Programmatic advertising cookies and a publisher's consent duties

Programmatic advertising uses cookies to recognise a visitor across sites, match them between ad tech vendors and decide which ad to buy for them. A single page view on an ad-funded site can bring cookies from an ad server such as Google Ad Manager, supply-side and demand-side platforms, identity providers and cookie-sync partners. None of them is strictly necessary to deliver the page, so in the EU and UK each one needs the visitor's consent before it is set, and the publisher whose page loads them is responsible for asking.

What happens during a programmatic ad auction

Every time a page loads on an ad-funded website, a sequence of events unfolds in a fraction of a second. The visitor's browser sends a request to the publisher's ad server, which passes bid requests to supply-side platforms (SSPs), ad exchanges and demand-side platforms (DSPs). Each participant may try to read or set cookies on the visitor's device.

A single page view can involve many advertising technology vendors. Each may set its own tracking cookies to identify the visitor across sites, build audience profiles and measure ad performance. The publisher's page is the entry point for all of this activity, which is why marketing cookies set through programmatic channels are the publisher's problem.

Real-time bidding (RTB) is the mechanism behind most programmatic transactions. During the bid request, data about the visitor, including cookie-based identifiers, browsing context and sometimes location, is sent to many potential bidders at once.

Common cookies set by programmatic advertising

The specific cookies vary by vendor, but some appear on many publisher sites running programmatic ads. Knowing what they do helps you categorise them correctly in your consent management platform.

Most of these are third-party cookies. Two are first-party: __gads is set on the publisher's own domain (Google's list of advertising cookies describes it as set from the partner domain and lasting 13 months), and _fbp is written to the site's domain by the Meta Pixel. First-party or not, none qualifies as strictly necessary, so each needs consent before it is set where the GDPR and the ePrivacy Directive apply. Vendors change cookie names and lifetimes, so check each vendor's current documentation when you categorise them.

Cookie syncing: the hidden data exchange

Cookie syncing is the mechanism that makes cross-vendor tracking possible. When vendor A wants to match its user ID with vendor B's records, a pixel request passes through both domains, letting each party map its cookie ID to the same visitor. It happens during page load without the visitor seeing it.

A header bidding setup using Prebid.js can trigger cookie sync requests to every configured bidder adapter. Each sync request can create another third-party cookie on the visitor's device.

That makes cookie syncing a particular problem for consent. The visitor cannot see which companies are exchanging data about them. Article 5(3) of the ePrivacy Directive requires consent for storing or accessing information on a user's device, and each sync is another access.

Publisher responsibilities under the GDPR and ePrivacy rules

The publisher is the first party in the relationship with the visitor. Regulators hold publishers accountable for cookies set through their pages, even when those cookies come from third-party ad tech vendors.

Under the GDPR, consent must be freely given, specific, informed and unambiguous. For programmatic advertising, your cookie banner must explain the purposes of the cookies being set and, in practice, the vendors involved. Hiding this information behind several clicks or using pre-ticked boxes does not meet the standard.

The CNIL's record shows the financial risk. In 2025 it issued 83 sanctions totalling EUR 486,839,500, and 21 entities were sanctioned for breaking the rules on cookies and other trackers, according to its review of 2025 sanctions. SHEIN received a EUR 150 million fine partly for placing advertising cookies before visitors made any choice.

In the UK, PECR fines can reach GBP 17.5 million or 4% of worldwide turnover, whichever is higher, since the Data (Use and Access) Act 2025 changes took effect on 5 February 2026.

Joint controller considerations

When a publisher and an ad tech vendor both decide the purposes and means of processing visitor data, they may be joint controllers under Article 26 of the GDPR. That has practical consequences: both parties need an arrangement setting out who handles consent collection, data subject rights and breach notification. The guide to controllers and processors explains the roles.

The IAB Transparency and Consent Framework

The IAB Transparency and Consent Framework (TCF) is the advertising industry's standard for collecting and passing consent in programmatic advertising. It creates a consent string, a machine-readable signal that records the visitor's choices about purposes and specific vendors.

TCF v2.2, launched in 2023, removed legitimate interest as a legal basis for advertising and content personalisation purposes, so those purposes need opt-in consent. Since 1 March 2026, Google requires every TC string generated from that date to follow TCF v2.3, which makes a disclosed vendors segment mandatory. According to Google's TCF v2.3 troubleshooting page, a missing segment, or one that does not include Google, triggers error 1.4, and Google is not able to operate on that request.

Google also requires publishers serving ads to visitors in the EEA, the UK and Switzerland through AdSense, Ad Manager or AdMob to use a consent management platform certified by Google that integrates with the TCF. This applies to publishers. Advertisers who only send Google Consent Mode signals do not need a TCF platform.

How TC strings flow through the bid stream

When a visitor gives consent through your consent platform, the TC string is attached to the bid requests. Each vendor receiving a request reads the string to decide whether it may process the visitor's data. If a vendor is not allowed in the string, it should not process the data.

The word "should" matters. The TCF relies on each vendor reading and respecting the string. As a publisher, you have little control over what happens after a bid request leaves your page, which is why the choice of demand partners matters.

Header bidding and consent: practical problems

Header bidding wrappers like Prebid.js run in the visitor's browser before the ad server is called. Bid requests, and the cookie syncs that come with them, can fire as soon as the wrapper loads.

If the wrapper loads before the visitor responds to your cookie banner, cookies are set and data is shared with bidders before consent. The fix is to let Prebid wait for the consent string and apply it. In Prebid.js that is the consent management module together with the TCF Control module, known until Prebid.js 9.0 as the GDPR Enforcement module.

Server-side header bidding (Prebid Server) moves the auction from the browser to a server. That reduces the number of cookies set on the visitor's device but does not remove the consent requirement: visitor data is still shared with bidders, only server to server.

Programmatic advertising without cookies

Publishers who lose personalised demand when visitors refuse have a few options that do not depend on third-party cookies:

• Contextual targeting: ads chosen from the page's content rather than the visitor's history. Where nothing is stored on or read from the device for the purpose, no cookie consent is needed for that targeting, though ad delivery may still use cookies that do.
• First-party identifiers: a publisher's own ID shared with buyers. It still stores information on the device, so it needs consent like any other advertising cookie.
• Seller-defined audiences: the publisher groups its audience and passes only segment labels to buyers. If the segments are built from tracking on the device, consent is still needed for that tracking.

Contextual ads usually earn less than personalised ones, but they keep inventory selling for visitors who refuse.

Steps to set up consent for programmatic advertising

Getting programmatic advertising right takes coordination between editorial, ad operations and development teams. These steps cover the most common gaps.

1. Audit every demand partner

Scan your site with all ad units active. Record every cookie set during a page load, identify which vendor sets it, and classify it by purpose. Automated scanning helps, and checking in the browser's developer tools catches cookies a scanner may miss.

2. Load the ad stack after consent

Configure your ad stack so that no bid requests fire before the visitor has made a choice. For Prebid.js, include the consent management and TCF Control modules. For Google Ad Manager, use a Google-certified consent platform that writes TCF v2.3 strings.

3. Limit your vendor list

Every extra demand partner adds cookies, increases data exposure and lengthens your consent interface. Review your vendors in the TCF Global Vendor List and remove partners that contribute little revenue.

4. Give visitors a genuine choice

Your cookie banner must give visitors a real choice, with accept and reject equally prominent on the first layer. Hiding the reject option behind a settings menu has led to fines in several countries.

5. Keep consent records

Keep a record of every consent decision, including the time, the version of your consent notice, and the purposes and vendors the visitor approved. That record is your evidence if a data protection authority investigates.

Revenue impact and trade-offs

Asking for consent properly reduces the share of visitors with personalised ads. How far depends on your audience, banner and country, so measure your own rates rather than relying on industry averages.

For visitors who decline, contextual advertising fills the gap. Contextual CPMs are generally lower than personalised ones, but the inventory still sells.

Cutting corners does not protect revenue: it moves the risk to enforcement, where 2025 fines in France alone reached nearly half a billion euros across all subjects.

Questions about programmatic cookies

Check the TC string your site sends

If you run programmatic ads, check what your consent platform actually writes. The TCF string decoder shows every segment of a TC string, including the disclosed vendors that TCF v2.3 requires, with vendor names from the Global Vendor List.