Does Consent Mode replace a CMP?

No. Consent Mode carries consent states to Google services, it collects nothing. To serve personalized ads in the European Economic Area, Google in fact requires a certified CMP integrated with the TCF. The two layers complement each other: the CMP collects the choice, the signal propagates it.

Does a well-formed consent signal prove the choice is honored?

No. It proves a choice was encoded. What an SDK does with it, and above all what it sends before the signal exists or after a refusal, cannot be read in the signal: it is observed on the device, exchange by exchange. The finding stays factual, the legal assessment belongs to the publisher and its counsel.

All articles

TCF and Consent Mode: is the consent signal honored inside the app?

July 8, 2026 · Updated August 26, 2026 · 4 min read · Mohamed

The IAB’s consent framework (the TCF) and Google’s Consent Mode share a goal: encoding the user’s choice into a signal that can be passed along. It still has to be honored at the end of the chain, inside the app.

A framework that keeps tightening

Since January 2024, Google requires publishers serving personalized ads in the EEA and the UK to use a certified CMP integrated with the TCF. Otherwise, only limited ads can be served.

For its part, IAB Europe monitors integrations: a vendor that tampers with a TC string can be suspended from the global vendor list. The framework exists, and it keeps tightening.

Version 2.3 of the framework illustrates it: launched in April 2025, it makes the disclosed-vendors section of the TC string mandatory, and gave participants until 28 February 2026 to adopt it. Inside an app, that signal lives in the phone’s storage, where every SDK comes to read it: here is where, and how to decode it.

Encoding is not honoring

A correctly encoded signal does not guarantee correct behavior. The TC string can be ignored by a badly integrated SDK, arrive after the request has already left, or be contradicted by an SDK firing too early.

The signal describes an intent. The app’s behavior describes what actually happens. The two can diverge, and it is that divergence that exposes the publisher and the vendor alike.

What the field shows

What is missing is a view of the real behavior, where the SDK runs. On a real phone, one observes what the SDK does and when, relative to the choice expressed in the banner: before, or after a refusal.

That finding stays a factual, dated map. It does not issue a TCF or Consent Mode compliance verdict: it documents what happens, and leaves the legal assessment to the publisher and its counsel.

The vendor-side check

For an adtech vendor, knowing how its SDK behaves, across a sample of real apps, once the choice is expressed, usefully complements what its documentation claims. It is a way to spot integrations where the choice has, in practice, no effect.

That is the purpose of a check for ad networks and adtech: observing the SDK’s behavior app by app, backed by evidence.

Sources

Every finding in this article traces back to one of these documents.

IABTransparency and Consent Framework (TCF)IAB Europe
GooglePublisher integration with the IAB Europe TCFGoogle AdMob Help, TCF integration
Belgium ’25The Market Court rules in the IAB Europe caseBelgian data protection authority, statement on the ruling of 14 May 2025

Common questions

Does Consent Mode replace a CMP?: No. Consent Mode carries consent states to Google services, it collects nothing. To serve personalized ads in the European Economic Area, Google in fact requires a certified CMP integrated with the TCF. The two layers complement each other: the CMP collects the choice, the signal propagates it.
Does a well-formed consent signal prove the choice is honored?: No. It proves a choice was encoded. What an SDK does with it, and above all what it sends before the signal exists or after a refusal, cannot be read in the signal: it is observed on the device, exchange by exchange. The finding stays factual, the legal assessment belongs to the publisher and its counsel.