Integrate a privacy-first consent signal into an OpenRTB 2.6 bid request using TCF and GPP fields

Verified steps

1. In your OpenRTB bid request builder, populate the regs object: set regs.gdpr = 1 for EEA traffic and regs.us_privacy for CCPA traffic (using the legacy 4-character US Privacy string, e.g., '1YNN' for opted-in-to-sale).
2. For TCF v2.2, set regs.ext.consent (or regs.ext.consents per your exchange's schema) to the base64url-encoded TC String retrieved from the __tcfapi or euconsent-v2 cookie.
3. For GPP, populate regs.gpp with the GPP string and regs.gpp_sid with the array of active section IDs (e.g., [2] for TCFEUV2, [7] for USPNATV1, [8] for California USCA).
4. Set user.ext.consent to the same TC String for DSP-side parsing, and user.eids only for users who have granted consent for personal data use under the applicable framework.
5. Validate bid requests in a staging environment by logging incoming requests from DSPs and confirming they parse the regs and user consent fields correctly before going live.
6. For server-side header bidding (e.g., via Prebid Server), pass the consent strings in the bidderRequest.gdprConsent.consentString parameter in your Prebid configuration, which Prebid Server maps to the OpenRTB fields automatically.