Under the IAB Transparency & Consent Framework (TCF), every vendor on the Global Vendor List (GVL) declares which purposes it processes data for, and which legal basis it relies on for each one: consent or legitimate interest. By default, your consent management platform (CMP) accepts those declarations as written.
Publisher restrictions let you override a vendor's declaration on your site, one vendor and one purpose at a time. You can block a vendor from a purpose entirely, or require it to use a specific legal basis. Restrictions are signaled to vendors in the consent string, and TCF-registered vendors are required to honor them.
Publishers typically use publisher restrictions to:
- Require consent, rather than legitimate interest, for purposes your legal team considers higher-risk, such as building advertising profiles.
- Stop a vendor from processing for one specific purpose without removing that vendor from your vendor list altogether.
- Apply a contractual or policy position with a particular partner consistently across every visitor.
Restriction Types
|
Restriction |
What it means |
|---|---|
|
Not allowed (0) |
The vendor cannot process data for that purpose at all, regardless of the legal basis it declared. |
|
Require consent (1) |
The vendor may only rely on consent for that purpose. If it declared legitimate interest, that basis is overridden. |
|
Require legitimate interest (2) |
The vendor may only rely on legitimate interest for that purpose. If it declared consent, that basis is overridden. |
Require consent and Require legitimate interest only change a vendor's legal basis when that vendor has declared the purpose as flexible on the GVL, meaning it has told the IAB it can operate under either basis. If a vendor has not declared a purpose as flexible, your Admiral dashboard shows a warning beneath that purpose. The restriction is still saved, but it may not be written into the consent string. Not allowed applies to any purpose a vendor declares.
Setting Up Publisher Restrictions
- In your Admiral dashboard, go to Privacy & Consent → Europe and click Appearance to open the consent editor.
- Select the Vendors tab in the right-hand panel.
- Scroll to the Restricted vendors panel.
- Search for a vendor by name or by its GVL vendor ID, then select it from the results.
- The vendor expands to show each purpose it has declared on the GVL. For each purpose you want to restrict, choose a restriction from the dropdown. Purposes left at None — no restriction keep the vendor's own declaration.
- Repeat for any other vendors. The panel header shows how many restrictions you have set and across how many vendors. To remove every restriction for one vendor, expand it and click Clear this vendor.
- Decide whether existing visitors should see the consent prompt again. After you change restrictions, a Require re-consent for these changes checkbox appears. Restriction changes alone do not update consent strings that visitors already have. If you check this box, visitors who last gave consent before today are asked to consent again, and their new consent string carries your restrictions.
- Click Save.
What Visitors See
The consent prompt does not display a separate notice listing your publisher restrictions. Instead, a restricted vendor's consent and legitimate interest controls in the partners view reflect the outcome of your restrictions. For example, a vendor that is Not allowed for a purpose will not be recorded as permitted for that purpose, even if the visitor clicks Accept all.
To keep the consent cookie small(er), Admiral only writes a restriction into the consent string when it changes the outcome for that vendor. A restriction you have saved may therefore not appear when you inspect a consent string.
Verification
- Open your site in a private or incognito browser window from a location where the consent prompt is shown (a VPN to an EU country may be required).
- Make a consent choice in the prompt, then open Our partners and find the restricted vendor. Its controls should reflect the restriction you set.
- To confirm the signal directly, open your browser's developer console and run:
__tcfapi('getTCData', 2, (tcData) => console.log(tcData.publisher.restrictions));
The output lists restrictions by purpose, then vendor ID, then restriction type (0, 1, or 2). Restrictions that do not change a vendor's outcome are omitted, as described above.
Further Configuration
If you would like assistance deciding which restrictions to apply, or with advanced configuration such as custom vendor lists and Additional Consent Mode, please reach out to CustomerLove@getadmiral.com.