A valid VAST file can still come back blank when the TC string omits a vendor in the creative
IAB Europe set October 23, 2026 as the deadline for consent platforms to ship TCF v2.4 disclosures on the web, with mobile and CTV due February 2027. Bidders read the string on each request, so creative vendors missing from it can cost the bid, a dev.to explainer says.
The Engineer · Build desk
What happened
- A TC string already records which vendors the CMP disclosed, a field added in v2.3, and v2.4 tightens the Global Vendor List feature text and drops some legitimate-interest shortcuts.
- Google's creative status codes in the 200 range include a case where the TC string does not consent to a vendor in the creative, and the post says that is not a VAST schema error.
- One common failure is half a signal: an SSP forwards the GPP section id but drops the GPP string, leaving the bidder with a grammar to expect and nothing to decode.
- TCF expects the TC string to travel unchanged, so a tag manager that truncates it, re-encodes it or swaps in a placeholder breaks vendor-level checks.
Why it matters
- constraint October 23 binds consent platforms. The post does not say when exchanges and DSPs begin acting on the new disclosure bits, so publishers have no stated cutover date to plan around.
- decision Stacks that still read both us_privacy and GPP need a written precedence rule. Without one, a section 7 opt-out and a 1YNN string produce no deterministic result.
- exposure Server-side auctions rebuild the request after the page, so a mismatch with the CMP output lands in logs the buyer never sees and the publisher may never check.
The spec and Global Vendor List update landed on July 23, 2026, according to the IAB Europe timeline letter the post cites [2]. The web deadline falls 92 days after that [19].
Where the string sits on the bid matters. OpenRTB 2.6-202211 gave GPP its own fields: regs.gpp for the encoded container and regs.gpp_sid for the section identifiers [5]. GDPR traffic still pairs regs.gdpr with the IAB Europe TC string in user.consent [6]. Break the pairing and the policy changes. The post's example is a long base64 blob in user.consent with regs.gdpr omitted. The exchange then treats the auction as non-GDPR and applies the wrong policy [8].
Next the bidder runs a comparison. It checks the vendors in the creative's AdVerification list against the consent bitmap, which the post describes as policy implementation [17]. If the string does not cover vendor 755 on the GVL, a VAST InLine can validate and a bid can win while the buyer still records a loss or a blank [4].
Video adds a second copy of the string. VAST Impression and Tracking URLs often expand ${GDPR_CONSENT_xxx} macros at serve time, and the string on that URL must still match the bid the DSP won with [15]. Those same strings also go out on impression pixels, verification scripts and server-side conversion posts, passed along in query parameters and macros [11]. A macro that defaults to a boolean puts gdpr_consent=1 where a string belongs. The value is syntactically plausible and semantically empty [13].
The only source here is one dev.to explainer. It points to RTBlint and Pixellint's GPP documentation as ways to lint the string itself, and it is not the IAB Europe text [18].
In our view the test that fits these failures is a three-way diff. Capture the string as the CMP emits it, as it arrives on the bid request, and as it appears on the tag URL. Then compare. Every failure the post lists is a mismatch between two of those points: a dropped gpp field, an omitted gdpr flag, a truncated or re-encoded macro, a rebuilt server-side request.
What to watch
- Whether exchanges and DSPs publish a date for acting on the TCF v2.4 disclosed-vendor bits in bid-time checks.
- Whether mobile and CTV consent platforms ship the same disclosures on the February 2027 schedule.
- Whether buyers document a precedence rule when GPP section 7 and a legacy us_privacy string disagree.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+5
- Incentives
- Insufficient
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
IAB Europe set October 23, 2026 as the deadline for consent management platforms to ship the new TCF v2.4 disclosures on the web, with mobile and CTV following in February 2027.
- [2]
The IAB Europe timeline letter confirms the TCF spec and Global Vendor List update landed July 23, 2026.
- [3]
Exchanges and DSPs do not re-run the CMP UI. They read whatever string arrived on the bid request or the pixel URL and decide whether the creative's vendors may fire.
- [4]
A VAST InLine can validate, a bid can win, and the buyer still records a loss or a blank when consent does not cover vendor 755 on the GVL.
- [5]
OpenRTB 2.6-202211 gave GPP a first-class home: the encoded consent container goes in regs.gpp and the applicable section identifiers in regs.gpp_sid.
- [6]
GDPR traffic still pairs regs.gdpr with the IAB Europe TC string in user.consent.
- [7]
A common failure is half a signal: an SSP forwards regs.gpp_sid [7] after an edge rewrite but drops regs.gpp. The section id tells the bidder which grammar to expect, and without the string there is nothing to decode. RTBlint flags that pattern as incoherent on the wire.
- [8]
The inverse failure is a long base64 blob in user.consent while regs.gdpr is omitted, so the exchange treats the auction as non-GDPR and applies the wrong policy.
- [9]
IAB Tech Lab deprecated the legacy regs.us_privacy string on January 31, 2024, but during transition many stacks still read both it and GPP. If GPP section 7 says opt-out of sale while us_privacy reads 1YNN, the instructions contradict and there is no deterministic winner unless the buyer documents precedence.
- [10]
Google's creative status codes in the 200 range include cases where the TC string does not consent to a vendor present in the creative. That is not a VAST schema error; the XML is fine and the privacy contract on the bid is not.
- [11]
Impression pixels, verification scripts, and server-side conversion posts carry the same strings through query parameters and macros.
- [12]
TCF expects the TC string to propagate as-is. A tag manager that truncates, re-encodes, or substitutes a placeholder breaks vendor-level checks even when the page looked compliant at banner time.
- [13]
Passing gdpr_consent=1 because the macro defaulted to a boolean produces values that are syntactically plausible and semantically empty.
- [14]
Server-side stacks rebuild OpenRTB after the browser blocked sync pixels. If the reconstructed regs.gpp and user.consent disagree with what the CMP emitted on the page, the compliance failure moves from DevTools to logs buyers never see.
- [15]
VAST Impression and Tracking URLs often expand ${GDPR_CONSENT_xxx} macros at serve time, and the consent string on that URL must still match the bid the DSP won with.
- [16]
The TC string encodes purposes, vendors, and (since v2.3) which vendors were actually disclosed in the CMP UI. TCF v2.4 tightens GVL feature text and removes ambiguous legitimate-interest shortcuts for certain vendor classes.
- [17]
A bidder comparing the creative's AdVerification vendor list against the consent bitmap is implementing policy, not XML validation.
- [18]
The post points to RTBlint and Pixellint's GPP documentation and TCF v2 guide as ways to lint the string itself, not just whether the HTTP request returned 200.
- [19]
The web deadline falls 92 days after the spec and GVL update landed.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toGPP Explained: How Privacy Strings on the Bid and Tag Gate Creatives
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Programmatic advertisingFollow
- Ad tech privacy complianceFollow
- Consent ManagementFollow
- Video advertising standardsFollow