Use current requirements
TCF 2.2 should not be described as current. IAB Europe's TCF 2.3 transition guidance makes the disclosed-vendors segment mandatory for newly created strings from March 1, 2026; older strings have transition treatment. The technical specification also records 2.4 changes. Check your CMP and platform's implementation requirements.
A TC string's core version field is not the same thing as the framework's minor version. Finding an API call with version 2, or seeing a consent macro, cannot prove 2.3 or 2.4 compliance.
Consent macros must identify the recipient
In GAM, ${GDPR_CONSENT_XXXX} is a pattern, not a ready-to-paste macro.
Replace XXXX with the receiving vendor's IAB Global Vendor List ID.
${GDPR_CONSENT_755} identifies Google; it is not a universal consent macro
for Flashtalking, Xandr, Innovid, Criteo or other vendors.
See Google's macro reference.
Confirm the recipient, parameter name and encoding with the vendor. A tag containing several recipients may need different IDs at different destinations. CreativeValidator preserves consent placeholders during automatic click/cachebuster repair; it does not choose a recipient ID for you.
What the tool can establish
- Static inspection: recognized macro strings and CMP API patterns in the submitted code. This cannot prove the actual consent string the publisher will supply at serving time.
- Isolated behavior: when available, the consent matrix compares attempted requests, storage writes and other observations under supplied test states.
- Limits: the current TCF simulation uses legacy 2.2-style fixtures. It is not a full 2.3/2.4 conformance test. External requests are blocked in that simulation, so blocked vendor payloads cannot execute downstream behavior.
General scan stages can still contact external hosts. Read scan traffic details. A consent score or clean simulated result is a technical diagnostic, not a legal-compliance verdict.
A practical verification sequence
- Identify the receiving vendor and its current GVL entry, then confirm the required signals and parameters with that vendor and the publisher's CMP implementation.
- Inspect the tag and report. Preserve unavailable measurements and unresolved placeholders as things still requiring verification.
- Test the actual serving integration under the relevant user choices. Confirm the CMP callback timing, expanded request values and vendor behavior in that environment.
- Recheck after CMP, tag or platform changes. Use Google's TCF troubleshooting guidance for platform-reported consent errors.