Prebid.js CMP Setup: Passing TCF, GPP, and CCPA Consent to Your Header Bidding Stack

Header bidding without consent signals is a compliance gap and a revenue problem: TCF-registered bidders discard bid requests that lack a valid TC string in GDPR territories. Wiring Prebid.js to a certified CMP fixes both. Here is the complete setup.

The Three Prebid Consent Modules

Prebid.js ships consent management modules for each framework. Include the ones your traffic needs when building Prebid:

• consentManagement: IAB TCF for GDPR (EEA and UK traffic)
• consentManagementGpp: IAB GPP for US state privacy laws
• consentManagementUsp: US Privacy / CCPA (legacy signal)

Configuration

Point each module at the standard IAB CMP API:

pbjs.setConfig({
  gdpr: {
    cmpApi: "iab",
    timeout: 3000,
    allowAuctionWithoutConsent: false,
  },
  usp: {
    cmpApi: "iab",
    timeout: 500,
  },
  gpp: {
    cmpApi: "iab",
    timeout: 3000,
  },
});

With cmpApi: "iab", Prebid discovers the CMP through the standard __tcfapi, __gpp, and __uspapi window APIs, with no vendor-specific adapter needed. UniConsent implements all three, so the same installation covers GDPR consent in Europe and opt-out signals in the US.

Why the CMP Must Be Certified

Bidders validate the TC string's CMP ID against the IAB Europe CMP list. A string generated by an unregistered "TCF-compatible" tool carries an invalid CMP ID and gets discarded, silently costing you demand. UniConsent is a registered CMP (ID 68), so its TC strings are accepted across the programmatic supply chain, including Google Ad Manager, which reads the same string alongside Prebid.

Holding the Auction for Consent

Set allowAuctionWithoutConsent: false and delay your first auction until the CMP reports a decision. UniConsent exposes the standard TCF event API for this - wait for tcloaded or useractioncomplete before calling pbjs.requestBids(). The exact snippet is in the Prebid integration tutorial.

Verifying the Setup

1. Decode the TC string your site generates with the TCF decoder and confirm CMP ID 68 and the consented purposes.
2. For US traffic, decode the GPP string with the GPP decoder.
3. In the browser console, check pbjs.getConsentData() and inspect bid requests for gdprConsent and gppConsent fields.

Prebid consent is one part of the wider publisher consent stack. The same CMP also handles Google Ad Manager and Additional Consent, Google Consent Mode v2, and mobile in-app consent.