---
title: "Privacy signals and ads.txt on your pages"
description: "What the Epom ad tag reads from your consent manager (TCF), what happens to a visitor without consent, how US privacy signals (CCPA, GPP, GPC) are treated, the vendor ID to list in your CMP, and where your ads.txt lines come from."
type: "howto"
audience: [publisher, network-manager]
keywords: [privacy, consent, GDPR, TCF, TCF 2.x, CMP, consent management platform, __tcfapi, vendor id, 849, vendor list, CCPA, US privacy, GPP, GPC, Global Privacy Control, cookies, cookie-policy, data-gdpr, data-gdpr-consent-iab, data-user-consent, ads.txt, app-ads.txt, sellers.json, authorized sellers]
ui_path: "Account → Publishers → site → zone → placement → Ad tags & API"
---

Fetch the complete documentation index at: https://epom.com/ad-server/docs/llms.txt. Use this file to discover all available pages before exploring further. Append .md to any documentation page URL to get its markdown version.

# Privacy signals and ads.txt on your pages

Before real traffic reaches your slots, two things outside the ad tag need to be right: the
consent your visitors give in your consent manager has to reach the ad server, and your `ads.txt`
has to authorise the network that sells your inventory. This page explains what the Epom ad tag
does with privacy signals on its own, what you add when it cannot, and where your `ads.txt` lines
come from.

## Who this is for

Publishers putting Epom ad tags on their pages or apps, and the network managers who onboard them.
Nothing here needs a permission: the tag behaves the same for every role. How strictly the ad
server enforces consent is a network setting that your network administrator chooses — see
[What happens without consent](#what-happens-without-consent).

## Prerequisites

- A placement and its **Universal JS** tag ([Ad tags & API](https://epom.com/ad-server/docs/guides/inventory/ad-tags-and-api.md)).
- If you have visitors in the European Economic Area: a consent management platform (CMP) that
  implements IAB TCF 2.x.

## Steps

1. **Add Epom to your CMP's vendor list.** Epom's IAB Global Vendor List ID is **849**. Your
   network can be set up to check a different vendor ID; if it gave you one, list that one too.
2. **Load the CMP before the ad tag**, or at least on the same page. You do not need to wire the
   consent string yourself: the tag finds the CMP and waits for the visitor's decision (see
   [What the tag reads](#what-the-tag-reads)).
3. **Tags you build yourself** — a VAST URL in a video player, an API request from an app, a tag
   whose consent you already know — pass the signals as request parameters or tag attributes
   instead (see [Options & fields](#options-and-fields)).
4. **Ask your network manager for your `ads.txt` lines** (or `app-ads.txt` for apps) and publish
   them at the root of your domain (see [ads.txt and app-ads.txt](#adstxt-and-app-adstxt)).
5. **Test from a browser that has accepted your consent banner.** A browser that refused, or has
   not answered yet, may legitimately get no ad or an ad without cookies.

## What the tag reads

The Universal JS tag looks for a TCF 2.x CMP once per page and shares the answer with every slot
on it:

- It calls the page's `__tcfapi` function or, when the CMP lives in a parent frame, reaches it
  through the `__tcfapiLocator` frame the TCF standard requires.
- It waits until the CMP reports a final decision — the string is ready, or the visitor has made
  their choice — for at most **5 seconds**. After that the ad request goes out with whatever it
  has.
- If the CMP says GDPR does not apply, the request says so. Otherwise the request carries the
  visitor's TCF consent string.
- It keeps listening: when the visitor changes their choice later, slots that refill afterwards
  send the new string.

A page with no CMP still gets ads requested; the request simply carries no consent string, and
the ad server decides whether GDPR applies from where the visitor is (the EEA countries).

> **Note:** only TCF **2.x** strings count. A string of any other version is treated as no consent.

## What happens without consent

Consent matters only for requests the ad server treats as in GDPR scope: the request says
GDPR applies, or it says nothing and the visitor is in the EEA. For those, your network administrator
chooses one network-wide behaviour when the visitor has not consented to the vendor:

| Network setting | What your visitor gets |
|---|---|
| Not enforced (the default) | Ads as usual |
| Do not serve ads | No ad; the slot shows your Default code or stays empty |
| Do not use the user-ID cookie | An ad, without the user-identifier cookie |
| Do not use any cookies | An ad, with no cookies set or read |
| No cookies or server-side processing | An ad, with no cookies, and the visitor's IP shortened, location reduced to country and browser details withheld |

Ask your network manager which one your network uses — it decides what your EEA fill looks like
for visitors who decline.

## US privacy signals

- **CCPA / US Privacy string and GPP:** the tag does not read them, and the ad request has no
  parameter for them. If your legal setup requires acting on them, stop the tag yourself — do not
  load it, or set `data-cookie-policy` — for visitors who opted out.
- **Global Privacy Control (GPC):** browsers that send GPC add it to every request, so it reaches
  the ad server without any work on your side. Your network administrator decides whether it counts. When
  it does, a GPC opt-out is treated as no consent, but only for requests in GDPR scope (above); for
  other visitors it changes nothing.

## Options and fields

Attributes go on the tag's `<ins>` element; the request-parameter form is for VAST, API and other
URLs you build yourself.

| Tag attribute | Request parameter | What it does |
|---|---|---|
| `data-gdpr` | `gdpr` | `1` = GDPR applies, `0` = it does not. Without it the CMP's answer is used, then the visitor's location. |
| `data-gdpr-consent-iab` | `gdprConsentIab` | The TCF 2.x consent string. Set it and the tag stops asking the CMP. |
| `data-user-consent` | `uc` | Your own verdict: `1` = consented, `0` = not. Overrides the consent string. |
| `data-cookie-policy` | `cookie-policy` | Cookies for this request, whatever the network setting: `0` normal; `1` no cookies and no server-side frequency counting; `2` no cookies; `3` no user-ID cookie only. |

## ads.txt and app-ads.txt

The product does not create, host or check `ads.txt` or `app-ads.txt` files. The lines come from
your network: they name the network as a seller of your inventory and list the ad systems it sells
through. Ask your network manager for them, publish them at `https://<your domain>/ads.txt` (and
`app-ads.txt` on the developer website listed in your app's store page), and update the file when
the network sends changes.

If your network resells your inventory through header bidding, the lines it gives you are the ones
buyers check against its `sellers.json`; a missing or outdated line makes buyers bid less or not at
all. See [Header bidding: what a publisher installs](https://epom.com/ad-server/docs/guides/inventory/header-bidding-for-publishers.md).

## Corner cases and gotchas

> **Corner case:** `data-gdpr-consent-iab` switches the CMP lookup off for that slot. If you set
> it from a variable that is empty when the page loads, the slot sends no consent at all — leave
> the attribute out and let the tag ask the CMP.

> **Corner case:** a CMP that takes longer than 5 seconds to answer loses the first request: it
> goes out without a string. Later refills use the visitor's answer.

> **Corner case:** a video player or outstream unit that loads its own VAST URL does not see the
> tag's attributes. Put the parameters on that URL as well.

## Per-role notes

- **Publisher:** everything on this page is on your pages and in your CMP; the consent policy and
  your `ads.txt` lines come from your network.
- **Network manager:** send each publisher their `ads.txt` lines and tell them which no-consent
  behaviour the network uses. The policy itself is set by your network administrator.

## Related

- [Ad tags & API](https://epom.com/ad-server/docs/guides/inventory/ad-tags-and-api.md)
- [Header bidding: what a publisher installs](https://epom.com/ad-server/docs/guides/inventory/header-bidding-for-publishers.md)
- [Publisher playbook](https://epom.com/ad-server/docs/roles/publisher.md)
- [Go-live checklist](https://epom.com/ad-server/docs/start/go-live-checklist.md)
- [My ad is not serving](https://epom.com/ad-server/docs/troubleshooting/ad-not-serving.md)
- [Frequently asked questions](https://epom.com/ad-server/docs/troubleshooting/faq.md)