TCF 2.3 and GPP for Prebid publishers: the 2026 consent setup that keeps demand bidding

Consent problems rarely look like consent problems. They look like a bidder whose bid rate fell by half in one country, or GAM quietly serving limited ads to EEA traffic, or a US state where CPMs dropped after a CMP update. The settings behind these are spread across your CMP, your Prebid build and Google Ad Manager, and the standards have changed more than once since mid-2025.

Here is where TCF and GPP stand in September 2026 and how the pieces fit in a Prebid setup.

TCF 2.3 is now the only valid version for new strings

IAB Europe released TCF v2.3 in June 2025. The main change is that the Disclosed Vendors segment of the TC string is mandatory. That segment lists the vendors the CMP actually showed to the user, so a vendor can tell the difference between "the user refused me" and "the user was never asked about me".

The transition period ended on February 28, 2026. TC strings created after that date without the Disclosed Vendors segment are invalid. Strings created earlier stay valid until they are refreshed.

Google enforces this on its side. Ad Manager's TCF error reference says TCF v2.3 is mandatory for all TC strings generated on or after March 1, 2026, and defines error code 1.4 for a Disclosed Vendors segment that is missing, malformed or does not include Google. When a string fails, Google tries to serve limited ads, which earn far less than personalized ones.

Separately, Google has required a Google-certified CMP integrated with the TCF for personalized ads in the EEA and UK since January 2024, and in Switzerland since July 2024.

What to check

1. Your CMP version. Ask your CMP vendor, or check its changelog, for TCF 2.3 support and the date you deployed it. A self-hosted or heavily customized CMP is the usual culprit.
2. Google's error reports. Ad Manager reports TCF errors by the codes in the reference above. Any volume on 1.4 means strings without a valid Disclosed Vendors segment that includes Google.
3. Google in the vendor list. Google's vendor ID has to be in the CMP's vendor list and shown to users. It is surprisingly common to find it removed during a "vendor cleanup".
4. Every bidder you run. Each Prebid bidder has a Global Vendor List ID. If a bidder is not in your CMP configuration, users are never asked about it, and under Prebid's TCF enforcement it gets no consent and bids blind or not at all. Compare your bidder list with your CMP vendor list after every bidder change.

How Prebid enforces TCF

Two Prebid modules do the work:

• consentManagementTcf reads the TC string from the CMP through the __tcfapi interface and attaches it to bid requests.
• tcfControl enforces it, deciding whether each bidder or module can store data, sync users, receive user IDs or bid at all, based on the purposes and legal bases in the string.

Prebid 10 expanded the default purposes tcfControl checks to include purpose 4 (personalized advertising), purpose 7 (measurement) and special feature 1 (precise geolocation). If you upgraded from Prebid 9 and some bidders' bid rates in the EEA dropped, compare their declared purposes with the new defaults before assuming it is a demand problem.

Three configuration details trip people up:

• The CMP timeout. consentManagement.gdpr.timeout controls how long Prebid waits for the CMP before running the auction. Too short and the first auction on a page runs without consent. Too long and your first ad is late. Measure how long your CMP takes to answer on a real mobile device, not on your office laptop.
• defaultGdprScope. This decides what Prebid assumes if the CMP does not say whether GDPR applies. Setting it to true is the safe choice if any real share of your traffic comes from the EEA.
• Vendor exceptions. tcfControl lets you exempt specific bidders or modules from enforcement. Every exception is a legal decision, not a technical one. Document who approved it.

GPP for US traffic

The Global Privacy Platform (GPP) is the IAB Tech Lab's format for carrying several privacy signals in one string. For publishers with US traffic it has replaced the older US Privacy string (USP, the 1YNN format).

The GPP string is made of sections. The ones that matter for US traffic, from the GPP section list, are:

Section	ID	Covers
usnat	7	US National, the multi-state privacy agreement
usca, usva, usco, usut, usct and others	8 to 27	Individual state laws, from California to Rhode Island
uspv1	6	The legacy US Privacy string carried inside GPP

The IAB deprecated the US Privacy string in January 2024. Google Ad Manager still reads it, but it only accepts some GPP sections: US National, California, Colorado, Connecticut, Florida and Virginia. It does not accept Utah or USP inside GPP. Ad Manager supports GPP National v2 since September 2025, and a GPP string using v1.0 of the spec returns an error.

This mismatch catches people. A CMP can send a perfectly valid GPP string that GAM partly ignores. If you only send a state section Google does not read, Google may treat the user differently from your other demand.

GPP in Prebid

Prebid reads GPP with the consentManagementGpp module, which talks to the CMP's __gpp API (version 1.1 of the CMP API). The gppControl_usnat and gppControl_usstates modules translate US National and state sections into Prebid's activity controls, the same mechanism that decides whether a bidder can sync or receive IDs.

A practical setup for a publisher with EEA and US traffic:

• Include consentManagementTcf, tcfControl and consentManagementGpp in the build.
• Add gppControl_usnat, and gppControl_usstates if your CMP writes state sections.
• Keep consentManagementUsp only while your CMP or some of your demand still needs the old string. Once your CMP sends usnat, USP is redundant for most bidders.
• Check that your bidders pass GPP through. Adapters built on Prebid's OpenRTB converter forward gpp and gpp_sid in the request; older hand-written adapters may not. Bidders that only read USP will see less than you think.

A troubleshooting order that works

When one bidder's bid rate drops in one region, check in this order:

1. Is the bidder's GVL ID in the CMP vendor list, and is it shown to users?
2. What does the bidder declare in the GVL for purposes and legal bases, and does it match what tcfControl requires?
3. Is the TC string or GPP string present on the bid request at all? Use the Prebid debug console or pbjs.getConsentMetadata() on a real page from that region, through a VPN if needed.
4. Did anything change recently: a CMP update, a Prebid upgrade, a new bidder or a vendor list cleanup?

Steps 1 and 4 are the cheapest to check, so start there.

Where Valuad fits

Valuad is a registered TCF vendor (vendor ID 1478), and our Prebid bidder adapter forwards TCF, GPP, USP, COPPA and DSA signals on every request. Our Prebid Server layer normalizes consent fields across OpenRTB 2.5 and 2.6 before requests go out to demand partners, because partners disagree about where those fields should live. If your consent setup is costing you bids and you can't see where, we are happy to look.

Want a second pair of eyes on your setup? Talk to the Valuad AdOps team.