TC String
The TC String is the compact, base64-encoded record generated by a TCF consent management platform that encodes a user's consent and objections per purpose and per vendor, and that advertising systems read to decide what they may do.Under the IAB TCF, when a visitor makes a choice, the CMP builds a Transparency and Consent String: a bit field that records the CMP's identity, the version of the vendor list, the timestamp, the purposes consented to, the purposes for which legitimate interest was not objected to, the vendors allowed, special features such as precise geolocation, and the publisher's own restrictions, all encoded in URL-safe base64. The string is stored in the browser and exposed to scripts through the __tcfapi function, then forwarded in bid requests so that each vendor in the advertising chain can check whether it has consent.
The Court of Justice held in IAB Europe (C-604/22, 7 March 2024) that the TC String is personal data: it contains the preferences of an identifiable user, since it can be linked to an IP address or other identifiers with reasonable means. IAB Europe, as the body that sets the rules for how it is created and used, can be a joint controller of that recording.
For a website, the practical meaning is that a consent string is itself regulated data: it must be collected validly, stored no longer than necessary and documented as proof of consent. Sites that do not run programmatic advertising through the TCF have no TC String; their CMP records the choice in its own format and passes it to tags through a data layer or Google Consent Mode.