CMP Implementation for TCF 2.2, Google AC and GPP

The number that matters: Consent rate is the wrong scoreboard. Across four TCF 2.2 migrations we ran last year, consent rate moved by less than two percentage points in every case. What moved was leakage: the share of consented sessions whose bid requests carried no valid TC string, or carried one with the bidder purged for a missing GVL ID. That ran between 11 and 19 percent before the work and under 3 percent after. It is revenue on traffic you already have permission to monetise. Why the string goes missing: Almost always a race. The __tcfapi stub is not inline in the head, so the ad server and the header bidding wrapper initialise before the CMP can answer. Or the auction is wired to tcloaded rather than useractioncomplete and fires on a stale string. Or the consent module timeout is shorter than the CMP's own load on a cold cache, so the auction proceeds without consent and every adapter that respects it drops out. Or a bidder is missing its gvlid in your Prebid build and is stripped on Purpose 1 with no error anyone reads. We instrument that sequence in the field, on real devices, before we change any configuration. What 2.2 changed for your inventory: Legitimate interest is gone for Purposes 3 through 6. Any vendor still relying on it for personalisation contributes nothing on non-consented traffic and should be sized accordingly rather than left in the list out of habit. Vendors must publish retention periods, the first layer must state how many are asking, and withdrawal must be as easy as the grant. We take the last one literally: a persistent, reachable control, not a link in the footer. Around the string we wire what actually reaches the auction. Google's Additional Consent string for ad technology providers outside the GVL. Consent mode signals for your Google tags. A GPP string carrying the US national section through the request, so state signals stop being handled by a second banner that contradicts the first. Health publishers, specifically: TCF gives you no lawful basis for special category data, and a health title's audience segments are frequently exactly that. We strip condition and symptom taxonomies out of key-values and out of first-party segments sent to bidders in scope, and we put that in writing for your privacy counsel. If the ask is to treat a consent string as covering inferred health status, we decline and the engagement ends there. What we refuse: We do not design for accept rate. No colour weighting between accept and reject, no reject path behind a second click, no consent wall. We will not deploy a CMP that is not on the IAB Europe registered list and Google certified, whatever the commercial terms attached to it. And we do not serve a banner to your Australian readers to be safe. We geo-scope, because the banner costs pageviews and Australian law has not asked for it. Not for you if: You want an accept rate written into the contract. Or you have chosen a platform on price and want hands only, no opinion. We work with Sourcepoint, Didomi and InMobi CHOICE because we can audit what they emit and reproduce a bad string from a session recording. If your vendor sits outside that set we will look at it, and we may still say no.