IAB TCF 2.3

What is IAB TCF?

The IAB Transparency & Consent Framework (TCF) is a standardized protocol for communicating user consent choices to ad tech vendors in the programmatic advertising ecosystem. TCF 2.3 is the current version and is widely adopted across the EU/EEA.

When your site participates in the IAB ecosystem (ad exchanges, SSPs, DSPs, DMPs), you need to:

• Disclose which vendors process user data and for what purposes
• Collect granular consent for each IAB-defined purpose
• Generate a TC String — a standardized encoding of consent choices that ad tech vendors can read
• Expose the __tcfapi CMP stub for vendor scripts to query consent status

CMP Registration

consent.io is pending validation as an IAB Europe-registered CMP for c15t. Once approved, when you use consent.io as your backend, the correct CMP ID will be automatically provided to your client via the /init endpoint — no client-side configuration needed.

If you self-host the c15t backend and have your own CMP registration with IAB Europe, you can configure your CMP ID on the backend via advanced.iab.cmpId or on the client via the iab.cmpId option. A valid (non-zero) CMP ID is required for IAB TCF compliance.

How c15t Implements TCF

c15t provides a complete IAB TCF 2.3 CMP (Consent Management Platform) implementation:

1. Global Vendor List (GVL) — Automatically fetched from the c15t backend. Contains the official IAB vendor registry with purposes, features, and stacks.
2. IABConsentBanner — A pre-built banner showing partner count, purpose summaries, and legitimate interest notices.
3. IABConsentDialog — A tabbed preference center for granular purpose and vendor consent management.
4. TC String generation — Consent choices are encoded into the standard TC String format.
5. __tcfapi stub — The standard CMP API is exposed on window so vendor scripts can query consent.

Quick Setup

Enable IAB TCF in the runtime options:

import { getOrCreateConsentRuntime } from 'c15t';

const { consentStore } = getOrCreateConsentRuntime({
  mode: 'c15t',
  backendURL: 'https://your-instance.c15t.dev',
  iab: {
    enabled: true,
    vendors: [1, 2, 10, 25], // IAB vendor IDs you work with
    // cmpId is automatically provided by the backend (consent.io).
    // Only set this if you have your own CMP registration with IAB Europe.
    // cmpId: 123,
  },
});

Accessing IAB State

The IAB manager is available on the store state when IAB is enabled:

const { iab } = consentStore.getState();

if (iab) {
  console.log('GVL:', iab.gvl);
  console.log('Vendor consents:', iab.vendorConsents);
  console.log('Purpose consents:', iab.purposeConsents);
}

// Subscribe to IAB state changes
consentStore.subscribe((state, prevState) => {
  if (state.iab !== prevState.iab && state.iab) {
    console.log('IAB state updated:', state.iab);
  }
});

__tcfapi Stub

When IAB is enabled, c15t automatically registers the __tcfapi function on the window object. This is the standard CMP API that ad tech vendors use to check consent:

// Third-party scripts can use the standard TCF API
window.__tcfapi('getTCData', 2, (tcData, success) => {
  if (success) {
    console.log('TC String:', tcData.tcString);
    console.log('Purpose consents:', tcData.purpose.consents);
  }
});

IAB Configuration Options

The iab option on the provider accepts:

Key Concepts

Purposes

IAB defines 11 standard purposes for data processing (e.g., "Store and/or access information on a device", "Select basic ads", "Measure ad performance"). Each purpose can be consented to individually.

Stacks

Purposes are grouped into stacks by the GVL for a simplified UI presentation. For example, "Advertising based on limited data" might group purposes 2, 7, and 10 together.

Special Features

Features like precise geolocation or device scanning that require explicit opt-in beyond standard consent.

Legitimate Interest

Some purposes can be processed under legitimate interest rather than consent. Users can object to legitimate interest processing per-vendor.

Vendors

Each vendor in the GVL declares which purposes it uses, whether via consent or legitimate interest. The preference center lets users toggle consent per-vendor.

Standard vs IAB Components