’re using Google’s IAB GDPR message, Ad Manager auto populates your selected Ad Technology Providers into all your messages. Otherwise, any CMP vendor selections in your IAB registered TCF CMP override Ad Technology Provider selections in the EU User Consent Controls. This includes if you have selected to serve non-personalized ads for all EEA, UK, and Swiss users through the EU User Consent Controls.

If you have set NPA in your ad request, we look at that and the consent indicated by the TC string and apply the most conservative setting.

• Passing the TC string to tags: GPT, GPT Passbacks, AdSense, and Ad Exchange Tags automatically communicate with the IAB CMP to forward the TC string to Ad Manager without publisher configuration. IMA SDK and Mobile Ads SDK automatically obtain, parse, and respect the TC string from within local storage. When Ad Manager publishers use tagless requests in place of an ad tag to request the raw creative code trafficked in the ad server, we do not have tags on the page that could interact with the CMP API. In this case we therefore rely on publishers sending us the TC string in URL parameters defined by the TCF spec. To do so, publishers need to pass the following signals manually: gdpr={0,1} and gdpr_consent={tc string}. You can also optionally pass addtl_consent={ac string}.
  Ad Manager won't request ads until a valid TC string is received.

• Passing the TC string to programmatic: The IAB TC string is automatically passed to Google’s programmatic channels without configuration required by publishers.

• Passing the TC string to non-programmatic creatives: Work with your creative provider to identify whether you need additional configuration for your creatives to ensure they consume the TC string correctly. Ad Manager offers support for the IAB TCF macros (${GDPR}, ${GDPR_CONSENT_XXXX}, and ${ADDTL_CONSENT}) to allow you to manually pass the TC string to other creative vendors as needed. Learn more about IAB TCF and reservations.

• Passing the TC string to mediation partners: The IAB TC string is available in device local storage (NSUserDefaults for iOS or SharedPreferences for Android) and accessible to all mediation partners to obtain, parse, and respect when called in a mediation waterfall request.

Requirements for personalized and non-personalized ads

Our interoperability guidance is intended to reflect Google's existing policy requirements, in particular the requirements of Google's EU User Consent policy and our policies against fingerprinting for identification (for example, those contained in our Requirements for Third-party Ad Serving). Google’s policies continue to apply and are more restrictive than IAB Europe TCF policies in some cases. Publishers should review the registration settings for the vendors they choose to work with through the IAB Europe TCF. The following requirements apply specifically when Google is a vendor in the publishers’ CMP.

Requirements to serve personalized ads

Google serves personalized ads when all of the following criteria are met:

• The end user grants Google consent to:
  • Store and/or access information on a device (Purpose 1)
  • Create a personalized ads profile (Purposes 3)
  • Select personalized ads (Purposes 4)
• Legitimate interest is established (or consent is granted, where a publisher configures their CMP to use publisher restrictions to request consent for Google) for Google to:
  • Select basic ads (Purpose 2)
  • Measure ad performance (Purpose 7)
  • Apply market research to generate audience insights (Purpose 9)
  • Develop and improve products (Purpose 10)

Requirements to serve non-personalized ads

If the requirements for personalized ads are not met, Google serves non-personalized ads when all of the following criteria are met:

• The end user grants Google consent to:
  • Store and/or access information on a device (Purpose 1)
• Legitimate interest (or consent, where a publisher configures their CMP to request it) is established for Google to:
  • Select basic ads (Purpose 2)
  • Measure ad performance (Purpose 7)
  • Apply market research to generate audience insights (Purpose 9)
  • Develop and improve products (Purpose 10)

Caution: If the previous requirements aren't met, only limited ads may be served:

• No consent for Purpose 1
• Legitimate interest or consent for Purposes 2, 7, 9, and 10

How the following scenarios are handled:

Description	Ad serving behavior
Lack of consent for Google to store and/or access information on a device (Purpose 1) In line with our existing EU User Consent policy, consent for cookies or mobile identifiers is required for both personalized and non-personalized ads. For non-personalized ads, consent for cookies or mobile identifiers is still required because non-personalized ads still use cookies or mobile identifiers to combat fraud and abuse, for frequency capping, and for aggregated ad reporting.	If you don't have consent for Purpose 1, Google attempts to serve a limited ad if you have legitimate interest or consent for Purposes 2, 7, 9, and 10. Swiss publishers who integrate with TCF can make use of the PurposeOneTreatment flag, as outlined in IAB Europe's TC String format specification.
Invalid TC string The TC string is not parseable (for example some fields are missing).	We don't serve an ad if the TC string is invalid.

Flexible vendor registration and publisher restrictions

IAB Europe TCF affords publishers the ability to customize a variety of restrictions. These allow publishers to indicate their own preferences, which take precedence over a vendor’s preferences, where applicable. Publishers can never cause a vendor to operate under a lawful basis or for a purpose which conflicts with the vendor’s Global Vendor List registration. Hence these are termed restrictions in that they never expand the scope of what a vendor can do but only restrict it.

Publishers should review the registration settings for the vendors they choose to work with through the TCF. If a vendor has registered flexibly with “legitimate interest” as the default lawful basis for a purpose where Google requires “consent” per our interoperability guidance, if a publisher wants to work with that vendor through Google products they should choose consent for that vendor in the publisher restrictions of their CMP.

Google has registered purposes 2, 7, 9, and 10 as flexible, defaulting to requiring legitimate interest. Unless a publisher configures their CMP to restrict Google to consent for these purposes, Google relies on legitimate interest where the CMP has established it with the user. Google is not flexibly registered for purposes 1, 3, and 4 and always requires consent for these purposes.

Additional Consent Mode

Additional Consent Mode is a temporary technical specification intended only for use alongside  IAB Europe TCF to serve as a bridge for vendors who are not yet registered on the IAB Europe Global Vendor List (GVL). This specification allows publishers, Consent Management Platforms (CMPs), and partners to gather and propagate additional consent—alongside their  IAB Europe TCF implementation—for companies that are not yet registered with the IAB Europe Global Vendor List but are on Google's Ad Tech Providers (ATP) list. Learn more about Additional Consent Mode.

Real-time bidding and Open Bidding

Note: Applies to all real-time bidding (RTB) and Open Bidding transactions, including Programmatic Direct deals.

The IAB Europe TCF logic applies to bid requests, bid responses, and cookie-matching requests.

We allow bid requests to be sent and activate cookie matching when a vendor registers with “Consent” or, in limited cases, “Not used” for Ads Personalization (Purposes 3 and 4 in the TC string). Vendors that register for “Consent” for the Personalized Ads purposes (Purposes 3 and 4 in the TC string), but have not been granted consent by the user:

• Won’t receive bid requests.

• Won’t receive a response to cookie match requests.

Additionally, the user must have given Google consent for Purpose 1, Purpose 3, and Purpose 4.

Reservations

We've launched a solution to support  IAB Europe TCF for reservations, including controls to indicate the vendors you’re working with on reservations. Learn more about declaring ad technology providers for creatives in Ad Manager reservation campaigns.

Mediation

If you've chosen to adopt the IAB Europe TCF solution, ensure that you are surfacing all of your mediation partners in your CMP. This ensures that Google can continue to make call outs to all partners in your mediation waterfall.

The TC and AC strings are evaluated by serving prior to the construction of the mediation waterfall and identify whether the mediation partner is present in one of the strings.

• If the mediation partner is present and the user has consented or legitimate interest has been established for at least one purpose, the mediation partner is included in the mediation waterfall as it is constructed.
• If the mediation partner is not present or the mediation partner has been fully declined by the user, the mediation partner is not called in the mediation waterfall.

Cookie matching

We support the gdpr and gdpr_consent fields to pass IAB Europe TCF consent information for both in-bound and out-bound cookie sync requests. These parameters are optional. If gdpr_consent= is not present, our standard EU User Consent Policy still applies.

If the &gdpr and &gdpr_consent parameters are present in the cookie match request, Ad Manager syncs cookies with third-party vendors request if all of the following criteria are met:

• The end user grants Google consent to:
  • Store and/or access information on a device (Purpose 1)
  • Create a personalized ads profile (Purposes 3)
  • Select personalized ads (Purposes 4)
• Legitimate interest (or consent, where a publisher configures their CMP to request it) is established for Google to:
  • Select basic ads (Purpose 2)
  • Measure ad performance (Purpose 7)
  • Apply market research to generate audience insights (Purpose 9)
  • Develop and improve products (Purpose 10)​
• The end user does not permit the vendor to use legitimate interest for "Create a personalized ads profile" (Purpose 3).
• The end user does not permit the vendor to use legitimate interest for "Select personalized ads" (Purpose 4).
• Each vendor either does not register for "Actively scan device characteristics for identification" (Special Feature 2), or registers Special Feature 2, but the Transparency & Consent (TC) string indicates the user did not opt-in to Special Feature 2.
• Each vendor needs to register for at least one purpose and have obtained a valid legal basis for that purpose.
• The end user grants the vendor consent for “Store and/or access information on a device” (Purpose 1).