Consent on the wire | TCF v2, GPP, US Privacy, CMP

A TC String is not the letters 1 or true ConsentengineersPMsmarketers gdpr must be 0 or 1. gdpr=1 needs a TC String in gdpr_consent. Pixellint decodes the string. gdpr_consent=1 and gdpr_consent=true are valid base64 and still not a TC String. Core reads query string and Floodlight-style path parameters.

GPP header type is 3 ConsentengineersPMs A GPP string has header type 3. A TC String pasted into gpp decodes as type 2. gpp needs gpp_sid so the callee knows which section is in force. The spec does not require sid to match sections inside the string. Pixellint does not invent that check.

US Privacy was deprecated on 31 January 2024 ConsentengineersPMsmarketers The IAB US Privacy string is a version digit plus three Y, N, or hyphen characters. Only version 1 was published. IAB Tech Lab deprecated it on 31 January 2024 in favor of GPP. Pixellint still checks the shape and always warns that the parameter is deprecated.

Consent Mode is a gtag signal, not a CMP ConsentengineersmarketersPMs Google Consent Mode is a gtag or GTM signal for ad_storage, analytics_storage, ad_user_data, and ad_personalization. It is not a CMP and not a TC String. Default denied, then update on choice. EEA traffic without the v2 keys is a policy problem, not a pixel syntax problem Pixellint invented.

A banner that does not block still fires the pixel ConsentPMsengineersmarketers A banner that does not wrap tags still fires pixels on first paint. Blocking means the tag does not queue until granted, or Consent Mode defaults to denied. UX copy is not a technical control. Network tab on a fresh profile is the audit, not a screenshot of the modal.

CAPI still needs a lawful basis ConsentPMsengineers Moving the pixel to CAPI does not move you out of GDPR. You still need a lawful basis, a processor story, and a way to respect refusal. Hashing an email is not anonymization. The vendor 200 is not a legal opinion. Consent Mode does not update your shop backend.

Limited Data Use is a parameter, not a vibe ConsentengineersPMs Meta Limited Data Use is dpo=LDU plus a country and usually a state. dpoco=1 is the US. Country without state lets Meta geolocate. Pixellint flags that as vendor.meta.ldu.country_without_state. On CAPI, data_processing_options_country is required when LDU is sent.

ATT is a prompt. IDFA is the identifier. ConsentengineersPMs ATT is the iOS prompt. IDFA is the advertising identifier you may read after authorize. Denied ATT does not forbid first-party CAPI with hashed email you collected in-app. It does forbid IDFA. All zeros means denied. Do not hash IDFA like email unless the MMP field is documented as hashed.

Child-directed traffic is not a tag setting you forget ConsentPMsengineers Child-directed apps and mixed-audience properties cannot treat ads pixels as default. Flag child-directed traffic in the vendor's restricted data processing settings. Hashing an email you should not have does not help. Pixellint does not invent a COPPA rulepack. The vendor 200 is not permission.

Event logs are PII adjacent ConsentengineersPMs Pixel query strings, CAPI bodies, HARs, Segment archives, and sGTM logs are identifier stores. Keep them as short as the debug job requires. A six-month access log of hashed emails is still a dossier. Pixellint flags a raw email on a live artifact. It will not scrub the file you already uploaded.

Cookies are not the only measurement future ConsentPMsengineers Third-party cookies are already gone in Safari and Firefox. Chrome moved to user choice and Privacy Sandbox APIs. Topics and Attribution Reporting are not a pixel with a different host. Keep CAPI while you learn them. Privacy Sandbox does not waive GDPR or a CMP. Pixellint does not validate Topics values.

Aggregate reports are not a pixel HAR ConsentengineersPMs The Attribution Reporting API sends delayed, noisy aggregate reports (and limited event-level reports) from the browser. It is not a conversion pixel you can paste into a HAR validator. Keep enhanced conversions and gclid. Pixellint does not validate Attribution-Reporting-Register-Source headers.

The CMP choice has to survive into the URL Consentengineersmarketers IAB signals have to land on the request the vendor sees: query or path. A CMP in the page that never expands the ad-server macro is a local-only choice. Empty values and unexpanded macros are template exemptions. Meta LDU and Google Consent Mode are separate vendor dialects.

Withdrawing consent has to hit the same URL that accepted it ConsentengineersPMsmarketers Granting consent is a request the vendor can see. Revoking it often is not. A banner that shows a new choice while Floodlight, Meta, and CAPI keep the old string is a withdraw that never left the page. Lint the hop after refuse, not only after accept.

Two gdpr_consent parameters is not belt and suspenders Consentengineers gdpr, gdpr_consent, us_privacy, gpp, and gpp_sid must appear at most once on a pixel URL. Two gdpr_consent values are not a backup. They force the callee to guess which copy is authoritative. Query plus Floodlight path both count. Pixellint reports core.privacy.duplicate_signal.