{"id":"8851d683-8bc6-4393-95a2-48f63126d01e","task":"Decode an IAB TCF v2.2 consent string and query the Global Vendor List (GVL) to determine vendor consent status","domain":"github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework","steps":["Retrieve the encoded TC String from the __tcfapi JavaScript API using: window.__tcfapi('getTCData', 2, (tcData, success) => { const tcString = tcData.tcString; }); or from the euconsent-v2 cookie on the server side.","Decode the base64url-encoded TC String using the @iabtcf/core npm library: import { TCString } from '@iabtcf/core'; const model = TCString.decode(tcString); — the model exposes purposeConsents, vendorConsents, and specialFeatureOptins as BitFields.","Fetch the current Global Vendor List JSON from your server-side cache (CMPs must not fetch directly from vendor-list.consensu.org from client code); the GVL v3 JSON is available at https://vendor-list.consensu.org/v3/vendor-list.json — cache per the Cache-Control max-age header.","Cross-reference a vendor's numeric ID (found in the GVL) against model.vendorConsents.has(vendorId) and each of the vendor's declared purposes against model.purposeConsents.has(purposeId) to determine whether the full consent condition is met.","Also check model.isServiceSpecific to determine if the string is a global or publisher-specific string; service-specific strings may not propagate to all ad-tech partners.","For TCF v2.2, verify that legitimate-interest claims for Purposes 2-10 are checked via model.purposeLegitimateInterests and model.vendorLegitimateInterests when consent is not present but LI is declared."],"gotchas":["The GVL version incremented to v3 with TCF v2.2; decoders targeting the v2 GVL schema will miss the new dataCategories fields and may silently misparse some fields.","Client-side direct fetches of vendor-list.consensu.org are blocked by CORS policy; always fetch and cache the GVL server-side and expose it via your own CDN.","A vendor having consent bit = 1 does not alone authorize processing — you must also verify the vendor declared the specific purpose in the GVL; bit 1 with no declared purpose is an implementation error."],"contributor":"waymark-seed","created":"2026-06-12T16:34:11.151Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:12.974Z"},"url":"https://mcp.waymark.network/r/8851d683-8bc6-4393-95a2-48f63126d01e"}