Skip to content
Gravito
Frameworks

IAB TCF, GPP and the Google, Microsoft and Amazon signals, from one script.

Gravito CMP supports IAB TCF, IAB GPP (the Global Privacy Protocol, formerly the Global Privacy Platform), Google Consent Mode v2, Microsoft UET Consent Mode and the Amazon Consent Signal (ACS) from a single script. The visitor makes one choice. The CMP keeps it, and passes it to each system in the form that system reads.

What this page covers

This page is about consent preferences: which frameworks and signals Gravito CMP supports, how one deployment serves all of them, and how the visitor's choice is kept. It names the laws they serve without explaining them, and nothing on it is legal advice.

Reference

At a glance

The consent frameworks and signals Gravito CMP supports, at a glance
Framework or signalWhat it carriesIn Gravito CMPMore
IAB TCFConsent choices and legitimate-interest objections for ad tech vendors, in the IAB Europe frameworkTCF 2.4 on the web; registered CMP ID 302Docs
IAB GPPUS state privacy choices, in one standard stringWeb and apps (WebView)Docs
Google Consent ModeThe visitor's consent status, for Google tags such as Analytics and AdsConsent Mode v2, Advanced or BasicGoogle Consent Mode
Microsoft Consent ModeWhether Microsoft Advertising's UET tag may use its cookiesTCF and Standard configurationsMicrosoft Consent Mode
Amazon Consent SignalThe visitor's choice, for Amazon AdsBuilt inAmazon Consent Signal
Standard CMPYour own consent categories, where TCF is not usedBanner with Google, Microsoft and Amazon signalsDocs

One script for all of them

Which frameworks and signals run is part of one configuration, served from one script, and every new version you publish goes live at the same address. Google, Microsoft and Amazon signals are switched on in that same configuration, not added as separate tags.

Which framework a visitor gets

We configure the decisioning layer with you during implementation. Your site tells the CMP the visitor's region, typically from your CDN. For each region, the decisioning layer can apply whichever framework or configuration fits: TCF, GPP, the Standard CMP with your own consent categories, or no banner where none is needed.

Decisioning layer
Your site
the visitor's region
typically from your CDN
  • TCF
  • GPP
  • Standard CMP
  • No banner
Framework

IAB TCF

Gravito is registered with IAB Europe as a TCF CMP, ID 302, and supports TCF 2.4 on the web, from release 6.6.1 in September 2026. TCF 2.4 changed what the banner shows about Features; it added no new purposes or consent signals, and existing TCF set-ups kept working without migration. Purpose and Feature texts, illustrations and their translations come from the IAB's Global Vendor List. On the page, the CMP provides the standard __tcfapi interface that ad tech vendors read.

CMP ID
302
Version
TCF 2.4
Release
6.6.1
Interface
__tcfapi
Framework

IAB GPP

GPP is the IAB's standard container for privacy signals. Gravito CMP uses it to carry US state privacy choices, through the standard __gpp interface. It runs on the web and in apps through the WebView, from release 6.6.0 in August 2026. Which state sections your deployment uses is confirmed with you during implementation, against the current product.

If you have signed the IAB Multi-State Privacy Agreement (MSPA), Gravito CMP also supports the US national section across the United States. We still recommend running consent with the state-specific sections: it is the better setup.

Release
6.6.0
Interface
__gpp
Signal

Google Consent Mode

Consent Mode tells Google tags, such as Google Analytics and Google Ads, what the visitor has agreed to, and the tags adjust their behaviour. The CMP sets the Consent Mode default before Google tags run and sends an update whenever the visitor's choice changes. All seven Consent Mode v2 signals are covered: ad_storage, analytics_storage, ad_user_data, ad_personalization, functionality_storage, personalization_storage and security_storage. You choose Advanced or Basic mode. In a TCF configuration, the Google signals are pre-mapped to TCF purposes in the configurator; the others map to your own settings.

Consent Mode is sent alongside whichever framework applies, so Google tags read one consistent signal wherever the visitor is.

Two things worth knowing.

  • Consent Mode is not a banner and not a legal compliance solution; it works together with the CMP.
  • And for a publisher's programmatic revenue, the strings that matter are TCF and GPP; Consent Mode governs Google's measurement and advertising tags.

Gravito CMP is on Google's list of certified CMPs, for web and app.

Signal

Microsoft Consent Mode

Microsoft Advertising's UET tag reads one consent property, ad_storage. Granted, UET may read and write its cookies; denied, it does not read or write first-party cookies. In a TCF configuration, ad_storage is pre-mapped to TCF purposes in the configurator; in a Standard configuration, you map it to one of your own categories.

Property
ad_storage
Configurations
TCF and Standard
Signal

Amazon Consent Signal

Amazon Ads reads the IAB TCF signal, and has its own Amazon Consent Signal for passing the visitor's choice without one. Gravito CMP has built-in support for it: where no TCF string is available, the CMP sets both values, amzn_user_data and amzn_ad_storage, from the visitor's marketing choice.

Values
amzn_user_data
amzn_ad_storage
Web and apps

Apps

Apps show the same CMP in a WebView, with GPP together with TCF, GPP on its own, or the Standard CMP. When the visitor saves, the app stores the choice under the standard IAB keys, so the other SDKs in the app can read it.

Consent state

Keeping the record

What the visitor chose is kept, so that every page and every system gets the same answer.

  • 01

    Each framework keeps its own standard record. The TC string for TCF, the GPP string for GPP, and the Standard CMP's consent string for Standard.

  • 02

    Kept server-side, in your first-party context.

  • 03

    Readable on the page. Your scripts can read the current state and listen for the CMP's events when it changes.

  • 04

    Open to change. Visitors can reopen their choices at any time, for example from a link in your footer. When your policy changes, a new configuration version asks every visitor again.

  • 05

    In apps, each save replaces the stored keys as a whole, so a withdrawn signal does not linger.

Regions

The laws the frameworks serve

No regulation defines a consent framework. Frameworks such as IAB TCF and GPP exist because the market built them to meet the regulations. Consent rules differ by country, and the decisioning layer applies the framework or configuration each region needs.

The laws that apply include, among others:

  • EU and EEA

    the General Data Protection Regulation (GDPR), and the ePrivacy Directive's cookie rule (Article 5(3)) as each country applies it.

  • United Kingdom

    UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR) as amended by the Data (Use and Access) Act 2025.

  • United States

    the California Consumer Privacy Act as amended by the California Privacy Rights Act, and the consumer privacy laws of Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah and Virginia, each through its IAB GPP section.

  • Elsewhere

    Canada (PIPEDA and Quebec's Law 25), Brazil (LGPD), Japan (APPI), South Korea (PIPA), Australia (Privacy Act 1988), New Zealand (Privacy Act 2020) and South Africa (POPIA). Several of these have no cookie-specific consent rule; Gravito CMP is configured for what each market needs.

No CMP on its own makes a site compliant. The CMP records the visitor's choice and passes it on; every tag, script and system that receives the signal has to respect it, for the purposes the visitor agreed to. That is the part we work on with you.

Configured with you

Which frameworks a site needs, how its categories map to Google, Microsoft and Amazon, and which regions get which banner: our team works that out during implementation.

Tell us what your sites need to speak.

If you run many sites, brands or templates, across regions and frameworks, we set the frameworks up once and keep them running.

  • Portrait of Patrick Glantz
    Patrick Glantz
    COO
  • Portrait of Jouni Mannerhovi
    Jouni Mannerhovi
    CEO