Reading IAB TCF Consent in JavaScript: __tcfapi, TC Strings and the TCF 2.3 Rule

TL;DR

• The IAB TCF is the standard for passing ad consent from a cookie banner to ad vendors.
• Your CMP exposes __tcfapi on the page. Listen for events instead of polling.
• From 1 March 2026, new TC strings need the Disclosed Vendors segment (TCF 2.3).
• TCF 2.4's deadline for websites is 23 October 2026.

What the CMP gives you

When a visitor makes a choice, a certified CMP encodes it into a TC string: purposes consented to, vendors approved, legal basis per vendor, CMP ID and timestamps. It gets attached to ad requests so SSPs and DSPs can decide whether to bid. If the overall flow is new to you, Seers has a beginner-friendly guide to the IAB Transparency Consent Framework.

Reading consent the right way

getTCData was deprecated in TCF 2.2. Register a listener instead:

__tcfapi('addEventListener', 2, (tcData, success) => {
  if (!success) return;

  const ready = ['tcloaded', 'useractioncomplete'].includes(tcData.eventStatus);
  if (!ready) return;

  if (tcData.gdprApplies === false) {
    loadAds(); // GDPR does not apply to this visitor
    return;
  }

  const canStore = tcData.purpose.consents[1];   // Purpose 1: store/access info on a device
  const googleOk = tcData.vendor.consents[755];  // 755 = Google Advertising Products on the GVL
  if (canStore && googleOk) loadAds();
});

The three eventStatus values:

• tcloaded: the CMP has loaded and has a TC string ready
• cmpuishown: the banner is showing (or was reopened)
• useractioncomplete: the visitor has just confirmed their choices

Gotchas

• __tcfapi must be a function at all times, even during start-up. Code inside iframes finds it through the __tcfapiLocator frame.
• gdprApplies can be undefined while the CMP is still working out where the visitor is.
• Google only serves personalised ads in the EEA, UK and Switzerland when the CMP is Google-certified and integrated with the TCF.

Why the business side cares

No valid string means fewer bids and lower fill on European traffic. Seers is an IAB TCF-certified CMP, so the banner, the TC string and the API come ready. Your code only has to listen.

---