Publisher integration with the IAB Europe TCF

To integrate with the IAB Europe TCF, a publisher must implement an IAB registered TCF CMP on their site. The CMP creates and sends the TC (Transparency & Consent) string. Then, Google’s ad tags consume the TC string they receive from the CMP.

Tip: Learn more about the new Google consent management requirements for serving ads in the EEA, the UK, and Switzerland. 

If you do not have consent for Google for Purpose 1 (Store and/or access information on a device), you should not call Google’s ad tag.

General guidance

If you have implemented an IAB Europe registered TCF CMP on your site, AdSense automatically consumes the TC string from the CMP.

Note: Any CMP vendor selections in your IAB registered TCF CMP will override Ad Technology Provider selections in the EU User Consent Controls. This includes if you have selected to serve non-personalized ads for all EEA, UK, and Swiss users via the EU User Consent Controls.

If you have set NPA in your ad request, we will look at that and the consent indicated by the TC string and apply the most conservative setting.

• Passing TC string to tags: GPT, GPT Passbacks, AdSense, and Ad Exchange Tags will automatically communicate with the IAB CMP to forward the TC string to AdSense without publisher configuration. IMA SDK and Mobile Ads SDK will automatically obtain, parse, and respect the TC string from within local storage. For other tag types you will need to pass the following signals manually: gdpr={0,1} and gdpr_consent={tc string}.
• Passing TC string to programmatic: The IAB TC string is automatically passed to Google’s programmatic channels without configuration required by publishers.
• Passing the TC string to non-programmatic creatives: Work with your creative provider to identify whether you need additional configuration for your creatives to ensure they consume the TC string correctly. AdSense offers support for the IAB TCF macros (GDPR and GDPR_CONSENT_XXXX) to enable you to manually pass the TC string to other creative vendors as needed.

Requirements: Personalized & Non-Personalized Ads

Our interoperability guidance is intended to reflect Google's existing policy requirements, in particular the requirements of Google's EU User Consent policy and our policies against fingerprinting for identification (for example, those contained in our Requirements for Third-party Ad Serving). Google’s policies continue to apply and are more restrictive than IAB Europe TCF policies in some cases.

Note: As of November 2023, Search Ads publisher products (Adsense for Search, Adsense for Shopping and Programmable Search Engine) have begun the process of no longer serving personalized ads.

Publishers should review the registration settings for the vendors they choose to work with via the IAB Europe TCF. The following requirements apply specifically when Google is a vendor in the publishers’ CMP.

Requirements to serve personalized ads

Google will serve personalized ads when all of the following criteria are met:

• The end user grants Google consent to:
  • Store and/or access information on a device (Purpose 1)
  • Create a personalized ads profile (Purposes 3)
  • Select personalized ads (Purposes 4)
• Legitimate interest (or consent, where a publisher configures their CMP to request it) is established for Google to:
  • Select basic ads (Purpose 2)
  • Measure ad performance (Purpose 7)
  • Apply market research to generate audience insights (Purpose 9)
  • Develop and improve products (Purpose 10)

Requirements to serve non-personalized ads

If the consent requirements for personalized ads are not met, Google will serve non-personalized ads when all of the following criteria are met:

• The end user grants Google consent to:
  • Store and/or access information on a device (Purpose 1)
• Legitimate interest (or consent, where a publisher configures their CMP to request it) is established for Google to:
  • Select basic ads (Purpose 2)
  • Measure ad performance (Purpose 7)
  • Apply market research to generate audience insights (Purpose 9)
  • Develop and improve products (Purpose 10)

We will handle the following scenarios according to the table below:

Description	Ad serving behavior
Lack of consent for Google to store and/or access information on a device (Purpose 1) In line with our existing EU User Consent policy, consent for cookies or mobile identifiers is required for both personalized and non-personalized ads. For non-personalized ads, consent for cookies or mobile identifiers is still required because non-personalized ads still use cookies or mobile identifiers to combat fraud and abuse, for frequency capping, and for aggregated ad reporting.	Publishers should not call Google’s ad tags. If consent is missing for Google for Purpose 1 in the TC string, Google will drop the ad request and no ads will be served.
Lack of consent for Search Ads publisher products (AdSense for Search, Adsense for Shopping and Programmable Search Engine) to apply market research to generate audience insights (Purpose 9) Search Ads publisher products do not require consent for Purpose 9.	Search Ads publisher products may serve ads if consent is obtained for the other required purposes.
Invalid TC string The TC string is not parseable (for example some fields are missing).	We do not serve an ad if the TC string is invalid.

Flexible vendor registration & publisher restrictions

IAB Europe TCF affords publishers the ability to customize a variety of restrictions. These allow publishers to indicate their own preferences, which will take precedence over a vendor’s preferences, where applicable. Publishers can never cause a vendor to operate under a lawful basis or for a purpose which conflicts with the vendor’s Global Vendor List registration. Hence these are termed restrictions in that they never expand the scope of what a vendor can do but only restrict it.

Publishers should review the registration settings for the vendors they choose to work with via the IAB Europe TCF. If a vendor has registered flexibly with “legitimate interest” as the default lawful basis for a purpose where Google requires “consent” per our interoperability guidance, and if a publisher wants to work with that vendor via Google products they should choose consent for that vendor in the publisher restrictions of their CMP.

Google has registered purposes 2, 7, 9, and 10 as flexible, defaulting to requiring legitimate interest. Unless a publisher configures their CMP to restrict Google to consent for these purposes, Google will rely on legitimate interest where the CMP has established it with the user. Google is not flexibly registered for purposes 1, 3, and 4 and always requires consent for these purposes.

Real-Time Bidding (RTB) & Open Bidding

The IAB Europe TCF logic will apply to bid requests, bid responses and creatives, and cookie-matching requests.

We will allow bid requests to be sent and enable cookie matching when a vendor registers with “Consent” or, in limited cases, “Not used” for Ads Personalization (Purposes 3 and 4 in the TC string). Vendors that register for “Consent” for the Personalized Ads purposes (Purposes 3 and 4 in the TC string), but have not been granted consent by the user:

• Won’t receive bid requests.
• Won’t receive a response to cookie match requests.
• Won’t be allowed to win an auction. Google will block creatives that have vendors that do not meet our policy requirements from winning auctions or serving ads.

Additionally, the user must have given Google consent for Purpose 1, Purpose 3, and Purpose 4.