Part 5 of 9: Privacy, consent & regulation

In part 4 I initially called consent the "master switch" – the thing that, when turned off, collapses the entire identity ladder to anonymous.

A switch is binary. On or off, ad or no ad. And almost everyone treats consent exactly like that: The user tapped a banner, we captured a consent string, we stuffed it into the bid request, done. Compliant.

But what runs in your auction is not a switch. It is more like a border checkpoint – one that asks the same five questions of every single impression and lets some things through while others are turned away. The consent string is not the decision. It is the document you hand over at the checkpoint. So this is where the master switch gets taken apart – and where we reach the part most people overlook:

Consent does not primarily decide whether you get paid. It decides how much.

Let's get the terminology straight

Three terms, because this layer is genuinely dense:

• The regs object – the "regulations" block in the OpenRTB bid request, separate from the user data it regulates.
• Legal basis – why you are allowed to process a person's data. Under GDPR, the two that matter here are consent (the user said yes) and legitimate interest (a vendor claims a business reason, which you can object to).
• The TC String – the consent string itself: a long, deliberately unreadable blob encoding which numbered Purposes the user has allowed.

What the rules actually look like in the request

Strip away the abstraction and the privacy layer is just a few fields. In OpenRTB 2.6:

"regs": {
  "gdpr": 1,
  "gpp": "DBABMA~CPXxRfAPXxRf...",
  "gpp_sid": [2, 7]
},
"user": { "ext": { "consent": "CPXxRfAPXxRfABcAB..." } }

• gdpr: 1 = GDPR applies, 0 = no, omitted = unknown
• gpp: Global Privacy Platform – the envelope for multiple regulations
• gpp_sid: sections that apply: 2 = TCF Europe, 7 = US National
• user.ext.consent: the TC String itself

Note the split. regs.gdpr is just a flag – it says the regime applies. It tells the buyer nothing about what the user has actually allowed. The substance is the opaque string over in user.ext.consent. You need both.

And that gpp sitting next to it? That is the Global Privacy Platform – one envelope carrying Europe's TCF string, a US state signal and Canada's, each as a numbered section. The same trick OpenRTB itself pulled for auctions: Stop everyone from inventing their own format. As the American privacy patchwork grows, that very field is quietly becoming the one that matters.

The five gates

Before Prebid lets a single bid leave the page, its TCF Control module reads that string and asks five questions, one per Purpose. Every "no" closes its own gate. And here is what kills the boolean idea: The gates do not swing in unison.

Full consent opens all five. Legitimate interest – the fallback when a user does not actively say yes – only opens some of them:

Visualization generated with claude.ai

That gap is the whole story. Under TCF v2.3 – the version IAB made mandatory in early 2026 – legitimate interest cannot carry personalized ads: Purposes 3 through 6 require real consent. So on a legitimate interest basis you can still run a contextual auction (Purpose 2) and measure it (Purpose 7), but storage (Purpose 1), identity (Purpose 4) and precise geolocation all require consent. Three of the five gates slam shut.

The one that hurts the most is Purpose 4. When it is closed, Prebid strips user.ext.eids before any adapter sees it – the entire identity ladder from part 4, gone for that impression. You are not in the dark; the auction still runs. You have just dropped down to a contextual ad – Google's "limited ads" mode, drawn gate by gate. (Lose Purpose 2 as well, with neither consent nor legitimate interest, and even the auction stops – bidders simply do not bid.)

But five gates is the simplified version. The real TCF list is longer – eleven Purposes and two Special Features:

Visualization generated with claude.ai

The good news sits in the bottom half. Legitimate interest keeps more alive than you might fear: not only the contextual auction, but the entire measurement and audience block – ad and content measurement, audience statistics, service improvement and content selection (Purposes 7 through 11).

What actually falls away without consent is a tight cluster: storage on the device (Purpose 1), the four personalization Purposes (3 through 6) and special features like precise geolocation. So "no consent" does not hollow out the request – it removes identity and personalization while measurement and context keep working. That is why limited ads still earn a substantial bid rather than nothing.

Every one of these gates is tuned with config – exactly the pattern from part 3:

pbjs.setConfig({
  consentManagement: {
    gdpr: {
      cmpApi: 'iab',
      defaultGdprScope: true,
      rules: [
        { purpose: "storage", enforcePurpose: true, enforceVendor: true },
        { purpose: "basicAds", enforcePurpose: true, enforceVendor: true },
        { purpose: "personalizedAds", enforcePurpose: true, enforceVendor: true },
        { purpose: "measurement", enforcePurpose: true, enforceVendor: true },
        { purpose: "transmitPreciseGeo", enforcePurpose: true }
      ]
    }
  }
});

The master switch was never one switch. It is five gates, and the string decides which ones open.

Passing the string along is not the same as respecting it

Capturing a consent string and passing it along is the easy 5%. Respecting it is the other 95% – the five gate checks, performed anew in every single auction before anything leaves the browser.

And there is an uncomfortable twist. That string you so carefully pass around? The courts have now ruled that it is in itself personal data. In IAB Europe v. Gegevensbeschermingsautoriteit (Court of Justice of the EU, case C-604/22, March 2024), the court found that a TC String can identify a person when combined with something like an IP address. That case traces back to a 2022 decision by the Belgian data protection authority, which fined IAB Europe €250,000 over the framework – a fine the Brussels Market Court largely upheld in May 2025.

The signal we built to prove we respect privacy is now itself regulated as personal data. The receipt became evidence. Whether the framework is sustainably compliant is genuinely unresolved. (I am an ad tech nerd, not a lawyer. Take this as context, not advice.)

The part that actually costs you money

And now to the reason "boolean" is the wrong word. When consent disappears, you mostly do not go dark. You drop into a worse state. Google calls it Limited Ads: contextual only, no stored identifiers. The ad still gets delivered. It just gets delivered for less.

So consent is not a switch between paid and unpaid. It is a dial for how much.

I gave you our numbers in part 4: Across a good 3.3 billion impressions, roughly one in five ran in the limited state without full consent and earned about 27% less on average. But the average hides the story: The pure open auction – the demand leaning hardest on third-party identity – lost around 60% of its value the moment consent disappeared, while PMP and header bidding lost about a quarter, and guaranteed and sponsorships only single-digit percentages.

The same pattern as the identity ladder, because it is the same pattern. Consent costs you the most precisely where you control the least.

Summary

Consent is not a boolean.

• It travels in the request as a flag (regs.gdpr) plus an opaque string (user.ext.consent) – increasingly inside the GPP envelope.
• Prebid turns that string into five gate checks in every auction: storage, the auction itself, identity, geo and measurement.
• Passing the string along is the easy part. Respecting it – the five checks, every time – is the real work.
• It rarely decides whether you get paid. It decides how much – and hits hardest on the open auction demand you control the least.

Outro

This is the fifth article in the nine-part series What is actually hiding in a bid request?

Next: Part 6 of 9: Context – site, app, device & environment →