webtracking.org · free tool

Consent / CMP Checker

Decode an IAB TCF v2.2 consent string or a GPP header into plain-English purposes, special features, and vendor consents — or read the consent signals the current page is handing to JavaScript. Built for privacy and tag-implementation QA.

100% client-side — decoding runs entirely in your browser, nothing is sent anywhere · works offline

JavaScript is disabled — the decoder and the page-signal reader both need it and the controls below will not respond. No network requests are made either way.

Paste a TC string (from the __tcfapi API, an ad request, or a cookie) or a GPP string. The type is auto-detected — TCF strings and GPP headers use different-but-related base64url bit layouts. Nothing is transmitted; the decode happens on this page.

Consent string — TC string or GPP string

waiting for input

Decoded fields appear here.

What a consent string is — and is not. A TCF/GPP string is the CMP’s record of a user’s choices: which purposes and vendors were consented to, at what time, by which CMP. It is the signal. It does not prove that any tag on the page actually read it or gated on it — that is a separate question this decoder cannot answer.

The signal is only half the story

This page shows you the consent signal. It can’t tell you whether the tags on a site actually gate on it — whether a pixel still fires when consent is denied. That requires auditing what a site loads and where it sends data. That’s what Tag Reaper (ad.rip) does.

Audit a site with ad.rip → Privacy guides

Decoding happens entirely in your browser; no account, no server, no logging. Related: GPC, Do-Not-Track & consent banners · all free tools