What the TC String Actually Is

The IAB Transparency & Consent Framework produces a single compact token — the TC string — that travels with every ad request and tells vendors exactly what a user has and hasn’t agreed to. It is Base64-URL encoded and packed at the bit level, so it looks like gibberish (CPxy...AAA) but encodes a precise, auditable record.

The Segments

A full TC string is several dot-separated segments. The first is the core string; others are optional:

• Core — CMP ID, CMP version, the consent timestamps, the policy version, and crucially the purpose consents and vendor consents bitfields.
• Disclosed vendors — which vendors were shown to the user.
• Publisher TC — consents specific to you, the publisher.

The bitfields are the heart of it: bit N set to 1 means consent for purpose N or vendor N. Purpose 1 is “store/access information on a device,” purpose 3 and 4 cover personalized ads, and so on.

Decoding One in Practice

You rarely decode bits by hand. Use the IAB-provided libraries or a public decoder:

• Split on . and Base64-URL-decode the core segment.
• Read the fixed-width header fields (version, created, lastUpdated, cmpId, cmpVersion).
• Walk the purpose and vendor bitfields to see exactly which are granted.

In JavaScript the __tcfapi('getTCData', 2, cb) call returns the already-parsed object — tcData.purpose.consents and tcData.vendor.consents are maps of id → boolean. That is your ground truth at runtime.

The Errors That Kill Revenue

When personalized demand silently disappears, the TC string is usually why:

• Missing string — the ad request carries no gdprApplies/TC string, so compliant SSPs drop to non-personalized.
• Vendor not consented — your demand partner’s vendor ID bit is 0, so they can’t bid with personalization.
• Expired or stale string — an old timestamp makes downstream platforms distrust it.
• Wrong CMP ID — a non-registered or test CMP ID invalidates the whole string.

A Debugging Workflow

Reproduce the user’s consent, grab the live TC string from __tcfapi or the ad request, run it through a validator, and compare the decoded purposes/vendors against what your partners require. Nine times out of ten the gap is a single vendor bit or a missing purpose 1.

Where FlexyConsent Fits

FlexyConsent generates spec-valid TC strings with a registered CMP ID, keeps them fresh, exposes the decoded state for debugging, and reports which purposes and vendors are actually being granted across your traffic — so you can see, not guess, where consent (and revenue) is leaking.

Key Takeaways

• The TC string is a bit-packed, auditable record of every consent choice.
• Purpose and vendor bitfields decide whether partners can serve personalized ads.
• Most revenue drops trace to a missing string, an unconsented vendor, or a stale/invalid CMP ID.
• Decode the live string with __tcfapi and validate it against partner requirements when debugging.