IAB TCF Consent Strings: Reading One by Hand

Open your browser, find the consent cookie, and copy the string. It looks like random characters, and it is not. It is a base64-encoded record of the consent decision: which version of the framework, which CMP recorded it, when it was created, and which of the eleven purposes the user allowed. If you cannot read it, you cannot audit it.

What is inside the string

The Transparency and Consent Framework, maintained by IAB Europe, defines the TC string as a compact, base64url-encoded bitfield. The core string starts with the version, six bits, currently version 2, then the creation timestamp in 36 bits, the last-updated timestamp, the CMP id in 12 bits, and the CMP version. After that comes the consent language, the vendor list version, and the purposes: 24 bits, one per purpose, in the order the framework defines them. Eleven purposes exist in TCF v2.2, from storing information on a device to developing and improving products, plus special purposes and special features with their own bits.

The vendor section follows: a bitfield with one bit per vendor on the Global Vendor List, which now runs past 800 vendors. That is why the string is long, and why it changes length when the vendor list updates. A string that is short usually means a vendor list version from months ago, or a CMP that only records a subset. The string also carries the publisher's own purposes and the legitimate-interest signals, which are separate bits from consent, and confusing the two is the most common audit finding in the framework.

The three ways a string goes wrong

First, the version. A string that decodes to version 1 is a framework that no longer exists: TCF v1 was retired, and a v1 string in a 2026 cookie means the CMP never upgraded or the cookie is stale. Second, the CMP id. Every CMP on the Global Vendor List has a numeric id, and a string with an id of zero or an id that does not match the CMP on the page means the string was written by something else, or by nobody. Third, the purposes bitfield: all zeros means the user consented to nothing, which is a valid state, but all zeros on a page that fired marketing tags anyway means the tags ignored the string entirely.

Check the timestamps too. A creation date in the future means the clock is wrong or the string was forged. A last-updated date months old on a cookie that should refresh with every visit means the CMP is not writing updates. And check the vendor list version against the current one: a string built on a vendor list from a year ago does not know about the vendors added since, and the vendors it does know about may have changed their purposes. The upgrade context is IAB TCF v2.4 Upgrade: What Changed and What Breaks.

How to audit one in practice

Do not decode it by hand every time. Decode it once, by hand, so you understand the structure, then use a decoder for the routine checks. The IAB publishes the format, and several open decoders will parse a string into its fields: version, timestamps, CMP id, purposes, vendors. Run the string from your own site through one and check the four things that matter: the version is 2, the CMP id matches the CMP on the page, the purposes match what the user actually chose, and the vendors list is current.

Then compare the string to the tags. Load the page, decline everything, and watch the network tab: if a marketing tag fires with a string that says no to purpose 1, the string is not the problem, the tag is. The audit that matters is not the string itself. It is whether the string controls anything. The vendor-list problem that sits beside this is Your CMP Vendor List Has 800 Names. Here Is Why.. The cookie-scan gap is Auditing Consent: Cookie Scan vs Actual Trackers.

Frequently asked questions

What is a TC string?

A base64url-encoded record of a consent decision under IAB Europe's Transparency and Consent Framework. It encodes the framework version, the CMP id, creation and update timestamps, the purposes the user allowed, and the vendors consented to.

How many purposes does TCF v2.2 have?

Eleven purposes, plus special purposes and special features with their own bits. Consent and legitimate interest are separate signals, and confusing the two is the most common audit finding.

What does a CMP id of zero mean?

The string was written by something that is not a registered CMP, or by nobody. Every CMP on the Global Vendor List has a numeric id, and a zero or mismatched id means the string does not match the CMP on the page.

How do I check whether my TC string is being honored?

Decline everything, then watch the network tab. If a marketing tag fires while the string says no to the relevant purpose, the tag is ignoring the string, and the string is not the problem.