core · formal standard

URL, HTTPS, macros, and IAB consent

Core runs on every URL-like artifact. Vendor packs add parameter contracts. This pack is the floor: the URL has to parse, the scheme has to be http or https, and a consent parameter has to be a consent string rather than a placeholder.

Base64 is a permissive alphabet. gdpr_consent=1 and gdpr_consent=true both pass a character check. Decoding the TC String version, the US Privacy version digit, and the GPP header type is what separates a string from a signal.

gdpr_consent=1 is not a TC String

The first six bits of a TCF v2 string are the version, and they have to read 2. A one-character placeholder decodes as something else, or as a truncated core segment. A TCF v1 string decodes as version 1 and is reported as sunset rather than as malformed.

Rule: core.privacy.tc_string_version

A TC String in gpp is the wrong parameter

GPP header type is fixed to 3. A TC String pasted into gpp decodes to header type 2. That is the commonest way to get this wrong: the right string, the wrong field.

Rule: core.privacy.gpp_header_type

What this pack matches

Vendor docs: url.spec.whatwg.org/

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`URL parse and host`	required	The artifact parses as an absolute URL and carries a host.	`core.url.invalid` `core.url.host_missing`	docs
`http or https`	required	Network-delivered artifacts use http or https.	`core.url.unsupported_scheme`	docs
`No userinfo, no fragment`	optional	Embedded credentials are deprecated. Fragments never reach the server.	`core.url.userinfo_deprecated` `core.url.fragment_ignored`	docs
`HTTPS baseline`	recommended	Plain http endpoints are flagged for upgrade.	`core.url.insecure_transport`
`JSON parse`	required	A JSON body parses, and the finding names the byte where it stops.	`core.json.parse_error`	docs
`Macros`	optional	A fired URL carries no unresolved macros. Macros never sit in scheme, authority, host, port, or userinfo. One artifact uses one syntax.	`core.macro.unexpanded_in_fired_url` `core.macro.unsafe_position` `core.macro.mixed_syntax`
`TC String`	optional	gdpr is 0 or 1. A TC String is decoded, not alphabet-checked. Version 2, core segment long enough, not a placeholder.	`core.privacy.gdpr_invalid` `core.privacy.gdpr_consent_missing` `core.privacy.gdpr_consent_without_flag` `core.privacy.gdpr_consent_ignored` `core.privacy.gdpr_consent_malformed` `core.privacy.tc_string_version` `core.privacy.tc_string_truncated`	docs
`GPP and US Privacy`	optional	GPP header type is 3. A TC String in gpp is type 2. US Privacy is a version digit plus three Y/N/- characters, and is deprecated.	`core.privacy.gpp_malformed` `core.privacy.gpp_sid_missing` `core.privacy.gpp_sid_malformed` `core.privacy.gpp_header_type` `core.privacy.gpp_header_version` `core.privacy.us_privacy_malformed` `core.privacy.us_privacy_deprecated` `core.privacy.us_privacy_version` `core.privacy.duplicate_signal`	docs

Validate a payload

pixellint validate url "$ARTIFACT" --rulepack core

Or paste it into the playground. Same engine, in the browser, nothing sent anywhere.

cargo install pixellint · npm install pixellint