Turn on IAB TCF and GPP

Outside India

A deployment for India hides this setting and refuses to turn it on, with 400 FRAMEWORK_NOT_OFFERED. The operator sets PRODUCT_SCOPE=global to offer it.

Turn these on when your ad partners read consent through IAB signals. TCF serves visitors under European law. GPP carries opt-outs under US state privacy laws.

Before you start#

A CMP ID that IAB Europe issued to the operator of your deployment. Vendors ignore TC strings from an id that is not registered. GPP uses the same id.
You can edit project settings and publish the form.
The runtime is installed on the page.

Turn on TCF#

In the console, open Settings and enter the CMP ID under IAB registration.
Open Consent forms, choose the form and open its Settings tab.
Switch on IAB TCF v2.2.
Enter the Publisher country. It is written into every TC string.
Under Vendors, search the IAB vendor list and add the vendors you work with.
Publish the form.

Add data-piedap-tcf to the runtime tag, so ad tags that call __tcfapi early get an answer.

HTML

<script src="https://console.dpconsent.com/consent/sdk/v1/loader.js"
        data-piedap-key="pk_…"
        data-piedap-tcf></script>

A visitor gets the TCF layer when their region rule carries the law GDPR, UK_GDPR or CH_FADP and asks by opt-in. Everywhere else the visitor gets the ordinary banner, and waiting tags are told the GDPR does not apply.

Your tags then get:

window.__tcfapi, the standard TCF interface
a TC string in the first-party cookie euconsent-v2, which applies to your site only
the same TC string on the consent record, in its metadata as tcString

JavaScript

if (typeof window.__tcfapi === 'function') {
  window.__tcfapi('addEventListener', 2, (tcData, success) => {
    if (!success) return;
    const done = ['tcloaded', 'useractioncomplete'];
    if (done.includes(tcData.eventStatus)) {
      console.log(tcData.gdprApplies, tcData.tcString);
    }
  });
}

The vendor list comes from your own deployment, never from IAB servers. A returning visitor whose euconsent-v2 cookie is gone is asked again. A TC string written by another CMP is not reused.

How a TCF choice sets your own purposes

Your purposes stay the basis for held tags, Consent Mode and the record.

The visitor chooses	Your purposes
Accept all	Every purpose in the `FUNCTIONAL`, `ANALYTICS`, `MARKETING`, `PERSONALISATION` and `SALE_OR_SHARING` categories is allowed
Reject all	Every optional purpose is refused
Save my choices	Each purpose is recorded as its own switch under This site stands

A SENSITIVE purpose has no IAB purpose behind it, so Accept all does not switch it on.

Turn on GPP#

In the form's Settings panel, switch on IAB Global Privacy Platform.
Publish the form.
Add data-piedap-gpp to the runtime tag.

Open your site as a visitor a US state rule covers and read the string.

JavaScript

window.__gpp('ping', (data) => {
  console.log(data.signalStatus, data.gppString);
});

A visitor whose region rule carries the law CCPA_CPRA or US_STATE gets window.__gpp with the US National section (usnat, section 7). They also get window.__uspapi with the older US Privacy string. It is 1YNN before an opt-out, 1YYN after one, and 1--- where no US state law applies.

Field	Value
`SaleOptOut`, `SharingOptOut`	Opted out when the sale-or-sharing purposes are refused. If the form has none, when its marketing purposes are refused
`TargetedAdvertisingOptOut`	Opted out when the marketing purposes are refused
`Gpc`	Whether the browser sends Global Privacy Control
`SensitiveDataProcessing`	Consent or no consent for the sensitive purposes. Not applicable when the form has none

The visitor opts out from the Do Not Sell or Share My Personal Information link in the banner. Put the same link anywhere on your page with data-piedap-do-not-sell.

Add a stub only where the framework is on

Add data-piedap-tcf or data-piedap-gpp only on sites whose forms have that framework on. Elsewhere nothing would ever answer the calls the stub queues, and ad tags keep waiting.

Before you start#

Turn on TCF#

Turn on GPP#

Related#