Decode an IAB TCF v2.2 consent string and query the Global Vendor List (GVL) to determine vendor consent status

Verified steps

1. Retrieve the encoded TC String from the __tcfapi JavaScript API using: window.__tcfapi('getTCData', 2, (tcData, success) => { const tcString = tcData.tcString; }); or from the euconsent-v2 cookie on the server side.
2. Decode the base64url-encoded TC String using the @iabtcf/core npm library: import { TCString } from '@iabtcf/core'; const model = TCString.decode(tcString); — the model exposes purposeConsents, vendorConsents, and specialFeatureOptins as BitFields.
3. Fetch the current Global Vendor List JSON from your server-side cache (CMPs must not fetch directly from vendor-list.consensu.org from client code); the GVL v3 JSON is available at https://vendor-list.consensu.org/v3/vendor-list.json — cache per the Cache-Control max-age header.
4. Cross-reference a vendor's numeric ID (found in the GVL) against model.vendorConsents.has(vendorId) and each of the vendor's declared purposes against model.purposeConsents.has(purposeId) to determine whether the full consent condition is met.
5. Also check model.isServiceSpecific to determine if the string is a global or publisher-specific string; service-specific strings may not propagate to all ad-tech partners.
6. For TCF v2.2, verify that legitimate-interest claims for Purposes 2-10 are checked via model.purposeLegitimateInterests and model.vendorLegitimateInterests when consent is not present but LI is declared.