Enable IAB TCF foundation mode, TC strings, and cmp.js parity — honest non-certified CMP guidance.
CookieShift includes an IAB TCF 2.2 foundation layer for EU/UK publishers: TC string encode/decode, proxied Global Vendor List (GVL), partial __tcfapi, and preference-center disclosure in cmp.js and banner.js preview.
Important: not a certified CMP
CookieShift is not an IAB-listed or certified TCF 2.2 CMP today. We provide a technical foundation (encode/decode, GVL proxy, consent logging) suitable for teams working with legal counsel on a manual compliance path — not a replacement for Cookiebot, CookieYes, or Usercentrics certification out of the box.
Honest positioning:
| Claim | Status |
|---|---|
TC string (euconsent-v2) generation | Supported when foundation mode enabled |
| GVL-backed vendor/purpose UI in cmp.js | Supported (Sprint 2 parity with preview) |
Full IAB CMP API (getVendorList, restrictions UI, etc.) | Partial — getVendorList + displayConsentUi added; not certification-ready |
| IAB Global CMP List registration | Not included — separate program |
Overview
When TCF foundation is enabled on a property, visitors with GDPR-classified traffic can see Purposes, Stacks, and Vendors (with legitimate-interest badges) in the preference center. Choices sync to window.__cookieshiftTcf and encode to a TC string on save via POST /api/public/tcf/encode.
Production WordPress and blocking-heavy installs typically load cmp.js. Dashboard preview uses banner.js — both now share the same TCF disclosure sections when foundation mode is on.
Why it matters
EU ad-tech stacks often expect a valid TC string and optional Google Additional Consent Mode string. Without foundation mode, CookieShift still manages cookie categories and Consent Mode, but partners requiring TCF signals need the foundation path configured honestly.
Setup
- Open Implementation → IAB TCF 2.2 for the active property.
- Enable TCF foundation mode and enter your registered CMP ID (from IAB or your legal vendor — CookieShift does not register CMP IDs for you).
- Use the GVL vendor picker to build an optional allow-list (or leave empty for all vendors).
- Map cookie categories to IAB purposes and configure legitimate interest defaults with legal review.
- Set publisher restrictions per vendor when you need consent-only or LI-blocked vendors.
- Choose GDPR applies (
auto,true, orfalse) for__tcfapiTCData. - Save configuration and publish the banner.
- Review TCF engineering readiness on the same page (checklist only — not certification).
- Verify on a live site using
cmp.js: open Customize → TCF sections (Purposes, Stacks, Vendors, LI). - Pair with Google Additional Consent Mode when running Google Ads ATP vendors.
| Check | Why |
|---|---|
tcf.enabled + foundationMode: foundation + cmpId > 0 | Required for encode and __tcfapi |
| Same property in header as live embed | Config loads by siteId |
| cmp.js on production site | Preview uses banner.js — both should match after parity work |
Entitlements and limits
- TCF foundation is a compliance configuration feature, not a separate paid toggle in all plans — confirm your workspace can save Implementation settings.
- Publisher restrictions, purpose LI editors, and GVL pickers are available under Implementation → IAB TCF 2.2.
- Legitimate interest purpose toggles appear in cmp.js for LI-eligible purposes (2, 7–11) plus publisher defaults in config. Work with legal counsel for LI legal basis.
Examples
| Scenario | Steps |
|---|---|
| Minimal EU publisher | Enable foundation + CMP ID → accept/reject banner → confirm euconsent-v2 cookie |
| Limit vendor list | Implementation → GVL vendor picker → select vendors → Save |
| Debug TC string | Consent logs → TC string column → Decode → review purpose/vendor maps |
| Check engineering readiness | Implementation → TCF engineering readiness panel |
| Google Ads EEA | TCF foundation + ACM vendor IDs → marketing consent |
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
| No TCF panel in preference center | Foundation off, missing CMP ID, or showVendorUi: false | Re-check Implementation → TCF foundation |
| Preview shows TCF but live site does not | Live site missing cmp.js or wrong siteId | Confirm embed from Modules; hard refresh |
| Empty TC string in logs | Visitor not in GDPR mode or foundation disabled at decision time | Test from EU VPN; verify config version on log row |
| Decode fails | Truncated string or wrong CMP ID at encode time | Copy full tcString; verify CMP ID matches encode |
| Vendor missing from list | Not in selectedVendorIds filter | Add ID or clear filter to show full GVL set |
__tcfapi returns false | Unsupported command | Supported: ping, getTCData, getVendorList, displayConsentUi, listeners |
Is CookieShift IAB-certified?
No. CookieShift provides a foundation implementation with nonCertifiedNotice in TC data when enabled. Certification requires the IAB CMP program, full API surface, and conformance testing — planned as a Phase 3 enterprise track, not this foundation release.
Where is the TC string stored?
In the euconsent-v2 cookie on the visitor browser, in consent logs (tcString field), and temporarily in cmp runtime state after encode.
Related
- Additional Consent Mode — Google ATP strings
- Consent modes — GDPR vs CCPA behavior
- Consent banner — first-layer banner setup
- Reports — consent log exports
Best practices
- Never tell EU customers CookieShift is a certified CMP without IAB list registration.
- Test live cmp.js after every TCF config change — preview alone is necessary but not sufficient.
- Store CMP ID and vendor selection changes in change-management records for audits.
- Use consent log Decode for support tickets involving TC string disputes.