Why Video Is Different

Video is often a publisher’s most valuable inventory, and it is also where consent signals are most likely to get lost. Display ads usually run through a header bidding wrapper and an ad server tag that read the CMP automatically. Video ads travel a longer path: the page loads a player, the player builds an ad request, an ad server returns a VAST document, and that document can point to further wrappers, tracking pixels and media files, each fetched by the player rather than by the page.

At every hop, the consent signal has to be passed along explicitly. When it is not, buyers either treat the impression as non-consented or drop it, and the highest-value format on your site quietly earns less than it should.

Step 1: Know How Your Player Reads Consent

Video players fall broadly into three groups:

• Players that read the CMP directly. They call __tcfapi or __gpp themselves and append the signals to ad requests.
• Players that expect you to supply consent. You pass the consent string and flags in the player configuration or directly in the ad tag URL.
• Players that do neither. Typically older or custom builds, where ad requests go out with no signal at all.

Check your player’s documentation and then verify the behaviour in the Network tab. Documentation describes what should happen; the request shows what does.

Step 2: Put the Signals on the Ad Request

Most ad servers and SSPs accept consent as URL parameters on the video ad request. Names vary by platform, but the common ones are:

• gdpr — 1 if GDPR applies to the request, 0 if not;
• gdpr_consent — the TCF consent string;
• addtl_consent — Google’s Additional Consent string, for vendors outside the TCF Global Vendor List;
• gpp and gpp_sid — the GPP string and the applicable section IDs;
• platform-specific flags for non-personalised or restricted data processing.

If the player builds tags from a template, make sure the values are filled in at request time, not when the page first loads. A visitor who accepts consent after the player initialises should not have their first ad request carry an empty string.

Step 3: Use the VAST Consent Macros

A VAST response often contains tracking URLs and wrapper URLs that are called by the player later. The IAB VAST 4.1 macro list includes [GDPRCONSENT], which the player is expected to replace with the consent string when firing those URLs. Ask your demand partners whether their tags use it, and confirm your player supports macro substitution. If the macro is left unreplaced, the receiving endpoint sees the literal placeholder rather than a valid signal.

Step 4: Handle Pre-Roll Timing

Pre-roll creates a timing tension. The ad request wants to fire as soon as the player is ready, but for a first-time EU visitor the banner may still be on screen. You have three options:

1. Wait for a decision. Hold the ad request until the CMP reports a final state. This gives buyers the best signal but can delay playback.
2. Request with the current state. Send the request immediately with whatever signal exists, accepting that the first ad may be treated as non-consented.
3. Delay autoplay slightly. Start the player only after the visitor interacts with the banner or the page, which suits sites where video sits below the fold.

There is no universal right answer. Measure fill rate, CPM and playback start time for each option on your own traffic before committing.

Step 5: Do Not Forget Mid-Roll and Long Sessions

Long-form video and live streams can run mid-roll breaks many minutes after the page loaded. If the visitor changed their choice in between, later ad requests must reflect the new state. Players that cache the consent string at initialisation will keep sending the old value. Prefer integrations that subscribe to consent change events or re-read the CMP before each ad break.

Step 6: Separate Media Hosting From Advertising

The video file itself may also come from a third party. Embedding a hosted player from a video platform can set cookies or load tracking even before any ad is requested. Treat the player as its own vendor: list it in your CMP configuration, decide which purpose it relies on, and load it behind a placeholder if it sets non-essential cookies.

How FlexyConsent Helps

FlexyConsent exposes standard IAB TCF 2.4 and GPP v1.1 APIs, along with Google Consent Mode v2 signals, so players and ad tags that read the CMP directly find the signals in the format they expect. FlexyConsent is a Google-certified CMP (CMP ID 317) and certified by IAB Europe and IAB Canada.

A Quick Verification Routine

• Load a video page from an EU location, accept, and inspect the first ad request for a populated consent string.
• Reject and repeat; confirm the request still goes out with the correct signal, not none.
• Follow a VAST wrapper chain and check that tracking URLs contain a real string rather than an unreplaced macro.
• Change consent during playback and check the next ad break.

Key Takeaways

• Video ad requests are built by the player, so consent must be passed deliberately.
• Populate consent parameters at request time, not at page load.
• Confirm that [GDPRCONSENT] and similar macros are substituted along the VAST chain.
• Choose a pre-roll timing strategy based on your own fill, CPM and start-time data.
• Treat the video host as a vendor in its own right.