Prebid.js CMP Setup: Passing TCF, GPP, and CCPA Consent to Your Header Bidding Stack

Header bidding without consent signals is not just a compliance gap, it is a direct revenue problem. Every TCF-registered bidder in your Prebid stack is bound by IAB Europe's policies: without a TC string establishing a legal basis, the bidder cannot process the request for EEA and UK traffic, so the request is discarded before an auction ever happens. The site keeps sending bid requests, the SSPs keep dropping them, and nothing in the Prebid debug output says why fill rate collapsed in Europe. The same pattern is now repeating in the US as bidders start honouring state-law opt-outs carried in GPP strings.

Wiring Prebid.js to a certified CMP closes both gaps with one integration. This guide covers the modules, the configuration, holding the first auction for consent, and how to verify what bidders actually receive.

The Three Prebid Consent Modules

Prebid.js handles each privacy framework through its own consent management module, chosen when you build Prebid:

• consentManagementTcf (named consentManagement before Prebid 9) reads IAB TCF consent for GDPR, covering EEA and UK traffic.
• consentManagementGpp reads the IAB Global Privacy Platform string that carries US state privacy signals, section by section: national (usnat), California (usca), Virginia, Colorado, Connecticut, and the states added since.
• consentManagementUsp reads the older US Privacy string for CCPA. It is a legacy signal, but plenty of bidders still read it, so publishers with US traffic should keep it alongside GPP for now.

If you enforce TCF purposes client-side, add the tcfControl module (named gdprEnforcement before Prebid 9) as well; it blocks bid adapters and analytics adapters that lack consent for their declared purposes rather than leaving enforcement entirely to the bidders.

Only include the modules your traffic needs. A publisher with no US traffic gains nothing from the GPP and USP modules except payload size.

Configuration

All three modules sit under the consentManagement config object:

pbjs.que.push(function () {
  pbjs.setConfig({
    consentManagement: {
      gdpr: {
        cmpApi: "iab",
        timeout: 8000,
        defaultGdprScope: true,
      },
      usp: {
        cmpApi: "iab",
        timeout: 100,
      },
      gpp: {
        cmpApi: "iab",
        timeout: 8000,
      },
    },
  });
});

Three settings here deserve attention.

cmpApi: "iab" tells Prebid to discover the CMP through the standard window APIs: __tcfapi for TCF, __gpp for GPP, and __uspapi for US Privacy, including the postMessage variants when Prebid runs inside a cross-domain iframe. No vendor-specific adapter is needed. UniConsent implements all three APIs from the same installation, so one banner covers GDPR consent in Europe and opt-out signals in the US.

timeout is how long Prebid waits for the CMP to respond before giving up on the signal. Set it generously for GDPR: if the CMP has not answered when the timer expires, the auction proceeds without a TC string, which is exactly the discarded-request problem you are trying to avoid. The USP string is synchronous in practice, so its timeout can stay short.

defaultGdprScope: true treats every request as GDPR-in-scope until the CMP says otherwise. Without it, requests that fire before the CMP resolves the visitor's region go out unprotected. The safe default is on.

Why the CMP Must Be Certified

Every TC string embeds the ID of the CMP that generated it, and bidders validate that ID against the IAB Europe CMP list. A string produced by an unregistered "TCF-compatible" cookie tool carries an ID that fails validation, and the request is discarded exactly as if no string were present. The failure is silent: no error, no console warning, just missing demand.

UniConsent is a registered CMP (ID 68, validated for web and app), so its TC strings are accepted across the programmatic supply chain. That includes Google Ad Manager, which reads the same __tcfapi output that Prebid does, and which additionally needs the addtl_consent string for Google ad tech providers that are not on the IAB Global Vendor List. UniConsent generates Additional Consent alongside the TC string, so Google demand keeps bidding on inventory that a TC string alone would not cover.

Holding the First Auction for Consent

Configuration alone does not decide when the first auction fires. The clean pattern is to wait for the CMP to report a settled state through the standard TCF event API, then request bids:

window.__tcfapi("addEventListener", 2, function (tcData, success) {
  if (
    success &&
    (tcData.eventStatus === "tcloaded" ||
      tcData.eventStatus === "useractioncomplete")
  ) {
    pbjs.que.push(function () {
      pbjs.requestBids();
    });
  }
});

tcloaded fires for returning visitors whose stored consent is already available, and useractioncomplete fires the moment a new visitor closes the banner. Between page load and either event, no auction runs, so no request leaves without its consent signal. UniConsent exposes this standard event API out of the box; the full snippet, including the Google Ad Manager equivalent, is in the Prebid integration tutorial.

Verifying the Setup

Do not assume the pipeline works because the banner shows. Check what bidders actually receive:

1. Decode the TC string your site generates with the TCF decoder and confirm CMP ID 68, the consented purposes, and the vendors you expect.
2. For US traffic, decode the GPP string with the GPP decoder and confirm the right state section is present for your test location.
3. In the browser console, call pbjs.getConsentMetadata() to see which consent data Prebid attached to the auction.
4. In the network tab, open a bid request and confirm the gdprConsent and gppConsent fields (or gdpr_consent on URL-based endpoints) carry the same strings you decoded.

If step 1 passes but step 4 shows empty fields, the auction is firing before the CMP resolves, which points back to the timeout and event-listener sections above.

One CMP for the Whole Stack

Prebid consent is one part of the wider publisher consent stack. The same UniConsent installation handles Google Ad Manager with Additional Consent, Google Consent Mode v2 for GA4 and Google Ads, TCF Canada for Canadian traffic, and mobile in-app consent through native SDKs, which few CMPs cover in one product: our 2026 CMP comparison breaks down which vendors document Prebid, GPP, and Additional Consent support and which do not. You can start on the free plan, which covers up to 50,000 users per month, and verify the TC strings on your own pages before any commercial decision.