Consent frameworks (TCF v2.2 / GPP)

What we check

Detects IAB TCF v2.2 (__tcfapi) and GPP (__gpp) in the HTML.

Why it matters

IAB TCF v2.2 and GPP are the standards for cross-vendor consent in EU ad-tech.

Common causes

• The site runs no programmatic advertising, then the finding is expected and not an error.
• The CMP supports TCF, but TCF mode was never activated in the configuration.
• A TCF-capable CMP runs in standard mode, the vendor list is empty.
• The __tcfapi only gets injected after banner interaction, invisible to the scan in the initial HTML.

How to fix it

For IAB advertising: choose a TCF-v2.2-compatible CMP (OneTrust, consentmanager, Didomi); __tcfapi must be reachable.