Working notes behind Decoding TCF Consent Strings — every query with its population and denominator, the scripts and their unedited output, the folds and their residue, the quotes checked against the source papers, the external sources and how each was verified, what was rejected, and what could not be established. Corpus-level caveats that apply to every page on this site are on corpus and are not restated here.

Create, extend or overlap? — Create, with one deliberate boundary. consent already carries a section Reading What the Site Stored: the TCF, about 70 lines, which introduces the framework, gives a __tcfapi probe, and covers the legal history (Belgian DPA, CJEU C-604/22, the Market Court ruling of 14 May 2025). That page's subject is the banner decision and it needs enough TCF to make that decision legible. This page's subject is the artefact: the bit layout, the seven channels, decoder and GVL reproducibility, Google Additional Consent, and the inference boundary between “the string says X” and “the site did X”.

The alternative — broadening privacy:consent instead — was rejected for two reasons. It is already 64,927 bytes and the TCF section would have to roughly triple to hold the segment table, the version-boundary table, the channel table and the AC specification. And the reader is different: privacy:consent is read by someone deciding what their crawler clicks, this one by someone who has already decided and now has to decode 40,000 strings without producing a number they cannot defend. Neither page repeats the other; each links to the other for what it does not carry. Someone could reasonably have decided the opposite.

Two corrections owed to privacy:consent, both found while writing this page and both applied there in the same sitting, and both recorded in the review log in §12.1:

1. Its TCF section describes the shared consensu.org cookie in the present tense — “The TCF permits a CMP to store the string in a cookie on a shared domain”. Global scope and that cookie were deprecated on 22 June 2021 and strings using them have been invalid since 1 September 2021.
2. Its published tcf_probe.js sample calls __tcfapi('getTCData', 2, …). That command was deprecated in the CMP API spec in TCF v2.2 (May 2023) in favour of addEventListener. It still works on most CMPs, so the sample is not broken, but it should say so.

There is no schema field for “worked with a TC string”, and there never will be — detection.phenomenon and classification.resourceName are free text and name what the paper headlines. So the population on this page is a full-text population, and it is labelled as such everywhere it is used.

The union, verbatim from tcf_report.mjs:

const TCF_CORE =
  /Transparency\s+(?:and|&)\s+Consent\s+Framework|__\s?tcfapi|euconsent|TC[\s-]?String|IAB\s+Europe/gi;

Text is read with hyphenation joined (s/-\n//) and whitespace collapsed before matching, because a PDF line break inside “con-\nsent string” otherwise hides the match.

The bare acronym TCF is deliberately excluded from the union. Included, it adds 24 papers, and in a security corpus the acronym has other expansions. Its per-pattern count is reported separately by tcf_fulltext_probe.mjs so the exclusion is visible rather than silent.

The ≥5 threshold was published as an answer in the first draft, and it was wrong. The draft asserted that “at and above 5 every one of the 19 either measures the TCF or measures something with the TCF”, chosen by eyeballing the ranked occurrence list. Nobody had validated it. The citations-and-quotes review pass challenged it directly, having read the papers, so all 19 were audited.

Every one of the 19 was read against its own full text, using scripts/tcf_core_audit.mjs –evidence (every core-TCF match with 90 characters of context, deduplicated, plus the extraction's own summary) and, where that was ambiguous, the paper's methodology section. Three tiers, distinguished by whether a figure in the paper depends on a TC string:

Threshold precision: 4/19 = 21.1% for “works with a TC string”, 9/19 = 47.4% for “does anything with the TCF at all”. The page publishes both numbers and scopes every downstream figure to the audited tiers.

... Future studies could use a more fine- the selection of websites used in these studies using a combi-
grained definition for this dark pattern and investigate the nation of the Consent-O-Matic [28] CMP detection module
intentions more thoroughly. and IAB Europe's Transparency & Consent Framework's API [15].

What the audit does not establish. It is one reader, on one pass, with no second coder and no agreement statistic — the same limitation as the consentAction audit on consent. The evidence each verdict rests on is committed in scripts/tcf_core_audit-evidence.txt so a disagreement can be adjudicated against the same text. The BACKGROUND-ONLY tier is the one most likely to contain an error, because it is the tier where a single methodology sentence buried in a column splice flips the verdict — which is precisely what happened once already.

The 77-paper TCF-MENTION set was not audited. 77 papers is beyond a hand pass in this run, and the page therefore uses it only where the question is “who mentions it”, never “who measures it”.

From tcf_fulltext_probe.mjs, denominator 5,869 papers with full text:

A DokuWiki table cell cannot contain a pipe — \| is not an escape — so every pattern below is named here and printed in full in the code block that follows.

// scripts/tcf_fulltext_probe.mjs, verbatim
const PATTERNS = {
  'framework, spelled out':      /Transparency\s+(?:and|&)\s+Consent\s+Framework/i,
  'TCF (bare acronym)':          /\bTCF\b/,
  'consent string / TC string':  /\b(?:TC[\s-]?String|consent\s+string)/i,
  '__tcfapi':                    /__\s?tcfapi/i,
  '__cmp (v1 API)':              /__\s?cmp\s?\(/i,
  'euconsent cookie':            /euconsent/i,
  'Global Vendor List / GVL':    /Global\s+Vendor\s+List|\bGVL\b/i,
  'Additional Consent (Google)': /Additional\s+Consent|addtl[_\s-]?consent|\bAC\s+string\b/i,
  'Ad Technology Providers / ATP': /Ad\s+Technology\s+Provider|\bATP\s+list\b/i,
  'gdpr_consent macro':          /gdpr[_\s-]?consent/i,
  'IAB Europe':                  /IAB\s+Europe/i,
  'CMP (consent management)':    /Consent\s+Management\s+(?:Platform|Provider)|\bCMPs?\b/,
  'US Privacy / GPP string':     /usprivacy|US\s+Privacy\s+String|Global\s+Privacy\s+Platform|\bGPP\s+string\b/i,
};

Two of these are the page's own worked example of why probe width decides a claim. gdpr_consent looks like a URL-parameter probe and is actually an English-phrase probe. __tcfapi appears in two papers' text, which would be an absurd basis for any claim about API-based detection — the API is used far more often than it is named.

All of these are printed by scripts/tcf_report.mjs. Counts are of papers, never tuples.

Per-year counts (used in the year table on the page) are the TCF-MENTION BY YEAR block of the report output. 2026 is provisional and 2025 is thin at the edges — CCS 2026 and IMC 2026 have not been held; IEEE S&P 2026 and TheWebConf 2026 are under-selected because selection screens on abstracts not yet in OpenAlex. The page labels this in the table itself and says not to read 2024→2026 as a decline.

The single 2012 TCF-MENTION is a match on the string “IAB Europe” in an unrelated context; it is footnoted on the page rather than silently dropped, and it is the reason the year table starts its series at 2019 in prose.

Resource names are free text and agree run-to-run on about 20% of exact strings, so they are folded before counting and reported as a ranking, never as a percentage. The fold is an explicit alias list in tcf_report.mjs (constant DECODER_ALIASES), applied to tools[].name and classification[].resourceName filtered to usedOrMentioned ∈ {used, produced}, over the 77 TCF-MENTION papers:

Unmapped residue — every consent-or-TCF-shaped name the fold did not claim, 12 distinct names over 11 papers (ConsentChk contributes two of the twelve from a single paper):

IAB Europe Transparency and Consent Framework
custom TCF compliance rules
__cmp() presence
custom TCF API indicators
custom consent-dialog design checks
custom CMP-presence probe
ConsentChk
ConsentChk rule-based violation classifier
custom cookie-consent taxonomy
GDPR-Consent
IAB Europe's CMP Compliance Programme
OneTrust CMP

The residue is almost entirely bespoke, single-paper artefacts — “custom TCF compliance rules”, “custom CMP-presence probe”, “custom TCF API indicators”. That shape is a finding, and the page now states it: no shared TCF decoding pipeline exists in this corpus. Only ConsentChk is a named reusable tool (two of the twelve strings, both from [19Tang, Brian; Bui, Duc; Shin, Kang G. (2025): "Navigating Cookie Consent Violations Across the Globe", in: Proceedings of the USENIX Security Symposium. (Link)]), and only OneTrust CMP would have merged into an existing family had the alias list included CMP vendor names; it was left out because a CMP vendor is not a decoding resource.

The page's claim “3 papers mention Google's Additional Consent mechanism, 0 decode a string” went through three widths. This is recorded in full because the first two answers were confidently wrong.

A: /Additional Consent|addtl[_ -]?consent|\bAC string\b/i
B: /Ad Technology Provider|\bATP list\b/i
C: /addtl[_\s-]?consent|\bAC ?string\b|Additional\s+Consent|Ad\s+Tech(?:nology)?\s+Provider|\bATPs?\b|consented_providers|ADDTL_CONSENT|IABTCF_AddtlConsent/i

Attempt 1 missed [7Toth, Michael; Bielova, Nataliia; Roca, Vincent (2022): "On dark patterns and manipulation of website publishers by CMPs", Proceedings on Privacy Enhancing Technologies 2022(3). (DOI)], which writes “Ad Tech Providers” and not “Ad Technology Providers”, and missed [18Tahaei, Mohammad; Ramokapane, Kopo M.; Li, Tianshi; Hong, Jason I.; Rashid, Awais (2022): "Charting App Developers' Journey Through Privacy Regulation Features in Ad Networks", in: Proceedings on Privacy Enhancing Technologies. (DOI)], which writes “Ad technology providers” as a console page name. Attempt 2 missed the addtl_consent cookie. Attempt 3 catches all three and 23 false positives, every one of which is printed by the script.

The 23 false positives are worth listing because they are why \bATP\b can never be used unadjudicated: Advanced Threat Protection (Microsoft Defender, FortiNet, Symantec, Office 365 — 8 papers), “ATP: In-network Aggregation for Multi-tenant Learning” in reference lists (2), “Absolute True Positives” as a ranking metric (1), N(ATP) as a bug-injection count (1), OBD-II AT commands (1), “attribute providers (ATPs)” in a brokered-identity paper (1), a D-Link binary called atp (1), an atp = 0.0005 statistic (1), and 7 papers using the ordinary English phrase additional consent about an IRB form or a second permission dialog.

The three true positives, hand-adjudicated on 2026-08-26 by reading each match in context:

None of the three decodes an AC string, resolves an ATP ID, or tests any rule from the specification. That is the basis for the open-question box on the page. The claim is bounded to these seven venues and says so.

scripts/tcf_quotecheck.mjs checks each quote against three renderings of the same PDF — paper.cols.txt (column order repaired; the one quoted from), paper.norm.txt and paper.txt — because they fail on different sentences. A quote found in any of them is located. Final result: 36 quotes checked, 0 not located, over 10 papers: 9 from [1Matte, Célestin; Bielova, Nataliia; Santos, Cristiana Teixeira (2020): "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)], 5 each from [2Smith, Michael; Torres-Agüero, Antonio; Grossman, Riley; Sen, Pritam; Chen, Yi; Borcea, Cristian (2024): "A Study of GDPR Compliance under the Transparency and Consent Framework", in: Proceedings of the ACM Web Conference. (DOI)], [3Kancherla, Gayatri Priyadarsini; Bielova, Nataliia; Santos, Cristiana; Bichhawat, Abhishek (2025): "Johnny Can't Revoke Consent Either: Measuring Compliance of Consent Revocation on the Web", in: Proceedings on Privacy Enhancing Technologies. (DOI)] and [4Morel, Victor; Santos, Cristiana; Carlsson, Pontus; Ahlinder, Joel; Duvignau, Romaric (2026): "The TCF doesn't really A(A)ID - Automatic Privacy Analysis and Legal Compliance of TCF-based Android Applications", Proceedings on Privacy Enhancing Technologies 2026(3). (DOI)], 3 each from [5Hils, Maximilian; Woods, Daniel W.; Böhme, Rainer (2021): "Privacy Preference Signals: Past, Present and Future", in: Proceedings on Privacy Enhancing Technologies. (DOI)] and [7Toth, Michael; Bielova, Nataliia; Roca, Vincent (2022): "On dark patterns and manipulation of website publishers by CMPs", Proceedings on Privacy Enhancing Technologies 2022(3). (DOI)], 2 each from [6Koch, Simon; Altpeter, Benjamin; Johns, Martin (2023): "The OK Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications", in: Proceedings of the USENIX Security Symposium. (Link)] and [9Bouhoula, Ahmed; Kubicek, Karel; Zac, Amit; Cotrini, Carlos; Basin, David (2024): "Automated Large-Scale Analysis of Cookie Notice Compliance", in: Proceedings of the USENIX Security Symposium. (Link)], 1 each from [8Liu, Zengrui; Iqbal, Umar; Saxena, Nitesh (2024): "Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy?", in: Proceedings on Privacy Enhancing Technologies. (DOI)] and [18Tahaei, Mohammad; Ramokapane, Kopo M.; Li, Tianshi; Hong, Jason I.; Rashid, Awais (2022): "Charting App Developers' Journey Through Privacy Regulation Features in Ad Networks", in: Proceedings on Privacy Enhancing Technologies. (DOI)].

The list grew from 30 to 36 during review, and that is the point of recording it. The generic review pass observed that a quote checker reporting “0 not located” says nothing about the quotes you never put in it. Six were added: 1 for [18Tahaei, Mohammad; Ramokapane, Kopo M.; Li, Tianshi; Hong, Jason I.; Rashid, Awais (2022): "Charting App Developers' Journey Through Privacy Regulation Features in Ad Networks", in: Proceedings on Privacy Enhancing Technologies. (DOI)] and 2 for [9Bouhoula, Ahmed; Kubicek, Karel; Zac, Amit; Cotrini, Carlos; Basin, David (2024): "Automated Large-Scale Analysis of Cookie Notice Compliance", in: Proceedings of the USENIX Security Symposium. (Link)], whose quotes appeared in these notes but not in the script; 2 from [4Morel, Victor; Santos, Cristiana; Carlsson, Pontus; Ahlinder, Joel; Duvignau, Romaric (2026): "The TCF doesn't really A(A)ID - Automatic Privacy Analysis and Legal Compliance of TCF-based Android Applications", Proceedings on Privacy Enhancing Technologies 2026(3). (DOI)]'s traffic table after a denominator was corrected; and 1 from [1Matte, Célestin; Bielova, Nataliia; Santos, Cristiana Teixeira (2020): "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] when a comparison figure was added to the page.

Seven quotes failed the first pass and were replaced, not dropped. All seven were column-splice artefacts, i.e. the sentence exists in the paper but the rendering interleaves a neighbouring column into the middle of it. In each case the published quote was shortened to a contiguous span that verifies:

The first four of those were the extraction's own evidence.quote values. They are evidence about the source, not fabrications — but they are not quotable verbatim, and copying an evidence.quote onto a page without this check is how an unverifiable quote gets published.

For [6Koch, Simon; Altpeter, Benjamin; Johns, Martin (2023): "The OK Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications", in: Proceedings of the USENIX Security Symposium. (Link)] the extraction records population.n = 3006. The paper's own text says “We were able to analyze 3654 apps”, and 146/3,654 = 4.0%, which matches the paper's own percentage; 146/3,006 would be 4.9%. The page publishes 3,654. This is the standard failure mode warned about in the dataset overview: detection.metric names the unit, not always the population. Every denominator in the What they measured table was re-read in paper.cols.txt for this reason.

Three figures on the page come from a table in the source, where there is no sentence to quote and the quote-checker cannot help:

The page publishes tcf/tcstring.mjs, a from-scratch Core-String decoder. Publishing a hand-rolled decoder needs justification and validation; both are here.

Why not just tell people to use @iabtcf/core? The page does tell them that, first. The hand-rolled version exists because the reader needs to see which fields exist and what each one does or does not mean, and because a decoder that touches only the Core String cannot silently disagree with a newer specification about a field it never reads.

Validation, and a correction made during review. The first cross-check was run against @iabtcf/core 1.5.6 and all six strings agreed. The external-currency reviewer then established that @iabtcf is the project's abandoned npm scope and the maintained package is @iabtechlabtcf/core 1.5.21 (2026-02-10) — same GitHub repository, no deprecation marker on the old scope. The cross-check was re-run against 1.5.21, and all six strings agree there too, on all eighteen compared fields: version, created, lastUpdated, cmpId, cmpVersion, consentScreen, consentLanguage, vendorListVersion, policyVersion, isServiceSpecific, useNonStandardTexts, purposeOneTreatment, publisherCC, specialFeatureOptIns[], purposesConsent[], purposesLITransparency[], vendorConsent[], vendorLegitimateInterest[]. corriere.it exercises the 1,634-bit bitfield path and spiegel.de the range-encoding path.

The two library versions themselves disagree, and that is now a claim on the page. On all six strings the only differing field is useNonStandardTexts: 1.5.21 returns a boolean; 1.5.6 returns undefined for that property and exposes the value under the older specification field name useNonStandardStacks. Verified by decoding the same string with both packages side by side and diffing the projected field sets. This is why the page tells readers to name the package as well as the version: the older build does not error on a renamed field, it returns undefined, which is falsy.

What it does not do, stated because the page publishes it: it does not read publisher restrictions, does not decode the DisclosedVendors or PublisherTC segment bodies (it reports their presence and type only), and does not validate. Anyone needing those should use the library.

Every external figure on the page is re-fetchable by scripts/tcf_external_checks.sh. Values below are that script's output on 2026-08-26; the GVL is republished weekly and the ATP list without notice, so they will drift.

The npm finding was wrong twice before it was right, and the page nearly shipped the second version.

1. First read: “the reference decoder has been unmaintained since 2023”. Wrong and unfair — the GitHub repository is active, with a v1.5.21 tag in February 2026. Caught in self-review.
2. Second read, which was drafted onto the page: “no release after 1.5.6 has been published to npm, so the maintained code never ships”. Also wrong, and wrong in a way that is invisible unless you guess the right package name: the project renamed its npm scope to @iabtechlabtcf and publishes there. Caught by the external-currency review pass, which queried the scope directly rather than trusting the query the author had run.
3. Published version: both scopes exist, both resolve, neither is marked deprecated, and they decode differently. That is a strictly more useful warning than either draft, and it is the reason the review pass earned its slot.

This is recorded at length because the error class — verifying a claim against the artefact you already had in mind, rather than searching for the artefact that would refute it — is the one this whole review layer exists to catch.

Sources considered and rejected.

One entry added to bibliography, appended before the closing </bibtex> tag:

@inproceedings{tahaei2022_charting,
  author        = {Tahaei, Mohammad and Ramokapane, Kopo M. and Li, Tianshi and Hong, Jason I. and Rashid, Awais},
  title         = {Charting App Developers' Journey Through Privacy Regulation Features in Ad Networks},
  booktitle     = {Proceedings on Privacy Enhancing Technologies},
  year          = {2022},
  series        = {PoPETs 2022},
  doi           = {10.56553/popets-2022-0061},
}

Generated by scripts/bibgen.mjs –key tahaei2022_charting. PoPETs records in the index carry no authors — this is true of 100% of PETS and USENIX records — so the DOI was derived from the landing URL by the script and the author list was fetched from petsymposium.org/popets/2022/popets-2022-0061.php with curl and a browser User-Agent. Checked for a duplicate key and a duplicate DOI before appending; neither was present. The other 18 keys the page cites already existed.

A pre-existing problem found while checking, and deliberately not fixed here. A scan for duplicate titles (not just duplicate keys) across the 481 entries finds four papers present twice under different keys:

lerner2016internet     / lerner2016_internet
bouhoula2024automated  / bouhoula2024_automated
fouad2022my            / fouad2022_cookie
bottger2025_regional   / boettger2025_regional

A duplicate-key check passes on all four, which is why they survived. They are not this page's doing and merging them would break whichever existing pages cite the losing key, so they are recorded here for whoever owns the bibliography rather than changed. This page cites bouhoula2024_automated (the underscore form, which the majority of entries use).

Run on 2026-08-26 from a residential Swiss IP (AS9044, Aarau, CH — checked via ipinfo.io), Playwright Chromium 151.0.7922.34 headless, locale en-GB, one domcontentloaded navigation per site, twelve-second wait, no banner interaction, one page load each. Eight sites, chosen as European news publishers likely to run a TCF CMP. This is not a sample of anything and the page says so twice.

Unedited output is below. Four of eight returned a TC string. The probe was accidentally re-run ~40 minutes later while the page was being edited; the second run's output is byte-identical to the first, which is expected — Created/LastUpdated are day-level and the printed strings are truncated — but it does mean nothing on this page rests on a single load that happened to go a particular way.

tcf_live_probe-output.txt

### https://www.spiegel.de/   [ok]
  __tcfapi: function   __tcfapiLocator iframe: true
  events seen: cmpuishown
  consent-shaped cookie names   : (none)
  consent-shaped localStorage   : _sp_user_consent_31256
  consent URL params on requests: (none)
  gdprApplies=true  cmpId=6  cmpVersion=1  tcfPolicyVersion=5
  addtlConsent: "2~~dv."
  tcString(350 chars): CQpjb0AQpjb0AAGABCENCtFgAAAAAALAAAQ4AAAMsgBgDu...
    segments        : 0:core 1:1 2:3
    created/updated : 2026-08-26 / 2026-08-26
    GVL version     : 173   policy 5   publisherCC CH
    purposes CONSENT: []
    purposes LI     : [7,9,10]
    vendors consent : 0 (bitfield, maxVendorId 0)
    vendors LI      : 3 (range)
    purposeOneTreatment: false   useNonStandardTexts: false
 
### https://www.lemonde.fr/   [ok]
  __tcfapi: function   __tcfapiLocator iframe: true
  events seen: (none)
  consent-shaped cookie names   : (none)
  consent-shaped localStorage   : (none)
  consent URL params on requests: (none)
 
### https://www.corriere.it/   [ok]
  __tcfapi: function   __tcfapiLocator iframe: true
  events seen: cmpuishown -> cmpuishown -> cmpuishown -> cmpuishown -> cmpuishown -> cmpuishown -> cmpuishown -> cmpuishown
  consent-shaped cookie names   : (none)
  consent-shaped localStorage   : permutive-consent
  consent URL params on requests: (none)
  gdprApplies=true  cmpId=218  cmpVersion=0  tcfPolicyVersion=5
  addtlConsent: "2~"
  tcString(334 chars): CQpjb0AQpjb0ADaAAAENCtFgAAAAAAAAAAAAMxNR_G__bW...
    segments        : 0:core 1:1 2:3
    created/updated : 2026-08-26 / 2026-08-26
    GVL version     : 173   policy 5   publisherCC AA
    purposes CONSENT: []
    purposes LI     : []
    vendors consent : 932 (bitfield, maxVendorId 1634)
    vendors LI      : 0 (bitfield)
    purposeOneTreatment: false   useNonStandardTexts: false
 
### https://www.elmundo.es/   [ok]
  __tcfapi: function   __tcfapiLocator iframe: true
  events seen: (none)
  consent-shaped cookie names   : user_consent_policy, user_consent_gam, ue_consentState
  consent-shaped localStorage   : ue-permutive-consent-status
  consent URL params on requests: (none)
 
### https://www.bild.de/   [ok]
  __tcfapi: function   __tcfapiLocator iframe: true
  events seen: cmpuishown
  consent-shaped cookie names   : (none)
  consent-shaped localStorage   : _sp_user_consent_6804
  consent URL params on requests: (none)
  gdprApplies=true  cmpId=345  cmpVersion=1  tcfPolicyVersion=5
  addtlConsent: "2~~dv."
  tcString(334 chars): CQpjb0AQpjb0AFZABCENCtFgAAAAAAAAAAQ4AAAAAAAA.I...
    segments        : 0:core 1:1 2:3
    created/updated : 2026-08-26 / 2026-08-26
    GVL version     : 173   policy 5   publisherCC CH
    purposes CONSENT: []
    purposes LI     : []
    vendors consent : 0 (bitfield, maxVendorId 0)
    vendors LI      : 0 (bitfield)
    purposeOneTreatment: false   useNonStandardTexts: false
 
### https://www.focus.de/   [ok]
  __tcfapi: function   __tcfapiLocator iframe: true
  events seen: cmpuishown
  consent-shaped cookie names   : (none)
  consent-shaped localStorage   : _sp_user_consent_278
  consent URL params on requests: (none)
  gdprApplies=true  cmpId=35  cmpVersion=1  tcfPolicyVersion=5
  addtlConsent: "2~~dv."
  tcString(306 chars): CQpjb0AQpjb0AAjABCENCtFgAAAAAAAAAAQ4AAAAAAAA.I...
    segments        : 0:core 1:1 2:3
    created/updated : 2026-08-26 / 2026-08-26
    GVL version     : 173   policy 5   publisherCC CH
    purposes CONSENT: []
    purposes LI     : []
    vendors consent : 0 (bitfield, maxVendorId 0)
    vendors LI      : 0 (bitfield)
    purposeOneTreatment: false   useNonStandardTexts: false
 
### https://www.marca.com/   [ok]
  __tcfapi: function   __tcfapiLocator iframe: true
  events seen: (none)
  consent-shaped cookie names   : user_consent_policy, user_consent_gam, ue_consentState
  consent-shaped localStorage   : ue-permutive-consent-status
  consent URL params on requests: (none)
 
### https://www.telegraph.co.uk/   [ok]
  __tcfapi: undefined   __tcfapiLocator iframe: false
  events seen: (none)
  consent-shaped cookie names   : (none)
  consent-shaped localStorage   : (none)
  consent URL params on requests: (none)

What was resolved against a primary source, not asserted:

• CMP IDs 6, 218, 345 and 35 were joined to the live Global CMP List: Sourcepoint Technologies (commercial), RCS MediaGroup (commercial), Axel Springer Deutschland (isCommercial: false), BurdaForward (isCommercial: false). The claim “the CMP ID belongs to the publisher on two of the four” rests on that flag plus the company names.
• All 932 corriere.it vendor-consent IDs were resolved against GVL 173 — all 932 are present, so this is not a decoder artefact or a garbage bitfield.
• spiegel.de's three LI vendors resolve to StackAdapt, Adobe Advertising Cloud and Nielsen International.
• addtlConsent values: 2~~dv. on three sites (a well-formed empty ACv2 string) and 2~ on corriere.it, which is not a well-formed ACv2 string — the grammar is 2~<consented>~dv.<disclosed> and this has only two parts. That observation is on the page as an illustration of the grammar, not as a compliance finding about one site.

What this probe deliberately does not claim. No prevalence. No compliance verdict about any named site. The corriere.it observation is presented as which array you read decides what you see, not as this site violates the GDPR — one page load from one country on one day cannot support the second. The PublisherCC-tracks-the-crawler observation is called an anecdote on the page and put in the open-questions box.

Ethics. Eight public homepage loads, read-only, no interaction, no authentication, no repeat visits, well under any plausible rate concern. See Ethics.

• Current web-side TCF prevalence. The newest figure in the corpus is [5Hils, Maximilian; Woods, Daniel W.; Böhme, Rainer (2021): "Privacy Preference Signals: Past, Present and Future", in: Proceedings on Privacy Enhancing Technologies. (DOI)], February 2021. Nothing on the page claims a 2026 web prevalence, and the gap is in the open-questions box. Closing it needs a toplist crawl, not a query.
• Whether AC strings are common. Three of four live sites returned an empty-but-well-formed one, which is suggestive of wide CMP support and of nothing else. Not published as a figure.
• How PublisherCC is actually set. Three of four strings reported the crawler's country. The specification permits both readings — establishment or legislative country of reference — so the observation does not by itself show a defect, and the page was rewritten to say so after the first draft asserted it did. A second vantage point would settle the empirical question in an hour; it was not run, because that is a measurement and this page is a systematisation. Flagged as an open question.
• Whether the 1 March 2026 disclosed-vendors requirement changed behaviour. The deadline falls inside the provisional 2026 slice; no paper in the corpus is on the far side of it.
• How many of the 77 TCF-MENTION papers actually touch a string. The 19 candidates over the ≥5 threshold were audited (§2.1) and 4 work with a string. The other 58 were not read. Given that the threshold's precision is 21%, its recall is the open question: a paper could decode strings in a two-sentence methods paragraph and clear only three or four mentions. A hand pass over all 77 would settle it and would probably move the count of 4 upward, not downward. The page's “four papers” claim is therefore a claim about the audited candidate set and is worded as one.
• Anything about CHI, SOUPS, EuroS&P, ACSAC, RAID or AsiaCCS. Not in this corpus. Consent and CMP research is published at all of them, and the page says its claims are claims about seven venues.

1. New page rather than broadening consent. Reasoning and the rejected alternative in §1.
2. Full-text populations rather than an extraction field. There is no extraction field for this subject. The alternative was to build an S2-style vocabulary sweep over free-text fields, as consent does. Rejected because the TCF vocabulary is small, distinctive and reliably spelled out in the paper's own prose, so a full-text regex has better recall than a sweep over extracted names — and because the extraction names what a paper headlines, and most TCF work headlines “GDPR compliance”, not “TC string”.
3. Keeping the ≥5 threshold as a candidate set rather than dropping it. After the audit found 21% precision, the alternative was to delete the threshold entirely and publish only the audited nine. It was kept, with both precision figures printed, because the threshold is what makes the audit reproducible: a reader who disagrees with a verdict can re-derive the same 19 candidates and argue about the classification rather than about the search. Publishing the audited nine with no account of what they were selected from would have hidden the selection step. A reasonable person could have dropped it.
4. Publishing a hand-rolled decoder. §6. Justified by the cross-check and bounded by an explicit list of what it does not do.
5. Running a live probe at all. A systematisation page that only cites papers cannot show the reader what a real pre-consent string looks like, and the most useful facts on the page — that __tcfapi can be defined and silent, that vendor and purpose arrays disagree, that PublisherCC may be the crawler's country — are not in any paper in the corpus. The cost is a non-reproducible artefact; it is mitigated by publishing the script, the raw output and the exact vantage, and by making no prevalence claim.
6. Dating [1Matte, Célestin; Bielova, Nataliia; Santos, Cristiana Teixeira (2020): "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)]'s shared-cookie result as historical. The page reports the 4.3% figure and then says the mechanism was retired in 2021, on the authority of the specification's own changelog (“Deprecation of Global Scope, OOB and 'euconsent-v2' cookie associated with the consensu.org domain”, September 2021; “Since Sept 1st 2021, TC strings established with global-scope are considered invalid”). A reasonable person could have left the caveat off and let the 2019 date do the work; that is what consent currently does, and it reads as current practice, which is why it is being corrected.
7. Not fixing the four duplicate bibliography entries. §8.
8. Calling getTCData deprecated but still usable. The spec says deprecated. Rather than assert “it still works” from the spec alone, scripts/tcf_gettcdata_probe.mjs was written and run on the four sites that answered anything: all four returned a TC string, and corriere.it returned one with the callback's success flag set to false. Both facts are on the page. An earlier draft of the correction to consent said “every CMP encountered still answers getTCData” before that probe existed — an assertion about a command that had not been called. It was replaced with the measured wording. Raw output:

https://www.spiegel.de/  {"ok":true,"err":null,"ts":350,"ev":"cmpuishown"}
https://www.corriere.it/ {"ok":false,"err":null,"ts":334,"ev":"cmpuishown"}
https://www.bild.de/     {"ok":true,"err":null,"ts":334,"ev":"cmpuishown"}
https://www.focus.de/    {"ok":true,"err":null,"ts":306,"ev":"cmpuishown"}

Four passes, each handed the page text, the scripts, their unedited output and these notes, and each told the author's context may not be exhaustive. Rejections are recorded as carefully as fixes, because they are the only record of whether a reviewer earned its slot.

Pass A — external currency (Sonnet). Told to fetch rather than recall.

Pass B — citations and quotes (Sonnet).

Pass C — figures against the script (Sonnet).

Pass D — generic (Fable). No checklist; told to look for whatever the focused three were not. It returned 15 findings against a page that had already absorbed the other three, and it is the pass that produced the largest number of accepted changes.

On the reviewer that found the most. Pass D was given no checklist and cost the most wall-clock by a wide margin. It found the two things that would actually have embarrassed the page — a claim the page's own data refutes, and a spec conflation that survived three focused passes and a fetch-everything currency review. The focused passes are still worth their slots (Pass C caught a wrong denominator and a deleted table; Pass B caught the contaminated population), but the evidence here is that the unstructured pass is not the optional one.

• Decoding TCF Consent Strings — the page these notes back.
• corpus — corpus-level provenance: how the 5,859 papers were selected, extracted and validated, and the caveats that apply to every figure on this site.
• consent — the neighbouring page's notes, including the consentAction audit these populations deliberately do not duplicate.

[1]

Matte, Célestin; Bielova, Nataliia; Santos, Cristiana Teixeira (2020): "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[2]

Smith, Michael; Torres-Agüero, Antonio; Grossman, Riley; Sen, Pritam; Chen, Yi; Borcea, Cristian (2024): "A Study of GDPR Compliance under the Transparency and Consent Framework", in: Proceedings of the ACM Web Conference. (DOI)

[3]

Kancherla, Gayatri Priyadarsini; Bielova, Nataliia; Santos, Cristiana; Bichhawat, Abhishek (2025): "Johnny Can't Revoke Consent Either: Measuring Compliance of Consent Revocation on the Web", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[4]

Morel, Victor; Santos, Cristiana; Carlsson, Pontus; Ahlinder, Joel; Duvignau, Romaric (2026): "The TCF doesn't really A(A)ID - Automatic Privacy Analysis and Legal Compliance of TCF-based Android Applications", Proceedings on Privacy Enhancing Technologies 2026(3). (DOI)

[5]

Hils, Maximilian; Woods, Daniel W.; Böhme, Rainer (2021): "Privacy Preference Signals: Past, Present and Future", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[6]

Koch, Simon; Altpeter, Benjamin; Johns, Martin (2023): "The OK Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications", in: Proceedings of the USENIX Security Symposium. (Link)

[7]

Toth, Michael; Bielova, Nataliia; Roca, Vincent (2022): "On dark patterns and manipulation of website publishers by CMPs", Proceedings on Privacy Enhancing Technologies 2022(3). (DOI)

[8]

Liu, Zengrui; Iqbal, Umar; Saxena, Nitesh (2024): "Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy?", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[9]

Bouhoula, Ahmed; Kubicek, Karel; Zac, Amit; Cotrini, Carlos; Basin, David (2024): "Automated Large-Scale Analysis of Cookie Notice Compliance", in: Proceedings of the USENIX Security Symposium. (Link)

[10]

Rasaii, Ali; Dao, Ha; Feldmann, Anja; Javid, Mohammadmahdi; Gasser, Oliver; Gosain, Devashish (2025): "Intractable Cookie Crumbs: Unveiling the Nexus of Stateful Banner Interaction and Tracking Cookies", in: Proceedings on Privacy Enhancing Technologies, pp. 429-445. (DOI)

[11]

Aziz, Muhammad Abu Bakar; Wilson, Christo (2024): "Johnny Still Can't Opt-out: Assessing the IAB CCPA Compliance Framework", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[12]

Utz, Christine; Degeling, Martin; Fahl, Sascha; Schaub, Florian; Holz, Thorsten (2019): "(Un)informed Consent: Studying GDPR Consent Notices in the Field", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[13]

Bollinger, Dino; Kubicek, Karel; Cotrini, Carlos; Basin, David (2022): "Automating Cookie Consent and GDPR Violation Detection", in: 31st USENIX Security Symposium (USENIX Security 22), pp. 2893-2910. USENIX Association, Boston, MA. (Link)

[14]

Utz, Christine; Amft, Sabrina; Degeling, Martin; Holz, Thorsten; Fahl, Sascha; Schaub, Florian (2023): "Privacy Rarely Considered: Exploring Considerations in the Adoption of Third-Party Services by Websites", Proceedings on Privacy Enhancing Technologies 2023(1):5-28. (DOI)

[15]

Zimmeck, Sebastian; Wang, Oliver; Alicki, Kuba; Wang, Jocelyn; Eng, Sophie (2023): "Usability and Enforceability of Global Privacy Control", Proceedings on Privacy Enhancing Technologies 2023(2). (DOI)

[16]

Demir, Nurullah; Urban, Tobias; Pohlmann, Norbert; Wressnegger, Christian (2024): "A Large-Scale Study of Cookie Banner Interaction Tools and their Impact on Users' Privacy", in: Proceedings on Privacy Enhancing Technologies, pp. 5-20. (DOI)

[17]

Kumar, Vinayshekhar Bannihatti; Iyengar, Roger; Nisal, Namita; Feng, Yuanyuan; Habib, Hana; Story, Peter; Cherivirala, Sushain; Hagan, Margaret; Cranor, Lorrie Faith; Wilson, Shomir; Schaub, Florian; Sadeh, Norman M. (2020): "Finding a Choice in a Haystack: Automatic Extraction of Opt-Out Statements from Privacy Policy Text", in: Proceedings of the ACM Web Conference. (DOI)

[18]

Tahaei, Mohammad; Ramokapane, Kopo M.; Li, Tianshi; Hong, Jason I.; Rashid, Awais (2022): "Charting App Developers' Journey Through Privacy Regulation Features in Ad Networks", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[19]

Tang, Brian; Bui, Duc; Shin, Kang G. (2025): "Navigating Cookie Consent Violations Across the Globe", in: Proceedings of the USENIX Security Symposium. (Link)