EU consent and TCF strings

Viewers in the EU, EEA, UK and Switzerland get contextual ads unless your player sends a valid TCF consent string. What that means and how to pass one.

If your viewers are in the EU, the EEA, the UK or Switzerland, every ad request needs the viewer's consent string. Without a valid one, LtvAdx still serves an ad, but chooses it contextually. This article explains when that happens and what your player has to send.

For every privacy signal LtvAdx reads, not only the European ones, see How viewer privacy and consent work.

When GDPR applies to a request

LtvAdx treats a request as covered by GDPR when:

• it carries gdpr=1, or
• it carries no gdpr value and the viewer is in the EU, the EEA, the UK or Switzerland. The country comes from the address that makes the request.

A request that carries gdpr=0 is treated as your statement that GDPR does not apply to that viewer. Send it only when that is true.

What counts as valid consent

The gdpr_consent value must be an IAB TCF v2 consent string that gives consent for purposes 1, 3 and 4: storing or reading information on the device, building a profile for personalised ads, and using that profile to choose ads. A string that cannot be read, or that lacks any of the three, counts as no consent.

LtvAdx is not registered as a vendor on the IAB Global Vendor List yet, so only the purposes are checked, not consent for a named vendor. If that changes, the string will also need consent for LtvAdx's vendor ID.

What "contextual" means for that request

The ad is chosen from the channel, its content, the country and region, and the type of device. For that request:

• The viewer's household is not used, so campaigns that target households or audiences can't match it.
• No frequency cap by household applies.
• No household is sent to outside buyers. They get no advertising ID, only the network part of the viewer's address, and they are told the request is contextual. Buyers that need to recognise a viewer may not bid.
• The viewer is not counted in reach.

Ads still play. Campaigns that don't depend on the household can win it: those that target location, channel, content, device or time, or nothing at all.

How to pass consent

The consent string belongs to one viewer, and it changes when they change their choices. It can't be written into a fixed tag, so it has to be added to each request.

1. Your consent tool (CMP) collects the viewer's choices and gives you their TC string. In a web page, the standard __tcfapi call returns it as tcString.
2. Add gdpr=1&gdpr_consent= followed by that string to the ad address for that viewer.
3. If your own ad server builds the address, use its consent macros so it fills both values for each request. See Call LtvAdx from your own ad server.

The same two names work on the VAST tag, the VMAP playlist (it passes them on to every break) and an SSAI session request. See Get your VAST tag and Set up server-side ad insertion.

Who is responsible

You decide the lawful basis for your viewers and run the consent tool that collects their choices. LtvAdx acts on the signals you send. The Privacy Policy and your contract set out the roles.