Mapping permission signals through the ad supply chain

A permission signal can change meaning as it passes from a site to an advertising platform and downstream partners. Draw the chain before assuming one consent tool controls every recipient.

Map each route as user choice and purpose in the notice → consent capture in a CMP → named signal and fields → API or tag reading it → each observed advertising platform and downstream partner → expected action. Mark each hand-off where the payload or its interpretation could change.

For TCF, map user choice → CMP → TC String (Transparency and Consent String with Global Vendor List format) → TCF CMP API or __tcfapi → Google Tag Manager, if present → tags and their observed endpoints. Record the signal and recipient at each hand-off; the TC String alone does not prove a downstream tag received or applied the choice.

For GPP, map site or app → Consent Management Platform API → GPP string → ad tech provider, and record the supported string carried: IAB Europe TCF, IAB Canada TCF, MSPA US National string or a US State string. IAB Tech Lab describes GPP as a transmission protocol, and IAB Europe publishes TCF specifications; a shared format does not guarantee every vendor follows the choice.

The TCF resources name the TC String with Global Vendor List format and a list of registered TCF Vendors. Use these to label the TCF route, then match each live endpoint to the vendor it actually calls rather than treating framework membership as proof of a call.

Google Tag Manager is a tag container; when installed, its script request contacts Google-controlled infrastructure to retrieve the container script. Map that request separately, then record which tags fire and the endpoint each calls; container loading does not establish that a consent signal reached a tag or partner.

Firefox implements Global Privacy Control (GPC), and OneTrust says its CMP supports the signal. Map GPC as a separate browser-originated input, then verify what value or API is passed onward instead of assuming it becomes a TC String or GPP string.

Include server-side events and measurement partners, not just browser tags. Add each as a node at the API or event hand-off where it receives a signal, and record the actual endpoint.

Test four states with authorised test devices: no choice yet, granted, denied and withdrawn. For each state, note which calls occur and which fields are passed at each named hand-off.

Check whether denial stops the relevant processing or merely changes a reporting label, and compare withdrawal separately with denial. Keep screenshots or logs in the internal review record, not in customer-facing copy.

Use the map to identify which partners belong in the chain at all. Record each partner's observed name and expected action, then document gaps and owners before expanding the integration.

Mapping Permission Signals Through the Ad Supply Chain

TC String vs. GPP String: Key Differences in Consent Transmission

Testing Permission Signal States with Authorised Devices

Key Data Points for Consent Signal Mapping