Free tool

Free TCF String Decoder and Encoder

The decoder reads the TC string of any IAB Transparency and Consent Framework (TCF) consent tool and shows every purpose, vendor and segment it holds, by name, in your browser.

Decode a TC string Generate Privacy Policy
  • Core string
  • Disclosed vendors
  • Publisher TC
  • Google AC string

Decode or encode a TC string.

Paste a TC string to see what it holds, or build a test string from a form. The strings stay in your browser and never reach TermsFeed.

Paste a TC string, the value of the euconsent-v2 cookie, or a GPP string with a TCF EU section.

The value of the addtl_consent cookie or parameter, such as 2~1.35.41~dv.9.21.

Loading the vendor names.

Paste a TC string to see its fields here.

Set the fields of a test string. The encoder writes the core segment and the disclosed vendors segment as you type.

CMP and string

2 letters, such as DE. AA when the country is unknown.

The encoder writes both dates at midnight UTC.

Purposes

From TCF v2.2 on, purposes 1, 3, 4, 5 and 6 rest only on consent, so their legitimate interest boxes are off.

Purposes
Purpose Consent Legitimate interest
Special features
Vendors

Vendor IDs and ranges, such as 1-50, 755. Accept all fills in every vendor of the Global Vendor List.

Disclosed vendors segment

The decoder follows the IAB Europe TC string specification and takes the vendor and CMP names from the lists IAB Europe and Google publish. It isn't legal advice, and an encoded string is for testing only.

How to find the TC string of a website.

A TCF consent tool stores the TC string in the browser and hands it to ad scripts. Open the website, make a choice in its consent banner, then use 1 of these ways.

  1. The cookie. Open the developer tools of your browser, go to Application (Chrome, Edge) or Storage (Firefox), then Cookies, and copy the value of euconsent-v2. Some CMPs keep the string under another name or in local storage.

  2. The console. In the Console tab, run __tcfapi('getTCData', 2, function (data) { console.log(data.tcString) }) and copy the string it prints.

  3. Ad requests. In the Network tab, filter by gdpr_consent and copy the value of that parameter from an ad request.

  4. Google Additional Consent. Run __tcfapi('getTCData', 2, function (data) { console.log(data.addtlConsent) }), or copy the addtl_consent parameter of a Google ad request.

  5. Mobile apps. In an Android or iOS app, the CMP stores the string as IABTCF_TCString in SharedPreferences (Android) or NSUserDefaults (iOS).

TC string

What a TC string holds.

A TC string is a list of segments separated by dots. The core segment comes first, and each other segment starts with its type.

The segments of a TC string, what each holds and when it is required
Segment What it holds In TCF v2.3
Core The CMP, the dates, the language, the purposes and special features the person chose, the vendors with consent or legitimate interest, and the publisher restrictions. Required in every TC string.
Disclosed vendors The vendors the consent banner showed to the person, whatever the choice. Required in TC strings created after February 28, 2026.
Publisher TC The choices for the purposes of the publisher itself, with any custom purposes. Optional.
Allowed vendors The vendors the publisher allowed. Retired in TCF v2.2.
Google AC string The Google ad technology providers outside the TCF with consent and, in version 2, the providers disclosed. A separate string, for Google ad products.
Purposes

The 11 TCF purposes.

TCF v2.2 defines 11 purposes that need a choice and 2 special features that need an opt-in. Vendors rely on consent or, for some purposes, legitimate interest.

The TCF purposes and special features with the legal basis each allows
Purpose Legal basis
1 Store and/or access information on a device Consent
2 Use limited data to select advertising Consent or legitimate interest
3 Create profiles for personalised advertising Consent
4 Use profiles to select personalised advertising Consent
5 Create profiles to personalise content Consent
6 Use profiles to select personalised content Consent
7 Measure advertising performance Consent or legitimate interest
8 Measure content performance Consent or legitimate interest
9 Understand audiences through statistics or combinations of data from different sources Consent or legitimate interest
10 Develop and improve services Consent or legitimate interest
11 Use limited data to select content Consent or legitimate interest
SF1 Use precise geolocation data Opt-in
SF2 Identify devices based on information actively requested Opt-in

Privacy Policy Generator

Explain your ad partners in your Privacy Policy.

A TCF consent banner names the vendors, and your Privacy Policy explains the data your website collects and who receives it. The TermsFeed Privacy Policy Generator writes your Privacy Policy from your answers.

Generate Privacy Policy

Frequently asked questions.

Answers to common questions about TC strings and the TCF.

What is a TC string?

A TC string is the encoded record of the choices a person makes in a TCF consent banner.

  • The consent management platform (CMP) writes it after the person accepts, rejects or saves choices.
  • Ad vendors read it to know which purposes and vendors the person agreed to.
  • The decoder turns it back into those fields.

Does the decoder send my TC string to TermsFeed?

No, the decoder runs in your browser, and the TC string never leaves it.

The page loads the vendor names as a file from the TermsFeed website, then decodes and encodes on your device. The Court of Justice of the European Union (CJEU) ruled in case C-604/22 on March 7, 2024 that a TC string is personal data when it is combined with data that identifies the person, such as an IP address.

What changed in TCF v2.3?

TCF v2.3 requires the disclosed vendors segment in every TC string created after February 28, 2026.

  • The segment lists the vendors the consent banner showed to the person.
  • Each vendor checks its bit in the segment to know it was disclosed.
  • Strings created earlier without the segment stay valid.

The core segment didn't change, and TCF v2.3 strings carry policy version 5.

Why does a vendor show as not in the GVL?

The vendor ID isn't in the Global Vendor List (GVL) version the page loaded.

  • The vendor left the GVL, and the table shows the date it left.
  • The CMP wrote an ID that IAB Europe never registered.
  • The string comes from a newer GVL than the copy on this page.

The decoder shows the GVL version and the date TermsFeed last checked it.

Can I use an encoded string on my website?

No, use the encoder only to test how vendors and tools read a string.

Vendors rely on a TC string that a CMP registered with IAB Europe writes after a person makes a choice in its consent banner. A string written by hand records no choice.

Does TermsFeed write TC strings?

No, TermsFeed Privacy Consent and Cookie Consent don't write TC strings, and neither is a CMP registered with IAB Europe.

Publishers on Google AdSense, Ad Manager or AdMob need a Google-certified CMP that writes a TC string to show personalized ads to visitors in the European Economic Area (EEA), the UK and Switzerland.

What is the Google Additional Consent string?

Does the decoder read GPP strings?

The decoder reads the TCF EU section of a Global Privacy Platform (GPP) string.

Paste the full GPP string, and the decoder finds the TCF EU section and decodes it as a TC string. The US sections of a GPP string stay undecoded.