How to set up IAB TCF v2.2

What it is, and why it matters

The IAB Europe Transparency & Consent Framework (TCF) is the standard that programmatic advertising runs on in the EU. Every real-time-bidding exchange, demand-side platform, and most ad networks that operate in Europe expect a registered Consent Management Platform to publish a TC string — a compact, signed encoding of exactly which purposes and vendors a visitor has consented to (or which vendors are relying on legitimate interest instead). Without a valid TC string, TCF-compliant vendors are contractually required to stop bidding on or serving ads to that visitor. If your site runs any programmatic ad demand in Europe, TCF isn't optional — it's the mechanism that keeps that demand flowing legally.

TCF is also the framework EU/EEA/UK regulators and ad-tech partners actually audit against, because it standardizes what a visitor was told and what they agreed to, purpose by purpose and vendor by vendor.

Cookie Munch implements TCF v2.2, encoding the standard TC string via the IAB reference encoder and exposing it through the same __tcfapi window function every TCF vendor script already knows how to call. TCF is a paid ("Pro") capability — the toggle is blocked in the editor for plans without the feature, and framework: 'iab' is silently stripped back to 'none' server-side if you try to set it directly via the API without an entitled plan.

How to enable it

1. In Studio, open the site's Settings drawer and go to the Consent tab.

2. Toggle Enable IAB TCF. If your plan doesn't include TCF, the toggle is disabled with an upgrade prompt instead of turning on.

3. Configure the fields that appear:

   Field	What to put there
   CMP ID	Your IAB-registered CMP ID. 0 is the unregistered placeholder — fine for testing, but you must register with the IAB and use your real ID before running live TCF traffic; an unregistered ID will cause reputable vendors to reject the signal.
   Publisher country code	Your 2-letter ISO country code (e.g. DE), written into the TC string's publisher-country field.
   Vendor IDs	Comma-separated IAB Global Vendor List (GVL) IDs for every ad vendor actually running on your site.
   Purpose IDs	Comma-separated TCF purpose IDs you're requesting consent for.
   Auto framework by region	When on, TCF activates only for visitors whose detected region is EU/EEA/UK — everyone else gets the plain banner with no TCF overhead. See Geo-targeting.

4. Add the TCF Ad-Settings panel element to your banner layout from the Studio element palette. TCF requires visitors be able to make granular, per-purpose and per-vendor choices beyond a single accept/reject button, and this panel is what renders that UI. It has no configuration fields of its own in the inspector — it's driven live by the fetched Global Vendor List at runtime, and it's built lazily (only when a visitor actually expands it), so it doesn't add weight to the initial banner render.

5. Optionally add the vendor count element (tcfVendorCount) to the first layer of your banner — it renders a live count, e.g. "We and our {count} partners (IAB TCF vendors) process data," satisfying TCF v2.2's requirement to disclose the vendor count before a visitor drills into the full panel. Its template text is editable from the inspector.

6. Publish from Studio.

What it does technically

Cookie Munch's four consent categories map onto TCF purposes as follows:

Purposes and vendor selections, legitimate-interest establishments, and special-feature opt-ins (precise geolocation, active device scanning) are encoded into a standard, service-specific TC string using the IAB's own reference encoder — the same library other CMPs use, which is what lets any TCF-compliant vendor decode it correctly regardless of who issued it.

Legitimate interest and objection. TCF v2.2 purposes 1, 3, 4, 5, and 6 are consent-only — Cookie Munch never shows a legitimate-interest toggle for them, even if a vendor's own GVL declaration mislabels them as LI-eligible. Only purposes 2, 7, 8, 9, 10, and 11 can show an LI toggle. Where a vendor does declare LI for an eligible purpose, the toggle defaults to established (on) — per TCF semantics, the visitor must actively untick it to object, rather than opt in. Two bulk controls, Object to all and Allow all, apply to every purpose- and vendor-level LI toggle in one action (this also forces the lazily-built vendor list to fully build first, so a bulk action can't silently miss vendors the visitor hasn't scrolled to yet).

The runtime API. The TC string and consent state are exposed through the standard __tcfapi(command, version, callback, parameter) function — ping, addEventListener/removeEventListener, and getTCData (which honors an optional vendor-ID filter) all behave per spec, returning fields like tcString, gdprApplies, cmpId, cmpVersion, tcfPolicyVersion, and per-purpose/per-vendor consent and legitimate-interest maps. For nested ad iframes that can't call __tcfapi directly (because it only exists in the top frame), Cookie Munch also installs the standard __tcfapiLocator hidden iframe plus a postMessage call/return bridge, exactly as the IAB spec defines — this is what lets a creative running three iframes deep still read the visitor's TCF signal.

Verifying it's working

1. __tcfapi('ping', 2, console.log) in the browser console on your live site should return cmpStatus: 'loaded', gdprApplies: true (for an EU-classified visitor), and your configured cmpId.

2. __tcfapi('getTCData', 2, console.log) should return a tcString — decode it with the IAB CMP Validator to confirm your purposes, vendors, and publisher country are encoded correctly.

3. Consent log cross-check. Every consent record Cookie Munch stores includes the tcString active at the time of that decision — check the Audit / consent log for a recent visit and confirm a string is present for TCF sessions.

4. Ad-vendor confirmation. If a DSP/SSP partner offers its own compliance checker, run it against your live site — the only way to confirm a specific vendor actually reads and respects your string, not just that one was published.

5. If Auto framework by region is on, spoof the region header (x-cookiemunch-region: us) against /config/:cbid and confirm TCF is inactive outside the EU/EEA/UK, and reciprocally with an EU code (e.g. de).

See also: Google Consent Mode v2 and US State Privacy (GPP) for how the same category state feeds the other signaling frameworks, and Geo-targeting for region-based auto-activation.