Header bidding, GDPR and TCF 2.0 consent

This article describes how consent signals interact with a header bidding auction. It is not legal advice — your obligations depend on your jurisdiction, your audience and your own data practices, and you should get those confirmed by a lawyer.

What is actually being shared

A bid request contains the user's IP address, user agent, page URL, and often cookie or vendor identifiers. Under GDPR that is personal data, and the demand partners receiving it are separate controllers with their own purposes. So the request itself is the processing event that needs a lawful basis — not the ad that eventually renders.

This is why consent has to gate the auction rather than the creative. Once a bid request has left the browser, the data is out.

The four states an auction must handle

1. 1 Consent given — the full auction runs. Personalised demand bids normally and this is where your revenue comes from.
2. 2 Consent refused — you may still serve ads, but only non-personalised demand. Bid requests must be stripped of identifiers and flagged as non-personalised. Far fewer bidders participate and CPMs are much lower, but it is not zero.
3. 3 Consent pending — the CMP has not resolved yet. Nothing may be sent. The auction has to wait, which is why a slow CMP directly costs you money: it eats your timeout budget before the auction has even started.
4. 4 Legitimate interest — some TCF purposes can be handled under legitimate interest rather than consent, per vendor and per purpose. This has to be read from the TC string vendor by vendor, not assumed.

How TCF 2.0 fits together

• Your CMP collects choices and encodes them into a TC string.
• The wrapper reads it through the standard __tcfapi interface.
• Each bidder adapter passes the string on and the receiving SSP is responsible for honouring it.
• Bidders on the Global Vendor List that lack the required purposes for that user should not be called at all.

The CMP latency problem

A CMP that takes 800 ms to resolve has spent more than half of a 1,500 ms auction budget before a single bid request goes out. Loading the CMP synchronously and as early as possible, and serving it from a fast edge, is one of the highest-leverage performance fixes available to a European publisher.

Do not solve it by starting the auction before consent resolves. That converts a speed problem into a regulatory one.

Beyond Europe

• CCPA / CPRA (California) — an opt-out model rather than opt-in, signalled through the US Privacy string or GPP.
• GPP — the Global Privacy Platform, a single container for multiple regional signals. Where new integrations are heading.
• COPPA — child-directed content must disable personalised advertising entirely, regardless of any consent signal.

What it costs

Revenue from non-consented users is materially lower — the reduction is large enough that it is worth measuring rather than estimating, and it varies a lot by market and by how many of your bidders support non-personalised demand well. What you should not do is respond by making the consent flow deceptive. Regulators have been fining exactly that, and a dark-patterned CMP is a bigger commercial risk than the revenue it recovers.

Related questions