Consent Signal Checklist

Step 1 — Identify Your Ad Tech Partners

• List every ad tech vendor in your stack: ad server, SSP, DSP, measurement, data platform
• For each vendor, confirm: which consent signals do they require? (TCF, GPP, or proprietary)
• Check if vendors are on the IAB GVL (Global Vendor List) — required for TCF integration
• Identify which markets you serve and which privacy laws apply

Step 2 — Select and Implement a CMP

• Choose a CMP registered on the IAB's CMP list (required for TCF compliance)
• Confirm the CMP supports GPP if you serve multi-market audiences
• Configure consent categories to match your tag inventory
• Configure vendor list to include all ad tech partners that require TCF purposes
• Review and finalise consent banner copy and UX (see consent UX patterns)
• Set default state: non-essential vendors blocked before consent

Step 3 — Block Tags Until Consent

• Configure tag manager (GTM or equivalent) to block non-essential tags before CMP fires
• Verify no personalised ad requests fire before a TCF/GPP signal is available
• Test in browser with network tab: confirm blocked tags are not loading on first page visit
• Test with consent declined: confirm ad requests include rejection signals

Step 4 — Pass Consent Strings Downstream

• Web ad requests: confirm TCF string is passed via gdpr_consent parameter (or GPP equivalent)
• Server-side auction: confirm consent string is included in bid requests to SSPs
• CTV ad requests: confirm GPP string (or TCF string if applicable) is passed in VAST URL parameters
• Confirm each SSP confirms receipt and respects the signals (request documentation from partners)

Step 5 — Test Across Environments

• Web (desktop Chrome, Safari)
• Web (mobile Chrome, Safari on iOS)
• CTV (if applicable) — test consent signal presence in ad request URLs
• Test: consent accepted → personalised ads deliver
• Test: consent declined → only contextual ads deliver (or no ads if no contextual fill)
• Test: consent withdrawn → subsequent ad requests reflect withdrawal

Step 6 — Monitor and Maintain

• Set up monitoring for consent acceptance rate by market (declining rates may indicate UX issues)
• Review GVL updates: vendors are added and updated; your CMP config needs periodic review
• Subscribe to IAB Europe and IAB Tech Lab update channels for framework changes
• Review when new US state privacy laws come into force — update GPP sections accordingly
• Annual review of your full tag inventory to catch new tags added without consent configuration

This checklist is a practical framework, not legal advice. Consent signal requirements depend on your specific ad tech stack, markets, and legal basis claims.