Skip to main content
Cookie Gate
The state of ai impact assessment
Category: CMP Implementation

__tcfapi

Also known as: TCF API, CMP API, IAB TCF API
Simply put

__tcfapi is a standard JavaScript function defined by the IAB Europe Transparency and Consent Framework (TCF) that lets a website's scripts communicate with the consent management platform (CMP) on a page. Through this function, developers can retrieve a user's consent choices or be notified when those choices change. It is a technical building block that supports TCF-based consent workflows but does not by itself determine whether any given use of cookies or data is lawful.

Formal definition

__tcfapi is the client-side JavaScript function specified by the IAB Europe Transparency and Consent Framework (TCF) v2.x CMP API for interacting with a CMP in the browser. It follows the general form __tcfapi(command, version, callback, parameter), where the command (for example, retrieving TC data or registering an event listener) invokes CMP behavior and the callback receives the result. Scripts may call __tcfapi before the full CMP script has loaded because early invocations are queued (via a stub) and executed once the CMP is initialized. The function surfaces TCF signals such as the consent string and event states, enabling vendors and third-party scripts to read consent status or listen for consent changes. Note that __tcfapi is a technical interface within the TCF's opt-in-oriented, EU/ePrivacy- and GDPR-facing model; its availability and correct behavior depend on CMP implementation, and its presence does not guarantee that consent collected is valid or that any downstream data processing is compliant. Requirements and applicable frameworks differ outside the EU (for example, US state privacy regimes that rely on opt-out mechanisms), which are out of scope for this function.

Why it matters

The __tcfapi function is the practical bridge between a website's tracking scripts and the consent choices a user has made through a TCF-based consent management platform (CMP). Without a reliable interface of this kind, third-party scripts and vendors would have no standardized way to check whether a user has consented before firing cookies, pixels, or other data-collection technologies. For teams that have adopted the IAB Europe Transparency and Consent Framework, __tcfapi is therefore central to how consent signals actually flow across a page.

Because __tcfapi surfaces the TCF consent string and event states, it becomes the technical point at which a compliance intention is either honored or missed. If a script reads consent incorrectly, ignores it, or fires before consent is available, the result can be data processing that the user did not agree to, a gap that carries risk in EU jurisdictions governed by the ePrivacy Directive's national implementations and the GDPR. It is important to stress, however, that the presence and correct operation of __tcfapi does not by itself make any use of cookies lawful. The function communicates consent status; it does not decide whether the consent collected was freely given, specific, informed, and unambiguous, nor whether any downstream processing meets its legal basis.

Teams should also be careful not to treat the TCF and its API as a universal solution. The framework and __tcfapi are oriented toward an opt-in model aligned with EU requirements, and their behavior depends heavily on how the underlying CMP is implemented. Different jurisdictions, for example, US state privacy regimes that generally rely on opt-out mechanisms, operate under different rules and are outside the scope of this function.

Who it's relevant to

Web developers and engineers
Developers integrating TCF-based CMPs use __tcfapi to read consent status and register listeners for consent changes before firing tags or scripts. They are responsible for calling the function correctly, including handling queued early calls via the stub, because implementation errors can cause scripts to fire without valid consent even when the interface is present.
Privacy and data protection officers
Privacy officers overseeing consent workflows need to understand that __tcfapi communicates consent signals but does not establish that consent is valid or that downstream processing is lawful. This distinction matters when assessing whether a TCF deployment supports compliance obligations under the ePrivacy Directive's national implementations and the GDPR in EU jurisdictions.
AdTech and third-party vendors
Vendors whose scripts run on publisher pages rely on __tcfapi to obtain the TCF consent string and event states so they can determine whether they may process data. Because the function is oriented toward the TCF's opt-in model, vendors operating across regions should recognize that different frameworks, such as US state opt-out regimes, fall outside its scope.
Compliance and legal counsel
Legal and compliance teams evaluating a CMP deployment should treat __tcfapi as a technical building block that supports, but does not replace, legal judgment about consent validity and lawful processing. Its correct behavior depends on CMP implementation, so counsel may need to confirm that the consent surfaced by the function reflects choices that meet applicable requirements.

Inside __tcfapi

API function name
The __tcfapi is a JavaScript function exposed on the window object that serves as the standardized interface for the IAB Europe Transparency and Consent Framework (TCF). Scripts, vendors, and consent management platforms (CMPs) call it to interact with consent information on a webpage.
Command and callback structure
Calls to __tcfapi typically include a command string (such as retrieving TC data or registering an event listener), a version parameter, and a callback function that receives the requested data and a success indicator. The precise commands available depend on the TCF version implemented.
TC string retrieval
One of its central roles is to provide access to the Transparency and Consent (TC) string, an encoded representation of the user's consent and objection choices across purposes and vendors participating in the TCF. This allows vendors to determine whether they have a legal basis to process data for given purposes.
Event listener capability
The API allows scripts to register listeners that are notified when the CMP's user interface loads or when the user's consent state changes, so that downstream processing can respond to updated choices.
Relationship to the CMP
The __tcfapi is generally implemented and populated by a consent management platform. It is the CMP that gathers user choices and encodes them; the API is the delivery mechanism through which that information is made available to other parties on the page.
Scope within the TCF
The API is specific to the IAB Europe TCF ecosystem and is primarily oriented toward the EU and EEA legal context under the ePrivacy Directive and the GDPR. It is distinct from other signalling mechanisms such as the IAB US Privacy API or Global Privacy Control.

Common questions

Answers to the questions practitioners most commonly ask about __tcfapi.

Does the presence of __tcfapi on a site mean the site is compliant with EU consent requirements?
No. __tcfapi is the JavaScript API defined by the IAB Transparency and Consent Framework (TCF) that allows a Consent Management Platform (CMP) to communicate consent and transparency information to other scripts and vendors. Its presence indicates that a CMP implementing the TCF is deployed, but it does not by itself establish that consent was validly obtained. Valid consent under the GDPR must be freely given, specific, informed, and unambiguous, and the placing of or access to information on a device is governed by the ePrivacy rules as implemented nationally. Whether a particular implementation meets those standards depends on how the CMP is configured and how the site actually behaves, and remains a matter of legal judgment rather than something the API guarantees.
Is __tcfapi a universal standard that satisfies consent obligations in every jurisdiction?
No. __tcfapi is tied to the IAB TCF, which was designed primarily around EU (and by extension UK) consent-based requirements. It does not automatically address the differing obligations found in other regimes, such as the opt-out-oriented approaches under US state privacy laws like the CCPA and CPRA in California. The IAB maintains separate frameworks and signals for some of those contexts. Because consent and preference-signalling obligations vary between the EU, the UK, and individual US states and other jurisdictions, the applicability and adequacy of __tcfapi should be assessed against the specific legal scope that applies to a given site or user.
How do vendor scripts read a user's consent status through __tcfapi?
Vendor and tag scripts typically call the __tcfapi function with a defined command (commonly to retrieve the current consent data) and register a callback that receives a consent object. That object generally includes the encoded consent string and structured information about which purposes and vendors the user has permitted. Scripts are expected to check the relevant permissions before firing, so that tags requiring consent (such as analytics or advertising technologies) only execute where the corresponding permission is present. Exact command names and return structures follow the TCF specification version in use, so implementers should consult the specification matching their CMP.
What should a script do if __tcfapi is not yet available when it loads?
Because a CMP may load asynchronously, __tcfapi might not be defined at the moment a dependent script runs. A common approach is to defer execution until the API is available and to use the framework's mechanism for listening to consent events, rather than assuming consent state on first load. Scripts should generally avoid setting non-essential cookies or accessing device storage until a valid consent signal has been received. How gracefully a site handles the pre-consent window is both a technical and a compliance consideration, since firing tags before consent is captured may undermine the lawfulness of the placement under EU and UK rules.
Can __tcfapi be used as a record of the consent that was collected?
The API provides the current consent state, including the consent string, which can inform logging, but the API call itself is not a substitute for a consent record. Record-keeping and demonstrating consent are separate organizational obligations, and the responsibility for storing and retaining evidence of consent typically rests with the CMP and the site operator's own systems. Teams should confirm how their CMP captures, stores, and makes retrievable the record of each consent event, and should not assume that the runtime availability of a consent string through __tcfapi satisfies documentation requirements.
How does __tcfapi relate to signals such as Global Privacy Control?
__tcfapi is a specific interface within the IAB TCF and is distinct from browser- or device-level preference signals such as Global Privacy Control (GPC), which are generally associated with opt-out mechanisms recognized under some US state privacy laws. These are separate components of a consent and preference architecture and may need to be handled independently. An implementation that reads consent via __tcfapi does not necessarily interpret or honor GPC, and vice versa, so operators subject to multiple regimes should map which signals apply to which users and ensure each is processed according to the relevant framework.

Common misconceptions

Implementing __tcfapi means a site is compliant with EU cookie and data protection law.
The API is a technical interface for transmitting consent signals within the TCF; it does not by itself guarantee compliance. Whether consent is valid still depends on how it was obtained (freely given, specific, informed, and unambiguous under the GDPR) and on lawful placement of and access to information on the device under the ePrivacy Directive. Tools support compliance but do not replace legal judgment, and the TCF itself has been the subject of regulatory scrutiny in the EU.
The presence of a TC string returned by __tcfapi confirms that consent exists for all connected vendors and purposes.
The TC string encodes the user's specific choices, which may include refusals or objections for particular purposes or vendors. Reading the API correctly means checking the granular signals rather than assuming consent; a returned string does not equate to blanket permission.
__tcfapi is a universal consent standard that applies everywhere.
The API is tied to the IAB Europe TCF and is oriented toward the EU/EEA context. Requirements differ in the UK and across US state privacy laws such as the CCPA and CPRA, which often rely on opt-out mechanisms and different signalling approaches. It should not be treated as a single global solution.

Best practices

Treat __tcfapi as one component of a broader consent architecture, and confirm that the underlying consent was collected in a manner meeting the applicable standard for the jurisdiction you serve, recognizing that EU requirements differ from those in the UK and US states.
Ensure tag and script firing is gated on the granular consent and objection signals within the TC string rather than on the mere presence of a response, so that vendors only process data where an appropriate legal basis is indicated.
Use the API's event listener capability to respond promptly to changes in user choices, including withdrawals, so that processing stops when consent is revoked.
Do not rely on the API or the TCF alone to demonstrate compliance; maintain separate consent logging and record-keeping consistent with your record-keeping obligations, and document how consent was obtained.
Combine the TCF signal with other applicable mechanisms where relevant, such as handling Global Privacy Control or US state opt-out signals, since __tcfapi is oriented toward the EU/EEA and does not cover other regimes.
Obtain legal review of your CMP configuration and TCF implementation, and monitor evolving data protection authority guidance, since enforcement positions on the framework continue to develop.
Application Security Isn’t Optional Anymore.