IAB TCF Support

The c15t backend optionally supports IAB TCF v2.3, including Global Vendor List (GVL) management and TC String generation.

CMP Registration

consent.io is pending validation as an IAB Europe-registered CMP for c15t. Once approved, when using consent.io as your hosted backend, the CMP ID will be automatically provided to clients — no additional configuration needed.

If you self-host and have your own CMP registration with IAB Europe, configure your CMP ID via iab.cmpId. This value is returned to clients in the /init response so they use the correct CMP identity in TC Strings.

Info

A valid (non-zero) CMP ID is required for IAB TCF compliance. If neither the backend nor the client provides a CMP ID, IAB initialization will fail with an error.

Info

If you heavily customize or build your own IAB banner or dialog (rather than using the default IABConsentBanner and IABConsentDialog components provided by c15t), you cannot use consent.io's CMP ID. You must register your own CMP with IAB Europe and configure your CMP ID via iab.cmpId.

Enable IAB

import { c15tInstance } from '@c15t/backend';

export const c15t = c15tInstance({
  // ...
  iab: {
    enabled: true,
    cmpId: 10, // your registered CMP ID (consent.io provides this automatically)
    vendorIds: [755, 52, 69], // only include vendors you use
  },
});

The backend fetches the GVL from https://gvl.consent.io by default and caches it. The /init endpoint returns the filtered GVL and your CMP ID to the frontend.

Custom GVL Endpoint

Point to your own GVL mirror:

iab: {
  enabled: true,
  endpoint: 'https://your-gvl-mirror.com',
  vendorIds: [755, 52, 69],
},

Bundle GVL by Language

Pre-bundle the GVL to avoid runtime fetches:

import gvlEn from './gvl/en.json';
import gvlDe from './gvl/de.json';

iab: {
  enabled: true,
  bundled: {
    en: gvlEn,
    de: gvlDe,
  },
},

Info

Bundling all required GVL translations can significantly increase your deployment size. On serverless environments like Cloudflare Workers — which have strict bundle size limits — this may cause deployments to fail. Consider bundling only the languages you need, or use the GVL endpoint with a cache adapter instead.

Custom Non-IAB Vendors

Add your own vendors alongside IAB-registered ones:

iab: {
  enabled: true,
  vendorIds: [755],
  customVendors: [
    {
      id: 'internal-analytics',
      name: 'Our Analytics Platform',
      privacyPolicyUrl: 'https://example.com/privacy',
      purposes: [1, 8],
    },
  ],
},

TC String

When IAB TCF is enabled, consent records include a tcString field — the encoded TC String that can be passed to vendors. The frontend SDKs handle this automatically when using mode: 'c15t'.