User.consent

The IAB Transparency and Consent Framework (TCF) consent string, sent when GDPR applies to the request. Added in OpenRTB 2.6; before that it traveled as user.ext.consent.

CurrentstringOptionalSince 2.6-202204

Field facts

Path: user.consent
Object: User
Type: string
Requirement: Optional
Added: OpenRTB 2.6-202204
Spec section: 3.2.20

How it is used

Read it together with regs.gdpr: the flag says GDPR applies, and the string records what the user agreed to, vendor by vendor and purpose by purpose. A TCF 2 string starts with the letter C and uses the URL-safe base64 alphabet. Buyers decode it to check their own vendor ID and purposes before using identifiers or personal data. Integrations that send GPP can carry the TCF section inside regs.gpp as well; keep the two consistent.

Example

Where the field sits in a payload, with everything else left out:

{
  "id": "req-1",
  "user": {
    "consent": "CPXxEXAMPLEconsentStringAAAAAAAAAAAAAAAAAAAAAA"
  }
}

Common mistakes

Sending it only at user.ext.consent on a 2.6 request. Buyers reading the 2.6 path see no consent, and RTBlint reports the moved field.
Sending different values at user.consent and user.ext.consent, which RTBlint reports as a privacy signal conflict.
Putting something other than a TCF string here, such as "1", "yes", or a US Privacy string.

Version history

Added in OpenRTB 2.6-202204, and present in the latest snapshot. The table shows how each version's spec text types the field.

Versions	Type in the spec	Required	Deprecated
2.6-202204	Added in the first 2.6 release, published without a structured text archive; the 2.6-202210 republication is the first tagged text.
2.6-202210 to 2.6-202606	string	No	No

Versioned rules that name this field

openrtb.2.6.user.consent OpenRTB 2.6 moved the TCF consent string from user.ext into the core user object.

Related fields

Other User fields

For a walkthrough of the whole object, read User identity and EIDs.