TCF v2.2 and GPP check: IAB signals in the page source

The check looks for the __tcfapi and __gpp interfaces in the HTML. Without programmatic advertising the note is expected; with it, it is a finding.

What we check

In the HTML: is the TCF interface __tcfapi or the euconsent-v2 cookie in the page source, and is there a __gpp for the Global Privacy Platform? A match means "ok" with the list of frameworks found. No match is a note, never critical, because without IAB advertising there is simply no reason for it. If you start the scan as "cookieless", the line is downgraded anyway.

What the scan cannot see: a CMP that only exposes __tcfapi after the banner interaction, whether the vendor list is maintained, and whether the TC string actually reaches the partners. You check that in the browser with __tcfapi('ping', 2, console.log) and in the network tab on the ad requests.

Why it matters

Whoever advertises programmatically in the EEA passes consent not to one tool but to a chain: SSP, DSP, verification, retargeting. The IAB's Transparency and Consent Framework packs the decision into a TC string that every partner reads, and Google requires publishers serving ads through Ad Manager, AdSense or AdMob in the EEA to use a certified CMP with exactly this integration. No string, no ad. When TCF runs, the Google tags also derive their Consent Mode state from the TC string.

For everyone else: Consent Mode V2 is the obligation, TCF the extra for publishers. Which platform delivers it certified is covered in the comparison of OneTrust, Usercentrics and Cookiebot.

Common causes

The site runs no programmatic advertising. Then the finding is expected and not an error.
The CMP supports TCF, but TCF mode was never activated in the configuration.
A TCF-capable CMP runs in standard mode, the vendor list is empty.
__tcfapi is only injected after the banner interaction; in the initial HTML it is invisible to the scan.

The fix

Only for IAB advertising: choose a CMP registered with the IAB (OneTrust, Usercentrics, consentmanager, Didomi), activate TCF v2.2 mode and cut the vendor list down to the partners that actually receive data. Then call __tcfapi('ping', 2, console.log) in the console: cmpLoaded: true and gdprApplies: true have to come back. Without IAB advertising, leave the note alone and put the time into the Consent Mode V2 finding.

Matching template

Consent Mode Audit Checklist

Seven layers, each with a check, a failure signal and an owner. Covers this finding and the six around it.

Get the checklist →

Check it yourself first

The Tracking Check tests this point along with all the others, in seconds.

Start the Tracking Check →

Asked often

We run no programmatic advertising. Is the note a problem?

No. TCF is the standard for consents that get passed on to dozens of ad-tech vendors. If you only run Google Ads, Meta and an analytics tool, you do not need it; Consent Mode V2 is what counts there. The line stays a note and barely moves the score.

Our CMP supports TCF. Should we just switch the mode on?

Only with a reason. TCF mode brings a vendor list with hundreds of partners into the banner, and each of them is part of the consent. That pushes the consent rate down and makes the second layer unreadable. Switch it on when an ad network or Ad Manager requires it, and then cut the vendor list down to the partners that actually receive data.

What is GPP, and do we need it in Europe?

The IAB's Global Privacy Platform bundles several jurisdictions into one signal, mainly the US states. A site that only advertises in the EU rarely needs it. The scan reports it because some CMPs expose both interfaces at once.

The fix, delivered

Wired up in days, not sprints.

Findings from the Tracking Check go into a ranked sequence with effort estimates in the Audit Sprint, every module with an acceptance criterion.

To the service Request an Audit Sprint