When a TC string is invalid, nothing crashes - revenue just leaks. TCF-enforcing platforms silently treat the request as no-consent: bids are filtered, personalisation is off, and with Google ad products EEA and UK serving is restricted. Because the failure is quiet, TC string errors routinely go unnoticed for weeks. This guide covers the errors that actually occur in the wild and how to fix each one.

First step, always: decode the string

Every debugging session starts the same way: grab the current string (from the euconsent-v2 cookie or via __tcfapi('getTCData', 2, callback) in the browser console) and decode it with the free TCF String Decoder. Ninety per cent of the errors below are visible the moment you see the decoded output next to what you expected. If you need a refresher on the segments you are looking at, see what is a TC string.

Error 1: missing disclosedVendors segment

Symptom: strings that validated for years suddenly rejected; Google reporting flags invalid consent.

Cause: TCF v2.3 made the disclosedVendors segment mandatory - every TC string created after the transition deadline (end of February 2026) must record which vendors were actually disclosed to the user. Strings from CMPs still producing v2.2-era output fail validation with enforcing platforms, Google chief among them.

Fix: confirm your CMP is emitting v2.3-compliant strings (the decoder shows the version and segments). If it is not, that is a CMP upgrade conversation, not a configuration tweak.

Error 2: stale or inconsistent timestamps

Symptom: returning visitors monetise worse than new ones.

Cause: the string's created and lastUpdated fields are too old. TCF policy requires consent to be re-established periodically (in practice at most every 13 months), and platforms discount or reject strings beyond their freshness expectations. A related bug: CMPs that regenerate the string on every page view with a new timestamp but stale choices, which some validators flag as inconsistent.

Fix: verify your CMP's re-consent schedule and that cached strings are re-surfaced, not silently re-stamped.

Error 3: vendor consented but not in the string

Symptom: a specific SSP or measurement partner reports no consent although your banner lists it.

Cause: mismatch between the vendor IDs your ad stack needs and the vendors enabled in your CMP - often after a Global Vendor List update added or renumbered a partner, or because the vendor was disclosed under a different ID than the partner checks.

Fix: decode the string, list the consented vendor IDs, and diff against the IDs your partners require. Enable what is missing; prune what nothing uses - regulators dislike maximal vendor lists as much as partners dislike missing ones.

Error 4: publisher restrictions blocking a purpose

Symptom: vendor has consent but a specific capability (say, personalised ads) never activates.

Cause: a publisher restriction in the string limits that vendor to fewer purposes than it declared. Restrictions are easy to set in a CMP and easy to forget.

Fix: the decoder's publisher restrictions section shows exactly which purpose and vendor combinations you restricted. Loosen deliberately or leave deliberately - but know it is there.

Error 5: the string never reaches the tag

Symptom: decoder says the string is perfect, platforms still see nothing.

Cause: integration, not encoding. The __tcfapi function is missing, loads after the ad tags fire, or is blocked by a script manager. Load order is the classic culprit: consent infrastructure must initialise before anything that consumes it.

Fix: in the browser console run window.__tcfapi - if undefined, the CMP stub is not loading first. Check tag sequencing. The same class of bug hits Google Consent Mode setups, where the Consent Mode Checker spots signals fired before defaults were set.

Error 6: mixing up TCF and Consent Mode signals

Symptom: teams debug the TC string for hours when the failing signal is actually ad_storage.

Cause: Consent Mode v2 and TCF are separate mechanisms. Google ad products can require a valid TC string AND read Consent Mode; an invalid TC string also drags down Additional Consent, which rides on it.

Fix: identify which signal the erroring product consumes before debugging. If you are unsure whether TCF applies to your site at all, start with does your website need IAB TCF.

Error 7: CMP ID or list version mismatches

Symptom: validators flag the string as malformed even though choices decode correctly.

Cause: the string's embedded CMP ID does not match a registered CMP, or the vendor list version it references does not exist - typically after a misconfigured self-hosted CMP deployment or a staging build that shipped with placeholder values. Enforcing platforms reject strings whose provenance fields do not check out, since only registered CMPs may create TC strings.

Fix: decode the string and read the CMP ID, CMP version, and vendor list version fields. Anything unexpected there points at deployment configuration rather than consent logic.

Monitoring so it does not regress

Because every failure mode in this guide is silent, one-off fixes decay. Three lightweight habits keep the setup honest:

  • Decode on a schedule. Once a month, capture a fresh string from a clean profile on your highest-traffic template and run it through the decoder. Compare version, vendor count, and restrictions against your last known-good decode.

  • Watch the revenue signal, not just the tech. A step-change in EEA programmatic revenue or in the personalised versus non-personalised mix is often the first observable symptom of a string problem.

  • Re-test after every CMP release and GVL-related change. The two events that most often break working setups are CMP upgrades and vendor list changes - the same events that never feel risky enough to test.

Also keep an eye on your banner's consent UX itself: an invalid string is worthless, but so is a valid string nobody grants - our guide to banner design best practices covers the other half of the revenue equation.

A repeatable debugging checklist

  1. Capture the live string from euconsent-v2 or __tcfapi.

  2. Decode it with the TCF String Decoder: check version, timestamps, segments.

  3. Diff consented vendor IDs against what your partners require.

  4. Check publisher restrictions.

  5. Verify __tcfapi exists before ad tags execute.

  6. Re-test in a clean browser profile - cached strings mask fixes.