A European site with a banner usually writes down what it thinks you agreed to, in a format that a machine can read: a TC string under IAB Europe's Transparency and Consent Framework, and often a second, much less studied Additional Consent (AC) string invented by Google for the vendors the TCF does not cover. Both are visible to a crawler. Decoding them turns “did the site respect my choice?” from a question about pixels and cookies into a question about two byte arrays. That is why the slice of the compliance literature that audits recording rather than behaviour is almost entirely TCF work — though, as this page's own corpus section shows, that slice is very small.

This page is about those strings as measurement artefacts: where they are, how to decode one so that the decode is still reproducible next year, and — the part that gets papers rejected — what a decoded string does and does not license you to claim. Whether your crawler should click Accept or Reject at all, how to find the banner, and what the wider consent-signal landscape looks like are on Granting Consent to Websites; this page starts after the choice is made.

• Do Cookie Banners Respect my Choice? [2Matte, Célestin; Bielova, Nataliia; Santos, Cristiana Teixeira (2020): "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)], IEEE S&P 2020 — the paper that made the TC string the unit of analysis. It is the origin of the four-violation taxonomy and of the practice of reading the stored string instead of the banner. Date it: it measures TCF v1.1, whose __cmp() API, shared consensu.org cookie and five-purpose model have all been retired. The method survived; the mechanics did not.
• A Study of GDPR Compliance under the Transparency and Consent Framework [3Smith, Michael; Torres-Agüero, Antonio; Grossman, Riley; Sen, Pritam; Chen, Yi; Borcea, Cristian (2024): "A Study of GDPR Compliance under the Transparency and Consent Framework", in: Proceedings of the ACM Web Conference. (DOI)], TheWebConf 2024 — the cleanest published description of an end-to-end TC-string pipeline: find strings in requests and cookies, decode, validate, aggregate per domain. Read it for the pipeline and for the finding that the IAB decoder will happily decode strings that are not TC strings.
• Johnny Can't Revoke Consent Either [1Kancherla, Gayatri Priyadarsini; Bielova, Nataliia; Santos, Cristiana; Bichhawat, Abhishek (2025): "Johnny Can't Revoke Consent Either: Measuring Compliance of Consent Revocation on the Web", in: Proceedings on Privacy Enhancing Technologies. (DOI)], PETS 2025 — the paper to read for where strings hide. It is the only one in this corpus that systematically compares the string in the browser against the strings actually leaving it, in POST bodies, JSON responses and HTML.
• The TCF doesn't really A(A)ID [4Morel, Victor; Santos, Cristiana; Carlsson, Pontus; Ahlinder, Joel; Duvignau, Romaric (2026): "The TCF doesn't really A(A)ID - Automatic Privacy Analysis and Legal Compliance of TCF-based Android Applications", Proceedings on Privacy Enhancing Technologies 2026(3). (DOI)], PETS 2026 — the framework in Android apps, where the string lives in SharedPreferences under IABTCF_* keys rather than in a cookie. The first study to decode what a mobile CMP stores — [5Koch, Simon; Altpeter, Benjamin; Johns, Martin (2023): "The OK Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications", in: Proceedings of the USENIX Security Symposium. (Link)] had already counted apps setting IABTCF_ keys three years earlier, but not read the values. The web methods do not transfer unchanged.
• Privacy Preference Signals: Past, Present and Future [6Hils, Maximilian; Woods, Daniel W.; Böhme, Rainer (2021): "Privacy Preference Signals: Past, Present and Future", in: Proceedings on Privacy Enhancing Technologies. (DOI)], PETS 2021 — for the framing question of why an industry consent signal exists at all, and for adoption measured longitudinally rather than in one snapshot.
• The specifications themselves are short and are the only authority that matters for the format: the TC string and GVL format spec and the CMP API spec, both maintained by IAB Tech Lab on GitHub, and Google's Additional Consent technical specification in the Ad Manager help centre.²⁾

A TC string is dot-separated web-safe base64. Segment 0 is the Core String and is always present. Later segments carry a 3-bit segment type in their first bits, so they can appear in any order:

A string with only one segment is either pre-v2.3 or non-conformant. Count segments before you conclude anything about disclosure.

The Core String is a fixed bit layout. These are the fields that change what a paper can claim; the full table is in the spec.

Every figure about the TCF is a figure about one version of it. This is the specification's own changelog, re-fetched on 2026-08-26, filtered to changes a measurement can see — two v2.1 rows about a JSON example and a document merge are dropped:

Two consequences for anyone crawling now. A dataset that spans 1 March 2026 spans two different meanings of the vendor legitimate-interest bit: before that date it was also set for vendors that declared only special purposes, so a naive “share of vendors asserting legitimate interest” is inflated on the early side of the boundary and not on the late side. And a dataset that spans May 2023 spans the change from ten purposes to eleven and the removal of legitimate interest for purposes 3–6, which is exactly the quantity [3Smith, Michael; Torres-Agüero, Antonio; Grossman, Riley; Sen, Pritam; Chen, Yi; Borcea, Cristian (2024): "A Study of GDPR Compliance under the Transparency and Consent Framework", in: Proceedings of the ACM Web Conference. (DOI)] measured under the old rules.

The TCF has never required one storage location — v2 explicitly leaves it to the CMP, including non-cookie storage. Reading only one channel is the single most common way to under-count.

One channel is historical and must not be reported as current: the shared cookie on the consensu.org domain, euconsent under TCF v1.x and euconsent-v2 under v2.0's optional global scope. Either way a CMP could read a consent string written by a different CMP on a different site, which is how [2Matte, Célestin; Bielova, Nataliia; Santos, Cristiana Teixeira (2020): "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] found that “Using this protocol, 62 (4.3%) websites return the same consent strings” after planting one in 2019. IAB Europe announced the deprecation of global scope, out-of-band consent and the euconsent-v2 cookie on 22 June 2021, and global-scope strings have been invalid since 1 September 2021. If you crawl statefully today, a stale consent string is a problem you carry between page loads of the same site, not one you carry between sites via IAB infrastructure.

The API channel needs one specific piece of code, because the command most published crawlers use for it is deprecated. This is the current pattern, and it is what produced the output below:

tcf_capture.js

// Inject BEFORE any page script (Playwright: context.addInitScript).
// Uses addEventListener, not the getTCData command deprecated in TCF v2.2.
// Records EVERY event, so a late 'useractioncomplete' is not lost, and leaves
// a defined-but-silent __tcfapi visible as an empty event list rather than as
// "no TCF".
window.__probe = { events: [] };
(function poll(n) {
  if (typeof window.__tcfapi === 'function') {
    window.__tcfapi('addEventListener', 2, function (d, ok) {
      window.__probe.events.push({
        ok: ok,
        eventStatus: d && d.eventStatus,     // tcloaded | cmpuishown | useractioncomplete
        cmpStatus: d && d.cmpStatus,         // stub | loaded | error
        gdprApplies: d && d.gdprApplies,     // the PUBLISHER's determination, not yours
        cmpId: d && d.cmpId,
        tcfPolicyVersion: d && d.tcfPolicyVersion,
        tcString: d && d.tcString,
        addtlConsent: d && d.addtlConsent,   // Google AC string, if the CMP supports it
      });
    });
    return;
  }
  if (n > 0) setTimeout(function () { poll(n - 1); }, 250);   // 10s for the stub to resolve
})(40);

The canonical decoder is IAB Tech Lab's iabtcf-es. Use it — and then check which package you installed, because the project renamed its npm scope and left the old one on the registry, undeprecated, three years stale:

This is not a cosmetic difference, and the failure is silent. Decode the same string with both and they disagree on useNonStandardTexts: the 2026 package exposes it, the 2023 package exposes the field under its old specification name useNonStandardStacks and returns undefined for the current one. Code written against the current spec gets undefined rather than an error, and undefined is falsy. Record the exact package and version in the paper, because a decoder that predates a field does not tell you the field is missing; it returns a default.

The other half of the warning is that a decoder returning a value is not evidence that the input was a TC string. [3Smith, Michael; Torres-Agüero, Antonio; Grossman, Riley; Sen, Pritam; Chen, Yi; Borcea, Cristian (2024): "A Study of GDPR Compliance under the Transparency and Consent Framework", in: Proceedings of the ACM Web Conference. (DOI)] searched requests and cookies for the keys gdpr_consent and euconsent_v2 and the C prefix, then found by hand that “we found 62 decoded strings that were not valid TC strings in TCF v2.1” — including the literal text cookie_banner_accepted — and concluded that “Currently, the IAB decoder lacks a solution for checking if a TC string is valid or not”. Validate structurally: version 2, a plausible VendorListVersion, a TcfPolicyVersion that exists, a PublisherCC that is two letters, and a segment inventory.

The decoder below reads the Core String fields listed above and nothing else, which is the point: it cannot silently disagree with a newer specification about a field it does not touch. It was checked field-by-field against @iabtechlabtcf/core 1.5.21 on the specification's own example string, a 2020-era string, and the four strings captured live on 2026-08-26 — all six agree exactly, on all eighteen fields. Its output is the spiegel.de row of the worked example above.

tcstring.mjs

// Decode the Core segment of a TCF v2 TC String, plus the segment inventory.
//
// Why hand-rolled: the reference implementation is IAB Tech Lab's iabtcf-es,
// published as @iabtechlabtcf/core (1.5.21, 2026-02-10) — NOT @iabtcf/core,
// which is the same project's abandoned npm scope, undeprecated and frozen at
// 1.5.6 from 2023. This reads the fields a measurement actually needs and
// nothing else, so it cannot silently disagree with a newer spec about a field
// it does not touch. Cross-checked field-for-field against 1.5.21 on 6 strings.
//
//   node tcstring.mjs '<tcstring>'
//
// No try/catch: a string that is not a TC string must crash here, not be
// silently reported as "no consent".
 
const B64 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
 
function bits(segment) {
  let out = '';
  for (const ch of segment) {
    const i = B64.indexOf(ch);
    if (i < 0) throw new Error(`not web-safe base64: ${JSON.stringify(ch)} in ${segment.slice(0, 20)}`);
    out += i.toString(2).padStart(6, '0');
  }
  return out;
}
const int = (b, s, n) => parseInt(b.slice(s, s + n), 2);
const chars = (b, s, n) => {
  let out = '';
  for (let i = 0; i < n / 6; i++) out += String.fromCharCode(65 + int(b, s + i * 6, 6));
  return out;
};
// Created / LastUpdated are deciseconds since epoch, but since Dec 2021 both
// carry the SAME day-level value: you cannot recover the time of day, and you
// cannot tell a first choice from a re-confirmation.
const day = (b, s) => new Date(int(b, s, 36) * 100).toISOString().slice(0, 10);
 
function vendorSection(b, start) {
  const maxVendorId = int(b, start, 16);
  const isRange = b[start + 16] === '1';
  const ids = new Set();
  let p = start + 17;
  if (!isRange) {
    for (let i = 0; i < maxVendorId; i++) if (b[p + i] === '1') ids.add(i + 1);
    p += maxVendorId;
  } else {
    const n = int(b, p, 12);
    p += 12;
    for (let i = 0; i < n; i++) {
      const isARange = b[p] === '1';
      p += 1;
      const startId = int(b, p, 16);
      p += 16;
      if (isARange) {
        const endId = int(b, p, 16);
        p += 16;
        for (let v = startId; v <= endId; v++) ids.add(v);
      } else ids.add(startId);
    }
  }
  return { maxVendorId, encoding: isRange ? 'range' : 'bitfield', ids, end: p };
}
 
export function decodeCore(tcString) {
  const segments = tcString.split('.');
  const b = bits(segments[0]);
  const core = {
    version: int(b, 0, 6),
    created: day(b, 6),
    lastUpdated: day(b, 42),
    cmpId: int(b, 78, 12),
    cmpVersion: int(b, 90, 12),
    consentScreen: int(b, 102, 6),
    consentLanguage: chars(b, 108, 12),
    vendorListVersion: int(b, 120, 12),
    tcfPolicyVersion: int(b, 132, 6),
    isServiceSpecific: b[138] === '1',
    useNonStandardTexts: b[139] === '1',
    specialFeatureOptIns: [...Array(12)].map((_, i) => b[140 + i] === '1'),
    purposesConsent: [...Array(24)].map((_, i) => b[152 + i] === '1'),
    purposesLITransparency: [...Array(24)].map((_, i) => b[176 + i] === '1'),
    purposeOneTreatment: b[200] === '1',
    publisherCC: chars(b, 201, 12),
  };
  const vc = vendorSection(b, 213);
  const vli = vendorSection(b, vc.end);
  const on = (a) => a.map((v, i) => (v ? i + 1 : 0)).filter(Boolean);
  return {
    ...core,
    specialFeatureOptIns: on(core.specialFeatureOptIns),
    purposesConsent: on(core.purposesConsent),
    purposesLITransparency: on(core.purposesLITransparency),
    vendorConsent: { ...vc, ids: [...vc.ids], end: undefined },
    vendorLegitimateInterest: { ...vli, ids: [...vli.ids], end: undefined },
    segments: segments.map((s, i) => ({
      index: i,
      // Segment 0 is the Core String. Every later segment declares its own type
      // in its first 3 bits. The current spec's SegmentType enum is 0 = Core,
      // 1 = DisclosedVendors, 3 = PublisherTC; 2 = AllowedVendors was dropped
      // with out-of-band consent in 2021 and survives only in archived strings.
      segmentType: i === 0 ? 'core' : int(bits(s), 0, 3),
      length: s.length,
    })),
  };
}
 
if (import.meta.url === `file://${process.argv[1]}`) {
  const s = process.argv[2];
  console.log(JSON.stringify(decodeCore(s), (k, v) => (v === undefined ? undefined : v), 1));
}

Vendor IDs mean nothing on their own. The GVL is republished weekly, Thursdays at 17:00 CET, and the string tells you which version it was written against, so a reproducible decode is:

current : https://vendor-list.consensu.org/v3/vendor-list.json
archive : https://vendor-list.consensu.org/v3/archives/vendor-list-v{vendorListVersion}.json

Fetched on 2026-08-26, the current list is version 173, tcfPolicyVersion 5, last updated 2026-08-20, with 1,203 vendors and a highest vendor ID of 1,634 — so about a quarter of the IDs below the maximum resolve to nothing in the current list, whether because the vendor left or because the ID was never issued. That gap is the reason to archive: resolve a 2023 string against today's list and the departed vendors vanish silently rather than erroring. The specification also requires GVL fetches to be server-side and cached to the max-age header, and warns that over-fetching gets you blocked; a crawler that pulls the GVL once per site is doing it wrong and is also generating a distinctive traffic signature.

For scale over time: the list held 751 companies at the end of May 2021 [7Toth, Michael; Bielova, Nataliia; Roca, Vincent (2022): "On dark patterns and manipulation of website publishers by CMPs", Proceedings on Privacy Enhancing Technologies 2022(3). (DOI)] and 684 registered companies in February 2021 [6Hils, Maximilian; Woods, Daniel W.; Böhme, Rainer (2021): "Privacy Preference Signals: Past, Present and Future", in: Proceedings on Privacy Enhancing Technologies. (DOI)], against 1,203 today.

CmpId joins to the Global CMP List at https://cmplist.consensu.org/v2/cmp-list.json. On 2026-08-26 it held 264 entries of which 189 are active and 75 carry a deletedDate, with a highest ID of 515. Three consequences: an ID you decode may not be in the current list (join against the whole file, including deleted entries, not just the active ones); the ID space is sparse, so a “not found” is at least as likely to be an invalid string as a new CMP; and the list flags isCommercial, which distinguishes a CMP vendor from a publisher running its own — a distinction that matters the moment you attribute a design choice to “the CMP”, as [7Toth, Michael; Bielova, Nataliia; Roca, Vincent (2022): "On dark patterns and manipulation of website publishers by CMPs", Proceedings on Privacy Enhancing Technologies 2022(3). (DOI)] does.

And the field is not authenticated. [2Matte, Célestin; Bielova, Nataliia; Santos, Cristiana Teixeira (2020): "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] found “the following incorrect CMP IDs in consent strings: 1, 0 and 4095” on 155, 45 and 3 websites respectively, at a time when valid IDs ran from 2 to 265, and found “CMP IDs in GET and POST requests different from the ones found using the standard APIs on 48 websites”.

The TCF only covers vendors registered on the GVL. Google runs a parallel list — Ad Tech Providers (ATPs) — for partners that are not, and a parallel string to carry consent for them. If you are measuring “how many parties did this site get consent for”, ignoring it undercounts by whatever the ATP list contributes, and in the CMP consoles [7Toth, Michael; Bielova, Nataliia; Roca, Vincent (2022): "On dark patterns and manipulation of website publishers by CMPs", Proceedings on Privacy Enhancing Technologies 2022(3). (DOI)] inspected the ATP list held “a total of 641 companies at the same date” in May 2021 against the GVL's 751 — “almost the same size” then. It has not kept pace: on 2026-08-26 the ATP list held 715 providers against the GVL's 1,203, both re-fetched from their publishers' own files. Neither number is a share of the signal, only of the lists: how many parties a given site actually discloses through each is unmeasured.

The format is trivial compared with the TC string — it is not bit-packed at all:

ACv2:  2 ~ <dot-separated consented ATP IDs> ~ dv. <dot-separated disclosed ATP IDs>

  2~1.10~dv.2.3.4   consented to 1 and 10; 2, 3 and 4 disclosed but not consented
  2~~dv.1.2.3.4.10  all five disclosed, none consented (or no decision yet)
  2~1.2.3.4.10~dv.  all five consented

A vendor in the consented list is not repeated in the disclosed list. ACv2 has been the standard since December 2023; v1 strings — a bare dot-list with no dv part — are still accepted but cannot express disclosure-without-consent, so a v1 string tells you strictly less.⁴⁾

Where to look for it:

Four rules from the specification that a measurement can test directly, and none of which anyone in this corpus has:

• Only a TCF-registered CMP may create an AC string, using its own CMP ID. Vendors must not.
• Google discards the AC string if the same request carries no TC string. An AC string without a TC string is inert.
• Google may rewrite it. If a vendor in the AC string is registered in the GVL version named in the accompanying TC string, the TC string wins and Google reserves the right to strip the duplicate entry. So the AC string a vendor receives is not necessarily the one the CMP wrote.
• All IDs must come from the published ATP CSV. An ID that is not in it is a defect you can detect for free.

The gap between the left column and the right is the whole subject. A compliance claim built on a decoded string is a claim about recording, which is narrow and mechanically checkable — which is exactly why [3Smith, Michael; Torres-Agüero, Antonio; Grossman, Riley; Sen, Pritam; Chen, Yi; Borcea, Cristian (2024): "A Study of GDPR Compliance under the Transparency and Consent Framework", in: Proceedings of the ACM Web Conference. (DOI)] reports violations on only “117 crawls to 48 distinct domains … 1.3% of all crawls and 2.2% of all domains” while a broader banner-compliance audit of the same framework finds a majority — [2Matte, Célestin; Bielova, Nataliia; Santos, Cristiana Teixeira (2020): "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] found “at least one suspected violation in 304 out of 560 websites (54%)” it hand-checked. Neither number is wrong. They answer different questions, and a paper that does not say which one it asked will be asked in review.

• Reading one array. Purposes and vendors are separate bitfields, and consent and legitimate interest are separate again — four arrays. The corriere.it case above has an empty purpose-consent array and 932 vendor-consent bits.
• Reading one channel. The API, the cookie, localStorage, GET parameters, POST bodies and response bodies can all disagree. If you only instrument the API you are measuring the CMP's claim, not the traffic.
• Treating a pre-interaction string as a violation. The CMP API requires a string to exist once the UI is shown, with LI signals true and consent signals false. The violation is a positive consent bit before a choice, which is the threshold [2Matte, Célestin; Bielova, Nataliia; Santos, Cristiana Teixeira (2020): "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] used.
• Comparing legitimate-interest rates across 1 March 2026. Before that date the vendor LI bit was also set for vendors declaring only special purposes.
• Comparing purpose counts across May 2023. Ten purposes became eleven, and purposes 3–6 lost legitimate interest as a legal basis.
• Trusting PurposeOneTreatment-adjacent zeros. A 0 in Purpose 1 consent can mean “the jurisdiction does not require it”, not “the user refused”.
• Resolving vendor IDs against today's GVL. Use the archive at the version in the string.
• Timing out too early, or not at all. Three of eight live sites defined __tcfapi and never called back inside twelve seconds. Record the timeout as a distinct outcome; do not fold it into “no TCF”.
• Using getTCData. It was deprecated in TCF v2.2 in May 2023 in favour of addEventListener, and the three commands a CMP must support are now ping, addEventListener and removeEventListener. It still works: on the four live sites above that answered anything, getTCData returned a TC string on all four — but on corriere.it it did so with the callback's success flag set to false, so a crawler that checks success before reading tcString loses the site. A CMP is also within spec to drop the command entirely, and the failure mode is a quietly growing “no TCF” bucket.
• Assuming the banner you see is the banner Europeans see. gdprApplies is the publisher's determination, and CMPs commonly derive it from geo-IP. See Crawling location.
• Forgetting mobile is a different measurement. No __tcfapi, no cookie: IABTCF_* keys in SharedPreferences. [5Koch, Simon; Altpeter, Benjamin; Johns, Martin (2023): "The OK Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications", in: Proceedings of the USENIX Security Symposium. (Link)] found “TCF-related settings in 146 (4.0%) apps” of 3,654 analysed — a much thinner population than the web.

The extraction schema has no “decoded a TC string” field, so the candidate population here is defined by full text: papers whose text contains at least one of Transparency and Consent Framework, __tcfapi, euconsent, TC String or IAB Europe. The bare acronym TCF is deliberately excluded from that union — it has other expansions in a security corpus. Two thresholds, because one mention in related work is not a measurement:

The concentration is extreme, and it is a fact about venues rather than about the field:

More than half of the papers that do anything with the TCF are at PETS — 11 of the 19 candidates and 5 of the audited 9, though only 30 of the 77 that merely mention it. If you are planning a TCF paper, that is where the reviewers who know the format are, and it is also where the related work you must not duplicate lives. Note also what is absent: CHI, SOUPS, EuroS&P, ACSAC and AsiaCCS are not in this corpus at all, and a good deal of consent research is published there.

By year, first appearance is 2019 — a year after the framework's first public version and one after the GDPR became applicable:

2025 is thin at the edges and 2026 is provisional — CCS 2026 and IMC 2026 have not been held, and IEEE S&P 2026 and TheWebConf 2026 are under-selected because selection screens on abstracts that are not yet in OpenAlex. Do not read the 2024→2026 shape as a decline. See the corpus page.

Population and banner action as the extraction recorded them. (no crawl) means the paper has no crawl configuration — an app study or a console review.

The ten background-only candidates are named, with the reason each was excluded, on the provenance page. Several are excellent consent papers — [11Bollinger, Dino; Kubicek, Karel; Cotrini, Carlos; Basin, David (2022): "Automating Cookie Consent and GDPR Violation Detection", in: 31st USENIX Security Symposium (USENIX Security 22), pp. 2893-2910. USENIX Association, Boston, MA. (Link)], [12Utz, Christine; Degeling, Martin; Fahl, Sascha; Schaub, Florian; Holz, Thorsten (2019): "(Un)informed Consent: Studying GDPR Consent Notices in the Field", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)], [13Rasaii, Ali; Dao, Ha; Feldmann, Anja; Javid, Mohammadmahdi; Gasser, Oliver; Gosain, Devashish (2025): "Intractable Cookie Crumbs: Unveiling the Nexus of Stateful Banner Interaction and Tracking Cookies", in: Proceedings on Privacy Enhancing Technologies, pp. 429-445. (DOI)], [14Demir, Nurullah; Urban, Tobias; Pohlmann, Norbert; Wressnegger, Christian (2024): "A Large-Scale Study of Cookie Banner Interaction Tools and their Impact on Users' Privacy", in: Proceedings on Privacy Enhancing Technologies, pp. 5-20. (DOI)], [15Aziz, Muhammad Abu Bakar; Wilson, Christo (2024): "Johnny Still Can't Opt-out: Assessing the IAB CCPA Compliance Framework", in: Proceedings on Privacy Enhancing Technologies. (DOI)], [16Tang, Brian; Bui, Duc; Shin, Kang G. (2025): "Navigating Cookie Consent Violations Across the Globe", in: Proceedings of the USENIX Security Symposium. (Link)], [17Zimmeck, Sebastian; Wang, Oliver; Alicki, Kuba; Wang, Jocelyn; Eng, Sophie (2023): "Usability and Enforceability of Global Privacy Control", Proceedings on Privacy Enhancing Technologies 2023(2). (DOI)], [18Utz, Christine; Amft, Sabrina; Degeling, Martin; Holz, Thorsten; Fahl, Sascha; Schaub, Florian (2023): "Privacy Rarely Considered: Exploring Considerations in the Adoption of Third-Party Services by Websites", Proceedings on Privacy Enhancing Technologies 2023(1):5-28. (DOI)], [19Kumar, Vinayshekhar Bannihatti; Iyengar, Roger; Nisal, Namita; Feng, Yuanyuan; Habib, Hana; Story, Peter; Cherivirala, Sushain; Hagan, Margaret; Cranor, Lorrie Faith; Wilson, Shomir; Schaub, Florian; Sadeh, Norman M. (2020): "Finding a Choice in a Haystack: Automatic Extraction of Opt-Out Statements from Privacy Policy Text", in: Proceedings of the ACM Web Conference. (DOI)], [9Tahaei, Mohammad; Ramokapane, Kopo M.; Li, Tianshi; Hong, Jason I.; Rashid, Awais (2022): "Charting App Developers' Journey Through Privacy Regulation Features in Ad Networks", in: Proceedings on Privacy Enhancing Technologies. (DOI)] — they simply do not read a TC string. If your related-work section cites them for a TCF result, check what they actually measured.

Three things to take from the table. The populations are small: of the seven that ran a crawl the stated populations are 200, 2,230, 4,482, 28,257, 97,090, 100,000 and 100,000 sites or apps — between two hundred and a hundred thousand, never millions, because TCF sites are a minority of a toplist and you have to find them before you can study them. The banner action is the treatment, and only 4 of those 7 ran both an accept and a reject arm, which for a TCF study is close to mandatory: a single-arm crawl cannot tell “the CMP recorded my refusal” from “the CMP recorded nothing”. And reporting is thin even here — 7 of 7 state a banner action, but only 5 of 7 say whether the crawl was stateful, 8 of 9 state a vantage location and 7 of 9 version their population list.

Every figure below was read back against the paper's own full text and the denominator checked there, because the extraction's metric field names the unit and not always the population.

• Populations are full-text populations, not extraction populations. TCF-MENTION and TCF-CANDIDATE come from a regex over paper.cols.txt with hyphenation joined and whitespace collapsed, not from any schema field. The regex and both counts are in scripts/tcf_fulltext_probe.mjs.
• The ≥5 threshold is not published as an answer, because it is wrong 79% of the time. A first draft of this page presented the 19 candidates as “the papers that work with the string”. A review pass challenged that, all 19 were read, and only 4 survive. Every figure in this section is now scoped to the audited tiers; TCF-MENTION (77) is used only where the question is “who mentions it”, never “who measures it”. The audit is scripts/tcf_core_audit.mjs and its evidence output is on the provenance page.
• The audit itself needed a correction, from the same source as the quote failures. [10Bouhoula, Ahmed; Kubicek, Karel; Zac, Amit; Cotrini, Carlos; Basin, David (2024): "Automated Large-Scale Analysis of Cookie Notice Compliance", in: Proceedings of the USENIX Security Symposium. (Link)] was first classified background only because paper.cols.txt splices a “future studies could…” sentence into the middle of the one that matters. In paper.norm.txt the sentence reads that the authors reconstruct prior work's website selection “using a combination of the Consent-O-Matic CMP detection module and IAB Europe's Transparency & Consent Framework's API”. It is detects only. Read a second rendering before excluding a paper.
• Probe width decided two of the claims on this page, and the first width was wrong both times. A narrow Additional-Consent regex returned 8 papers of which 7 were the English phrase; a wide one including ATP returned 26 of which 23 were other expansions of the acronym. The published number, 3, comes from reading every match in context by hand. Every rejected match is printed in scripts/tcf_ac_probe-output.txt.
• Free-text names were folded before counting, and the residue is printed. The resource fold over the 77 TCF-MENTION papers maps nine families (IAB decoder, GVL, CMP list, Cookiepedia, Cookie Glasses, Cookinspect, Consent-O-Matic, Disconnect, EasyList) and leaves 12 distinct unmapped consent-shaped names over 11 papers, listed in full on the provenance page. Free-text extraction fields agree run-to-run on about 20% of exact strings, so these are rankings, never percentages. The residue's shape is a finding in itself: almost every unmapped name is a single-paper bespoke artefact — “custom TCF compliance rules”, “custom CMP-presence probe”, “custom TCF API indicators” — so no shared TCF decoding pipeline exists in this corpus. The only named reusable things anyone reports are the IAB decoder itself (4 papers) and two one-off research tools, Cookinspect and Cookie Glasses, both from [2Matte, Célestin; Bielova, Nataliia; Santos, Cristiana Teixeira (2020): "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)].
• Every quote on this page was checked against the paper's own text, in three independent renderings of the PDF, by scripts/tcf_quotecheck.mjs: 36 of 36 located, over 10 papers. Seven initially failed and were replaced with shorter contiguous spans after inspection — column-splicing in the PDF rendering, not misquotation. The list grew from 30 to 36 during review, which is itself worth knowing: a quote checker only checks the quotes you put in it.
• One denominator in the extraction was wrong and is corrected here. The population.n recorded for [5Koch, Simon; Altpeter, Benjamin; Johns, Martin (2023): "The OK Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications", in: Proceedings of the USENIX Security Symposium. (Link)] is 3,006; the 4.0% figure's denominator is the 3,654 apps the paper says it analysed. Read the denominator in the paper, not in the schema.
• The eight-site live probe is not a measurement. It is one page load per site, from one residential Swiss IP, on one day, with no interaction. It illustrates mechanisms; it supports no prevalence claim, and it is labelled as such wherever it appears.
• External figures are re-fetchable. The GVL, CMP list, ATP list, npm release state and specification changelog are all fetched by scripts/tcf_external_checks.sh; the values on this page are that script's output on 2026-08-26 and will drift.
• What the corpus cannot tell you: how many sites use the TCF today (the newest web-side prevalence figure here is 2021), whether AC strings are common (nobody has looked), and whether the v2.3 disclosed-vendors requirement changed anything (the deadline was 1 March 2026, inside the provisional slice).
• Full query log, unedited script output, folds, residue and reviewer findings: Provenance of this page's figures. Corpus-wide caveats: the corpus page.

• Granting Consent to Websites — the decision this page starts after: what your crawler does with the banner, the other consent signals (GPC, US Privacy, GPP), and the TCF's legal history including the Belgian DPA case and CJEU C-604/22.
• Classifying Cookies — what the cookies set before and after the choice actually are.
• Classifying Web Requests — finding the banner and labelling its buttons, and reading the requests the string travels in.
• Stateful and stateless crawling — why a consent string persisting between page loads changes what you measure.
• Crawling location — gdprApplies and PublisherCC are both downstream of where you crawl from.
• Legal enforcement — what to do with a recording violation once you have found one.
• Provenance of this page's figures — every query, the scripts and their unedited output, the folds and their residue, and what was rejected.

[1]

Kancherla, Gayatri Priyadarsini; Bielova, Nataliia; Santos, Cristiana; Bichhawat, Abhishek (2025): "Johnny Can't Revoke Consent Either: Measuring Compliance of Consent Revocation on the Web", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[2]

Matte, Célestin; Bielova, Nataliia; Santos, Cristiana Teixeira (2020): "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[3]

Smith, Michael; Torres-Agüero, Antonio; Grossman, Riley; Sen, Pritam; Chen, Yi; Borcea, Cristian (2024): "A Study of GDPR Compliance under the Transparency and Consent Framework", in: Proceedings of the ACM Web Conference. (DOI)

[4]

Morel, Victor; Santos, Cristiana; Carlsson, Pontus; Ahlinder, Joel; Duvignau, Romaric (2026): "The TCF doesn't really A(A)ID - Automatic Privacy Analysis and Legal Compliance of TCF-based Android Applications", Proceedings on Privacy Enhancing Technologies 2026(3). (DOI)

[5]

Koch, Simon; Altpeter, Benjamin; Johns, Martin (2023): "The OK Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications", in: Proceedings of the USENIX Security Symposium. (Link)

[6]

Hils, Maximilian; Woods, Daniel W.; Böhme, Rainer (2021): "Privacy Preference Signals: Past, Present and Future", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[7]

Toth, Michael; Bielova, Nataliia; Roca, Vincent (2022): "On dark patterns and manipulation of website publishers by CMPs", Proceedings on Privacy Enhancing Technologies 2022(3). (DOI)

[8]

Liu, Zengrui; Iqbal, Umar; Saxena, Nitesh (2024): "Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy?", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[9]

Tahaei, Mohammad; Ramokapane, Kopo M.; Li, Tianshi; Hong, Jason I.; Rashid, Awais (2022): "Charting App Developers' Journey Through Privacy Regulation Features in Ad Networks", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[10]

Bouhoula, Ahmed; Kubicek, Karel; Zac, Amit; Cotrini, Carlos; Basin, David (2024): "Automated Large-Scale Analysis of Cookie Notice Compliance", in: Proceedings of the USENIX Security Symposium. (Link)

[11]

Bollinger, Dino; Kubicek, Karel; Cotrini, Carlos; Basin, David (2022): "Automating Cookie Consent and GDPR Violation Detection", in: 31st USENIX Security Symposium (USENIX Security 22), pp. 2893-2910. USENIX Association, Boston, MA. (Link)

[12]

Utz, Christine; Degeling, Martin; Fahl, Sascha; Schaub, Florian; Holz, Thorsten (2019): "(Un)informed Consent: Studying GDPR Consent Notices in the Field", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[13]

Rasaii, Ali; Dao, Ha; Feldmann, Anja; Javid, Mohammadmahdi; Gasser, Oliver; Gosain, Devashish (2025): "Intractable Cookie Crumbs: Unveiling the Nexus of Stateful Banner Interaction and Tracking Cookies", in: Proceedings on Privacy Enhancing Technologies, pp. 429-445. (DOI)

[14]

Demir, Nurullah; Urban, Tobias; Pohlmann, Norbert; Wressnegger, Christian (2024): "A Large-Scale Study of Cookie Banner Interaction Tools and their Impact on Users' Privacy", in: Proceedings on Privacy Enhancing Technologies, pp. 5-20. (DOI)

[15]

Aziz, Muhammad Abu Bakar; Wilson, Christo (2024): "Johnny Still Can't Opt-out: Assessing the IAB CCPA Compliance Framework", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[16]

Tang, Brian; Bui, Duc; Shin, Kang G. (2025): "Navigating Cookie Consent Violations Across the Globe", in: Proceedings of the USENIX Security Symposium. (Link)

[17]

Zimmeck, Sebastian; Wang, Oliver; Alicki, Kuba; Wang, Jocelyn; Eng, Sophie (2023): "Usability and Enforceability of Global Privacy Control", Proceedings on Privacy Enhancing Technologies 2023(2). (DOI)

[18]

Utz, Christine; Amft, Sabrina; Degeling, Martin; Holz, Thorsten; Fahl, Sascha; Schaub, Florian (2023): "Privacy Rarely Considered: Exploring Considerations in the Adoption of Third-Party Services by Websites", Proceedings on Privacy Enhancing Technologies 2023(1):5-28. (DOI)

[19]

Kumar, Vinayshekhar Bannihatti; Iyengar, Roger; Nisal, Namita; Feng, Yuanyuan; Habib, Hana; Story, Peter; Cherivirala, Sushain; Hagan, Margaret; Cranor, Lorrie Faith; Wilson, Shomir; Schaub, Florian; Sadeh, Norman M. (2020): "Finding a Choice in a Haystack: Automatic Extraction of Opt-Out Statements from Privacy Policy Text", in: Proceedings of the ACM Web Conference. (DOI)