Privacy signals and ads.txt on your pages

What the Epom ad tag reads from your consent manager (TCF), what happens to a visitor without consent, how US privacy signals (CCPA, GPP, GPC) are treated, the vendor ID to list in your CMP, and where your ads.txt lines come from.

How-to publisher network manager Account → Publishers → site → zone → placement → Ad tags & API

Before real traffic reaches your slots, two things outside the ad tag need to be right: the consent your visitors give in your consent manager has to reach the ad server, and your ads.txt has to authorise the network that sells your inventory. This page explains what the Epom ad tag does with privacy signals on its own, what you add when it cannot, and where your ads.txt lines come from.

Who this is for

Publishers putting Epom ad tags on their pages or apps, and the network managers who onboard them. Nothing here needs a permission: the tag behaves the same for every role. How strictly the ad server enforces consent is a network setting that your network administrator chooses — see What happens without consent.

Prerequisites

A placement and its Universal JS tag (Ad tags & API).
If you have visitors in the European Economic Area: a consent management platform (CMP) that implements IAB TCF 2.x.

Steps

Add Epom to your CMP’s vendor list. Epom’s IAB Global Vendor List ID is 849. Your network can be set up to check a different vendor ID; if it gave you one, list that one too.
Load the CMP before the ad tag, or at least on the same page. You do not need to wire the consent string yourself: the tag finds the CMP and waits for the visitor’s decision (see What the tag reads).
Tags you build yourself — a VAST URL in a video player, an API request from an app, a tag whose consent you already know — pass the signals as request parameters or tag attributes instead (see Options & fields).
Ask your network manager for your ads.txt lines (or app-ads.txt for apps) and publish them at the root of your domain (see ads.txt and app-ads.txt).
Test from a browser that has accepted your consent banner. A browser that refused, or has not answered yet, may legitimately get no ad or an ad without cookies.

What the tag reads

The Universal JS tag looks for a TCF 2.x CMP once per page and shares the answer with every slot on it:

It calls the page’s __tcfapi function or, when the CMP lives in a parent frame, reaches it through the __tcfapiLocator frame the TCF standard requires.
It waits until the CMP reports a final decision — the string is ready, or the visitor has made their choice — for at most 5 seconds. After that the ad request goes out with whatever it has.
If the CMP says GDPR does not apply, the request says so. Otherwise the request carries the visitor’s TCF consent string.
It keeps listening: when the visitor changes their choice later, slots that refill afterwards send the new string.

A page with no CMP still gets ads requested; the request simply carries no consent string, and the ad server decides whether GDPR applies from where the visitor is (the EEA countries).

Note: only TCF 2.x strings count. A string of any other version is treated as no consent.

Consent matters only for requests the ad server treats as in GDPR scope: the request says GDPR applies, or it says nothing and the visitor is in the EEA. For those, your network administrator chooses one network-wide behaviour when the visitor has not consented to the vendor:

Network setting	What your visitor gets
Not enforced (the default)	Ads as usual
Do not serve ads	No ad; the slot shows your Default code or stays empty
Do not use the user-ID cookie	An ad, without the user-identifier cookie
Do not use any cookies	An ad, with no cookies set or read
No cookies or server-side processing	An ad, with no cookies, and the visitor’s IP shortened, location reduced to country and browser details withheld

Ask your network manager which one your network uses — it decides what your EEA fill looks like for visitors who decline.

US privacy signals

CCPA / US Privacy string and GPP: the tag does not read them, and the ad request has no parameter for them. If your legal setup requires acting on them, stop the tag yourself — do not load it, or set data-cookie-policy — for visitors who opted out.
Global Privacy Control (GPC): browsers that send GPC add it to every request, so it reaches the ad server without any work on your side. Your network administrator decides whether it counts. When it does, a GPC opt-out is treated as no consent, but only for requests in GDPR scope (above); for other visitors it changes nothing.

Options and fields

Attributes go on the tag’s <ins> element; the request-parameter form is for VAST, API and other URLs you build yourself.

Tag attribute	Request parameter	What it does
`data-gdpr`	`gdpr`	`1` = GDPR applies, `0` = it does not. Without it the CMP’s answer is used, then the visitor’s location.
`data-gdpr-consent-iab`	`gdprConsentIab`	The TCF 2.x consent string. Set it and the tag stops asking the CMP.
`data-user-consent`	`uc`	Your own verdict: `1` = consented, `0` = not. Overrides the consent string.
`data-cookie-policy`	`cookie-policy`	Cookies for this request, whatever the network setting: `0` normal; `1` no cookies and no server-side frequency counting; `2` no cookies; `3` no user-ID cookie only.

ads.txt and app-ads.txt

The product does not create, host or check ads.txt or app-ads.txt files. The lines come from your network: they name the network as a seller of your inventory and list the ad systems it sells through. Ask your network manager for them, publish them at https://<your domain>/ads.txt (and app-ads.txt on the developer website listed in your app’s store page), and update the file when the network sends changes.

If your network resells your inventory through header bidding, the lines it gives you are the ones buyers check against its sellers.json; a missing or outdated line makes buyers bid less or not at all. See Header bidding: what a publisher installs.

Corner cases and gotchas

Corner case: data-gdpr-consent-iab switches the CMP lookup off for that slot. If you set it from a variable that is empty when the page loads, the slot sends no consent at all — leave the attribute out and let the tag ask the CMP.

Corner case: a CMP that takes longer than 5 seconds to answer loses the first request: it goes out without a string. Later refills use the visitor’s answer.

Corner case: a video player or outstream unit that loads its own VAST URL does not see the tag’s attributes. Put the parameters on that URL as well.

Per-role notes

Publisher: everything on this page is on your pages and in your CMP; the consent policy and your ads.txt lines come from your network.
Network manager: send each publisher their ads.txt lines and tell them which no-consent behaviour the network uses. The policy itself is set by your network administrator.