An IAB vendor is a third-party ad-tech company, such as an ad server, DSP, SSP, or measurement provider. It registers with IAB Europe's Transparency and Consent Framework (TCF). The Global Vendor List (GVL) is the public registry of these verified vendors. It assigns each a unique ID and lists its declared purposes and legal bases.
Publishers running programmatic ads must surface every registered vendor on their consent banner. The GVL is the shared registry a CMP reads to do that, and it is why one vendor registration works across every TCF-compliant site.
What Is an IAB Vendor?
An IAB vendor is a company that does not ordinarily have direct access to a publisher's end users. It still processes their data for advertising or measurement. Vendors include ad servers, demand-side platforms (DSPs), supply-side platforms (SSPs), data management platforms (DMPs), measurement providers, and advertising agencies.
The distinction matters because publishers have direct visitor relationships and CMPs collect consent. Vendors sit one step removed, receiving data through the publisher's site rather than owning the visitor relationship themselves. The GVL groups these vendors by role type.
- Ad servers that decide which ad creative loads and where
- DSPs that buy ad inventory programmatically on an advertiser's behalf
- SSPs that sell a publisher's ad inventory into programmatic auctions
- DMPs that aggregate and segment audience data across sites
- Measurement providers that verify viewability, fraud, and attribution
- Advertising agencies that plan and place campaigns for brands
Every one of these company types must register with IAB Europe and appear on the GVL before a TCF-compliant site can pass them consent signals.
What Is the IAB Global Vendor List (GVL)?
The IAB Global Vendor List (GVL) is the central, public, machine-readable registry of every vendor approved under the IAB Europe Transparency and Consent Framework. Each entry records the vendor's declared purposes, features, and legal bases, which is what lets a publisher collect consent that stands up under GDPR. Every certified consent management platform reads this one shared list to know which vendors exist and what each one is allowed to do.
The GVL is not a static document. IAB Europe publishes it as a live JSON feed that updates as vendors join, update their declarations, or get removed. A CMP downloads the current GVL and matches it against the vendors a publisher has enabled. It then renders those choices in the consent banner or preference center. That single shared source is what makes the framework interoperable instead of proprietary per platform. A vendor never registers separately with each CMP.
Who Manages the Global Vendor List?
IAB Europe is the Managing Organisation that maintains the Global Vendor List. IAB Tech Lab publishes the technical specification the list follows. In IAB Europe's own policy, the GVL is the list of vendors who have registered with IAB Europe to participate in the Framework. CMPs, publishers, and vendors all reference this same list.
IAB Tech Lab, the technical standards arm of the IAB, owns the underlying spec. That spec sets the exact JSON schema, the fields each vendor entry must carry, and how the list is hosted at vendor-list.consensu.org. IAB Europe runs the registry; IAB Tech Lab defines its shape.
What Information Does Each Vendor Declare?
Every vendor entry on the GVL declares a fixed set of fields covering what it does with data and under what legal basis. That structure lets a CMP present accurate consent choices without guessing.
Purposes, Special Purposes, and Features
Each vendor's GVL entry breaks its data use into four declared categories.
- Purposes require visitor consent, such as selecting personalised advertising or measuring ad performance
- Special Purposes don't require separate consent (things like security and fraud prevention)
- Features describe how a vendor processes data technically, like matching and combining offline data sources
- Special Features need explicit opt-in, most commonly precise geolocation
Legal Bases: Consent vs Legitimate Interest
Each vendor declares one of two legal bases per purpose: consent or legitimate interest. Consent means the vendor cannot process data for that purpose until the visitor actively agrees. Legitimate interest lets a vendor process data unless the visitor objects, which historically produced banners with legitimate-interest boxes pre-checked by default.
The current TCF version removed legitimate interest as an option for advertising-related Purposes 3 through 6. Vendors can no longer rely on it for personalised advertising or ad measurement specifically. One r/gdpr user summed up the older frustration directly. Every vendor on the global list, they noted, could pre-tick a legitimate-interest box and claim it applied. That gap is now closed for the purposes it affected most.
How a Vendor Registers and Gets a Vendor ID
A company becomes an IAB vendor by completing IAB Europe's Global Vendor registration and receiving a permanent numeric vendor ID. To register:
- Apply for annual Vendor membership through the TCF registration portal
- Declare every purpose, special purpose, feature, and legal basis the company uses
- Submit the declaration for review and approval by IAB Europe
- Receive a unique vendor ID and inclusion in the next published GVL update
Vendor IDs are incrementally assigned and never reused. When a vendor is removed from the GVL, its entry is marked deleted rather than erased outright. Its number is retired permanently, never handed to a new applicant. That means a vendor ID reliably identifies the same company for as long as the GVL exists, even years after that vendor stops actively participating.
Where to Find the IAB Vendor List (and How CMPs Use It)
The IAB vendor list lives at two official locations: a human-readable page at IAB Europe's site and a machine-readable JSON feed that CMPs download automatically. For a person checking manually, IAB Europe's Vendor List shows every registered vendor by ID, name, country, and data-retention terms, searchable by name or ID.
For software, the canonical machine-readable source is the live GVL JSON feed, republished on a rolling basis as vendors update their registrations. A certified CMP downloads the GVL and handles the signaling for you, the same way it does when you set up Consent Mode. It checks which vendors a site has enabled, cross-references their declared purposes, and encodes the visitor's choices for each one. Once encoded, each vendor is referenced inside the TC String by its numeric ID, not its name, which is why the ID never changing matters.
Publishers outside the EU should also know a regional variant exists: the IAB Canada TCF Vendor List mirrors the same framework for Canadian compliance requirements.
IAB Vendors vs CMPs: What's the Difference?
An IAB vendor processes ad data on a publisher's site; a CMP collects and transmits the visitor's consent choices to those vendors. They are two separate IAB Europe registries with different schemas and different jobs.
| IAB Vendor | CMP | |
|---|---|---|
| Role | Processes ad/measurement data (DSP, SSP, ad server, etc.) | Collects and signals visitor consent choices |
| Appears on which list | Global Vendor List (GVL) | CMP List |
| Has a numeric ID | Yes, a Vendor ID | Yes, a CMP ID |
A publisher's CMP does not become a vendor by using the GVL. A vendor cannot collect consent directly from a visitor either; each role is registered and audited separately by IAB Europe.
The GVL and TCF Versions: GVL v3 Under TCF v2.3
The current framework version is IAB TCF v2.3, and the Global Vendor List runs on specification version GVL v3. The list is versioned alongside the TCF, so the two version numbers move together but do not match. The live GVL feed reports gvlSpecificationVersion 3 and tcfPolicyVersion 5, on TCF Policy Version 2026-05-29.
GVL v3 first arrived with TCF 2.2, which launched on May 16, 2023. That release brought several structural changes to the list.
- Legitimate interest removed as a legal basis for Purposes 3 through 6 (personalised advertising and ad measurement)
- A new
illustrationsfield was added to make vendor purposes clearer to visitors in plain language, replacing legal text with real-use examples - New
dataRetentionanddataCategoriesfields let vendors declare exactly how long they keep data and what categories it covers - A new
urlsfield lets vendors declare multiple privacy-policy and legitimate-interest explanation links, including in different languages - CMPs must disclose the total number of vendors seeking a legal basis on the first layer of the consent banner, so visitors see the full count up front
- The
getTCDataAPI command was deprecated, with vendors required to listen for framework updates through event listeners instead
TCF v2.3 then layered a further refinement on the same GVL v3 base, without incrementing the list's specification number. It makes the Disclosed Vendor segment mandatory in the TC String, closing an ambiguity in how vendors declaring special purposes were represented. The live feed confirms GVL v3 is still the active specification, republished on a rolling basis as vendors update their registrations.
Why the IAB Vendor List Matters for Publishers
Publishers running programmatic ads must surface every registered vendor on their banner and collect a valid per-vendor consent signal. Otherwise, those ad and measurement partners lose their legal basis to process data and the publisher loses that revenue. The GVL makes that surfacing possible at scale. Instead of manually vetting every ad partner, the CMP reads the shared list and handles it automatically.
That scale creates real friction for visitors and publishers alike.
- Banners can list hundreds of vendors at once; one r/revanced user described the opt-out experience directly, "you have to manual go through deselecting 142 vendors" on a single site's configured list
- The pre-ticked legitimate-interest pattern drew direct criticism before TCF v2.3 tightened the rules for advertising purposes specifically
- Google requires sites in the EEA to use a certified CMP for ad requests, which in practice means running a TCF-registered vendor list correctly or losing Google demand entirely
Which consent model actually applies to those vendors depends on the visitor's region. It is an opt-in vs opt-out decision the publisher's CMP has to get right per jurisdiction.
How Consently Signals the IAB TCF and Vendor List
Consently is a consent management platform that supports IAB TCF v2.3. It renders each registered vendor's consent choices to your visitors, then signals those choices onward to the vendors themselves. Every plan includes IAB TCF v2.3 support and Google Consent Mode v2 signaling by default, with no feature-gated upgrade required to turn either on.
Consently is also a Google-certified CMP for Additional Consent (AC v2). AC v2 is the mechanism that passes consent signals to Google demand partners outside Google's own ad products. Alongside IAB TCF signals, Consently also sends Google's Consent Mode v2 states for Google Analytics and Google Ads. A full Google CMP Partner listing is still pending approval, so that specific certification is not yet complete, distinct from the live AC v2 certification.
For the full picture of how the framework fits together beyond the vendor list itself, see what the IAB TCF is. Try Consently free to set up IAB TCF and vendor consent on your own site.
FAQs
What is an IAB vendor?
An IAB vendor is a company registered with IAB Europe's TCF that processes ad data without directly owning the end-user relationship. Examples include ad servers, DSPs, and measurement providers. It must declare its purposes and legal bases and appear on the Global Vendor List.
What does IAB stand for?
IAB stands for Interactive Advertising Bureau, the trade association behind the Transparency and Consent Framework. IAB Europe specifically manages the TCF and the Global Vendor List for the European market and beyond.
What is a vendor in IAB in simple terms?
A vendor is any ad-tech company that touches a visitor's data through a publisher's site but doesn't run that site itself. It has to register, declare what it does with data, and get listed before a compliant banner can pass it consent.
How many vendors are on the IAB Global Vendor List?
The GVL holds well over 1,000 registered vendors, and the count changes constantly as companies register, update, or get removed. No single published source currently agrees on an exact live total. Treat any precise number you see elsewhere as a snapshot, not a fixed figure.
Where can I download the IAB vendor list?
Humans can browse and search it at IAB Europe's Vendor List page. Software reads the machine-readable JSON feed, which republishes on a rolling basis.
What is the difference between the GVL and the CMP list?
The GVL lists ad-tech vendors that process data; the CMP list registers the consent platforms that collect visitor choices. They're separate IAB Europe registries with separate ID schemes.
Is the IAB Global Vendor List the same as the TCF?
No. The GVL is one component of the wider TCF, specifically the registry of approved vendors. The TCF also defines the consent string format, the CMP requirements, and the purpose and legal-basis rules the GVL entries follow.
Can I remove or disable IAB vendors?
Yes, a CMP's preference center lets visitors toggle vendors individually or by category, and publishers configure which vendors appear at all. In practice, opting out of every vendor on a large banner can mean deselecting well over 100 entries one at a time. That friction is a genuine usability complaint from visitors.
What is a TCF vendor ID?
A TCF vendor ID is the permanent numeric identifier assigned when a vendor registers with the GVL. It's referenced inside the TC String instead of the vendor's name, and it's never reused even after a vendor is removed.
