The TCF inside a mobile app: where consent lives, and how to read it
On the web, IAB consent can be seen: a cookie, and browser tools to read it. In a mobile app, the same framework exists, but it lives in a file nobody ever opens. Here is where the TCF gets written inside an Android app, what it contains, and what reading it reveals, or does not, about real behavior.
A storage contract: keys everyone reads
The IAB’s CMP API specification fixes the mechanism: the CMP, the tool that shows the banner and collects the choice, writes the result into the app’s default storage, the SharedPreferences, under standardized keys prefixed IABTCF_. There you find, among others, IABTCF_gdprApplies, which says whether the GDPR applies, IABTCF_TCString, the full consent string, and its decoded declensions such as IABTCF_PurposeConsents or IABTCF_VendorConsents.
That standardization is the heart of the system: any SDK embedded in the app can read the user’s choice without asking anything of the CMP that collected it. It is also what makes the mechanism fragile: reading is a convention, not a constraint of the system.
The TC string, data that encodes data
The centerpiece is the TC string. This compact string encodes the entire choice expressed: the identifier and version of the CMP that collected it, the creation and update timestamps, the vendor list version, the purposes accepted, the actors authorized, the publisher’s country. It decodes fully offline, with nothing but the specification.
This is no neutral technical detail: the Court of Justice of the European Union ruled that the TC string is personal data, and the Belgian courts have confirmed it since. The string that carries consent is itself covered by the GDPR.
Who reads it, and when
Every advertising or measurement SDK reads these keys at initialization, then refers to them to decide what it emits. The framework keeps moving: version 2.3 of the TCF, launched in April 2025, makes the disclosed-vendors section of the TC string mandatory, and had to be adopted by all participants by 28 February 2026.
Everything therefore rests on a chain of good will: the CMP writes, the SDKs read, each is supposed to draw the consequences. The useful question is not whether the string is well formed. It is whether behavior follows.
What the storage does not say
Reading the IABTCF_ keys tells you what the app declares it has collected. Three gaps only show in the traffic: requests that left before the keys existed, data flowing to an actor the string does not mention, and traffic that keeps going after a refusal.
The complete check therefore confronts the two readings: the signal written in storage, and the behavior observed on the device, timestamps attached. That is what a mobile app audit does: every outgoing exchange is placed relative to the choice expressed in the banner, and the finding, factual, leaves the qualification to the DPO. For an SDK provider, the same check runs vendor-side, app by app.
Sources
Every finding in this article traces back to one of these documents.
- IAB Tech LabIAB Tech Lab - CMP API v2Transparency and Consent Framework specification
- IABTransparency and Consent Framework (TCF)IAB Europe
- CJEU ’24Judgment C-604/22, IAB Europe v APDCourt of Justice of the European Union, 7 March 2024
Common questions
- Where is TCF consent stored in an Android app?
- In the app’s default SharedPreferences, under standardized keys prefixed IABTCF_. The IAB’s CMP API specification mandates it: any embedded SDK can read the user’s choice without depending on the CMP that collected it.
- What is the TC string?
- The compact string that encodes the user’s choice: purposes accepted, actors authorized, vendor list version, timestamps. It decodes with nothing but the specification, and the Court of Justice of the European Union ruled that it constitutes personal data.
- Can an SDK ignore the TC string?
- Technically, nothing stops it: reading the keys is an integration convention, not a system constraint. That is why real behavior, what leaves, to whom, at what moment, remains the check that counts, and it is observed on the device.
- Is the TCF mandatory for a mobile app?
- No text imposes it as such: it is an industry framework. It becomes unavoidable by ricochet: Google requires a certified CMP integrated with the TCF to serve personalized advertising in the EEA, and the programmatic chain assumes it.