RTBlintAlpha
Menu

Decode GPP, TCF, and US Privacy consent strings

Consent travels in an OpenRTB request as opaque base64 strings. This decoder reads them field by field against the IAB Global Privacy Platform, TCF v2, and US Privacy specifications, entirely in your browser.

GPP string: decoded without errors.

Where it goes in a bid request

  • regs.gpp (since OpenRTB 2.6-202211). Send regs.gpp_sid = [7]: The gpp_sid you passed. It should list the sections in force for this auction. The full GPP string goes in regs.gpp unchanged. regs.gpp_sid tells the buyer which sections apply.

GPP header

Version 1, sections 7.

US National (MSPA) (section 7, usnat)

  • Sale opt-out: not applicable
  • Opted out of sharing
  • Did not opt out of targeted advertising
  • GPC is off

Core subsection

  • Section version Version: Section version 1 (raw 000001)
  • Notice of sharing with third parties SharingNotice: Not applicable (raw 00)
  • Notice of the right to opt out of sale SaleOptOutNotice: Notice was given (raw 01)
  • Notice of the right to opt out of sharing SharingOptOutNotice: Notice was not given (raw 10)
  • Notice of the right to opt out of targeted advertising TargetedAdvertisingOptOutNotice: Not applicable (raw 00)
  • Notice of the right to opt out of sensitive data processing SensitiveDataProcessingOptOutNotice: Notice was given (raw 01)
  • Notice of the right to limit use of sensitive data SensitiveDataLimitUseNotice: Notice was not given (raw 10)
  • Sale opt-out SaleOptOut: Not applicable (raw 00)
  • Sharing opt-out SharingOptOut: Opted out of sharing (raw 01)
  • Targeted advertising opt-out TargetedAdvertisingOptOut: Did not opt out of targeted advertising (raw 10)
  • Sensitive data processing consent SensitiveDataProcessing: 4 not applicable, 4 no consent, 4 consent given (raw 000110000110000110000110)
    • Racial or ethnic origin 1: Not applicable (raw 00)
    • Religious or philosophical beliefs 2: No consent (raw 01)
    • Health (condition, diagnosis, medical history, or treatment) 3: Consent given (raw 10)
    • Sex life or sexual orientation 4: Not applicable (raw 00)
    • Citizenship or immigration status 5: No consent (raw 01)
    • Genetic data used to identify a person 6: Consent given (raw 10)
    • Biometric data used to identify a person 7: Not applicable (raw 00)
    • Precise geolocation 8: No consent (raw 01)
    • Government ID numbers (SSN, driver's license, state ID, or passport) 9: Consent given (raw 10)
    • Account log-in or financial account with access credentials 10: Not applicable (raw 00)
    • Union membership 11: No consent (raw 01)
    • Contents of mail, email, and text messages 12: Consent given (raw 10)
  • Known child data consent KnownChildSensitiveDataConsents: 1 no consent, 1 consent given (raw 0110)
    • Consumers aged 13 to 16 1: No consent (raw 01)
    • Consumers under 13 2: Consent given (raw 10)
  • Consent to use personal data for incompatible purposes PersonalDataConsents: Consent given (raw 10)
  • MSPA covered transaction MspaCoveredTransaction: Not an MSPA covered transaction (raw 10)
  • MSPA opt-out option mode MspaOptOutOptionMode: Opt-out option mode on (raw 01)
  • MSPA service provider mode MspaServiceProviderMode: Service provider mode off (raw 10)

GPC subsection

  • Subsection type SubsectionType: GPC subsection (raw 01)
  • Global Privacy Control Gpc: GPC is off (raw 0)

Where consent strings go in OpenRTB

  • A GPP string goes in Regs.gpp, with the applicable section ids in Regs.gpp_sid (both since 2.6-202211).
  • A TCF v2 string goes in User.consent, with Regs.gdpr set to 1 when GDPR applies.
  • A US Privacy string goes in Regs.us_privacy. IAB Tech Lab has deprecated it in favor of the GPP US sections.

The privacy signals reference explains how these fields interact, and the GPP versus TCF versus US Privacy post covers which to send.

How it was checked

The decoder is tested against the example strings in each specification and against the official IAB decoders (@iabgpp/cmpapi and @iabtechlabtcf/core), field for field. It reads the newest US National and state layouts from the specification tables; where the reference libraries disagree with the specification, the result says which reading it used.

Questions people ask

Is the consent string sent anywhere?

No. The decoder runs entirely in your browser. Nothing you paste leaves the page.

What does the gpp_sid check do?

regs.gpp_sid lists the GPP sections that apply to the request. The decoder reports a section id that gpp_sid names but the string does not carry as an error, and a section the string carries but gpp_sid omits as information, because a string can hold sections that do not apply.

Which sections does it decode?

The GPP header, TCF EU v2 (section 2 and standalone strings, including vendor ranges and publisher restrictions), TCF Canada (5), US Privacy (6 and standalone), US National (7), and every US state section the GPP specification defines. Unknown sections are shown raw with their bit length.