Consent Management (CMP)

How Advlume collects and forwards GDPR/TCF, GPP, and CCPA consent signals using the InMobi Choice CMP — and what that means for you as a publisher.

Advlume ships with full Consent Management Platform (CMP) support built into the wrapper. This article explains how consent signals are collected, how they flow to Prebid and Google Ad Manager, and what you need to do — if anything — as a publisher.

Do I need to set up a CMP?

That depends on your traffic:

Traffic region	Regulation	Requirement
European Economic Area + UK	GDPR / ePrivacy	A TCF v2-registered CMP is legally required before placing non-essential cookies or serving personalised ads
United States (California, Virginia, Colorado, Utah, Connecticut)	CCPA / state privacy laws	An opt-out mechanism (USP or GPP) is required for sites over the applicable thresholds
Rest of world	—	No legal requirement, but deploying a CMP does no harm and enables maximum demand competition

Advlume will serve ads without a CMP, but demand partners that require a valid TCF consent string may not bid for EEA/UK traffic, reducing your fill rate and CPMs in those regions.

The CMP Advlume uses

The Advlume wrapper loads the InMobi Choice CMP (formerly Quantcast Choice) automatically for every site. It is a registered TCF v2.2 CMP and covers:

GDPR / TCF v2.2 (EU/EEA/UK)
GPP (Global Privacy Platform) v1.1, including US national and state strings
CCPA / USP (California)

No additional setup is needed on your end. The consent dialog will appear automatically to visitors in applicable jurisdictions on their first visit and on any subsequent visit where consent has expired or the vendor list has changed.

How consent is loaded

The CMP is loaded non-blocking — it does not delay the auction or ad rendering. The sequence is:

CMP stubs install synchronously before any async work. The stubs implement the __tcfapi, __gpp, and __uspapi interfaces immediately, so any downstream library that calls these APIs before the real CMP is ready gets queued responses rather than errors.
The CMP script loads in parallel with GPT and Prebid. It does not block either.
Prebid reads the consent string before sending bid requests. It polls __tcfapi('getTCData', 2, cb) with an 8,000ms timeout. If a valid TCF string is returned within the timeout, it is appended to every bid request. If not (e.g. a visitor dismisses the dialog without choosing), Prebid proceeds with defaultGdprScope: true — meaning it treats the visitor as subject to GDPR and restricts personalised demand accordingly.
GPT reads the consent string natively. The googletag library has built-in TCF v2 support — it calls __tcfapi itself and adjusts the ad request before sending it to GAM/AdX.

Consent timeout behaviour

Prebid is configured with an 8-second timeout for each consent module (GDPR, USP, GPP). If the CMP takes longer than 8 seconds to resolve — for example, because the visitor is on a slow connection and the consent dialog has not loaded — Prebid proceeds with whatever signal it has. In practice, the InMobi Choice script loads in under 500ms on most connections.

What the consent banner looks like

The InMobi Choice banner respects your site's language. It presents a layered notice (first layer: accept / manage preferences; second layer: per-purpose and per-vendor controls). The styling is neutral and works on both light and dark sites. Advlume does not currently offer custom consent banner styling — if you require a branded CMP dialog, contact us to discuss enterprise options.

Withdrawing and re-showing consent

Visitors can withdraw or change their consent at any time. The CMP stores consent in a first-party cookie (euconsent-v2 for TCF, usprivacy for US) scoped to your domain. To re-open the preference panel programmatically you can call:

window.__tcfapi('displayConsentUi', 2, () => {});

This is useful if you want to add a "Manage cookies" link in your site footer.

Publisher obligations

Because Advlume handles CMP loading automatically, your main obligations are:

Privacy policy: Maintain an up-to-date privacy policy that discloses the use of personalised advertising and lists the ad technology vendors you work with. Advlume's vendor list is available on request.
ads.txt: Keep your ads.txt file current. An invalid ads.txt does not affect consent, but it does affect authorised selling signals. See ads.txt Setup Guide.
Do not suppress the CMP: Do not use CSS or JavaScript to hide or auto-dismiss the consent banner. Doing so violates IAB TCF policies and could result in your site being removed from the program.