A user in Germany and a user in California have different rights, and your ad stack has to know which, and act on it, in milliseconds. The whole apparatus is a set of strings that travel with the bid request.
| Regulation | The signal it produces |
|---|---|
| GDPR (EU) | TCF, encoded as the TC string (which consent purposes the user granted). |
| CCPA / CPRA (US) | The US Privacy string, plus MSPA (Multi-State Privacy Agreement) signals. |
| All of the above | Unified under the IAB Tech Lab Global Privacy Platform (GPP): one string carrying whichever applies. |
Prebid’s consent-management modules read the signal from your CMP and attach it to every bid request, so bidders and identity modules can honor it.
Key idea
Consent gates identity and bidder participation. When a user withholds a purpose, the identity IDs (UID2 and friends) do not populate and some bidders drop out entirely. Fewer bids and lower CPM, but compliant, which is the only acceptable outcome.
Quick check
An EU user withholds TCF Purpose 1 (storing and accessing information on the device). What happens to their UID2 ID?
Note
A publisher in the EU plus a few US states needs the TCF and US Privacy / MSPA signals (under GPP) and the matching Prebid consent modules wired in.