Your Games Portal's Consent Rate Is 79%. The Share You Can Actually Personalise Is 60%.

A games portal's headline consent rate excludes everyone who ignored the banner. The share of European sessions you can actually personalise is nearer 60%. And on a licensed catalogue there is a second leak, because the consent string does not cross into the game's iframe unless somebody builds the bridge. Both gaps are measurable, and both are usually missing from the revenue model.

Two numbers get quoted interchangeably in portal revenue decks. They are not the same number, they are not close, and only one of them has anything to do with what your ad stack can sell.

📊 Two Rates, One Banner, Nineteen Points Apart

Didomi publishes an annual benchmark drawn from its own CMP deployments. The 2026 edition, covering consent interactions collected through 2025 across sixteen industries, breaks the Gaming & Sports category into three figures:

• Consent rate: 79.3%
• Opt-in rate: 60.2%
• No-choice rate: 24.1%

Didomi defines opt-in rate as opt-ins over total banners displayed, and no-choice as the visitors who "neither accept nor refuse, and simply leave the banner unanswered." Do the subtraction and the third bucket falls out: 100 − 60.2 − 24.1 leaves 15.7% who actively refused. Now check the headline: 60.2 ÷ (60.2 + 15.7) = 79.3%. Exactly.

So the 79.3% is a ratio taken among players who interacted with the banner. The quarter of your audience who scrolled past it, hit Escape, or started a game without looking are excluded from the denominator entirely. The same arithmetic reconciles the Media & Publishers row — 82.7% headline, 64.4% opt-in, 22.6% no-choice — to within rounding.

Neither number is dishonest. The consent rate is a legitimate measure of banner persuasiveness. It is simply not the number that multiplies against your impressions.

🧮 Where the Missing Quarter Goes

Under the GDPR, consent has to be an affirmative act. Silence, inactivity, and pre-ticked boxes are not consent. A player who never engaged with the banner is, for ad-serving purposes, indistinguishable from a player who pressed Reject All. They land in the same bucket, and that bucket is 39.8% of your European gaming traffic on the benchmark figures.

That is the number to put in the model. Roughly six in ten European sessions can be monetised with personalised demand. Four in ten cannot.

There is a lever here, and it has a cost. Make the banner blocking — no game until a choice is made — and the no-choice bucket largely disappears, converted into either an opt-in, a refusal, or a bounce. On a portal where the visitor arrived from a search result for one specific game and has no relationship with you, a meaningful share of that 24% converts to bounce rather than to consent. Measure it as a bounce-rate test, not just a consent-rate test, or you will "improve" consent while losing the session.

The regional spread in the same benchmark is worth noting before anyone extrapolates one market to all of Europe. Consent rates ran from 75.1% in Western Europe to 89.3% in Eastern Europe, with opt-in rates between 55.7% and 67.6%. A portal weighted toward Germany and France is at the bottom of that band; one weighted toward Poland and Romania is at the top.

💸 What "No Consent" Costs, and Why Nobody Agrees

No consent does not mean no ad. It means a cheaper one. Google serves non-personalised and limited ads to that traffic, with limited ads running without cookies or local storage. The question is what the discount is, and here the literature is a mess worth knowing about.

Google's own study — Ravichandran and Korula, published by Google in August 2019 — ran a randomised experiment across the top 500 global publishers and reported average revenue down 52% for the group without third-party cookies, with a median per-publisher decline of 64%.

The same year, Marotta, Abhishek and Acquisti presented "Online Tracking and Publishers' Revenues: An Empirical Analysis" at the Workshop on the Economics of Information Security, using transaction-level data from a large US media company. Their finding: cookie-enabled impressions added roughly 4% to publisher revenue.

Fifty-two percent and four percent, same year, same question. The gap is partly methodological — different denominators, different inventory, one side measuring a cookie-blackout condition and the other measuring the marginal premium on matched impressions — and partly that one author had a position to defend. Both papers are now seven years old and predate the entire current consent stack.

You will also see "over 50% revenue loss" quoted in CMP vendor blog posts about migration deadlines. Those are marketing pages for companies selling the fix. Treat the direction as real and the magnitude as unknown until you have measured your own inventory.

The honest planning posture: build the model with a personalised share around 60% of EEA sessions, apply a discount to the rest, and run the discount as a band rather than a point estimate. If your business case only clears at the optimistic end, it does not clear.

🖼️ The Consent String Does Not Cross the Game Frame on Its Own

This is the part specific to licensed catalogues, and it is the one that gets discovered late.

Your CMP runs on your portal. It writes a TC String and exposes a __tcfapi function on the top-level page. Your header bidding, your display units, your analytics — all on your domain, all fine.

The game is not on your domain. On most catalogue deals it is embedded from the licensor's origin, and whatever ad or analytics code the licensor compiled into that build executes inside a cross-origin iframe. Same-origin policy means that code cannot simply read window.top.__tcfapi.

The locator frame is the bridge, and it has to be built

The TCF spec handles this. Per the IAB Tech Lab CMP API specification, a CMP must create an iframe named __tcfapiLocator as a signal to scripts nested in other frames. A vendor inside an iframe walks up the ancestor chain looking for that named frame, then posts a __tcfapiCall object to it and listens for a __tcfapiReturn matched by callId.

Two sentences in that spec do the commercial work. The first: "Publishers must load the CMP in a parent (or ancestor) of all iframes that may need to establish a GDPR legal basis." That obligation is yours, not the licensor's, and it is satisfied by where your CMP loads — which is usually fine, since the game frame sits inside your page.

The second is the failure mode. Where no CMP answers, vendors "should assume 'no consent' and 'no legitimate interest transparency established' in contexts where GDPR applies." Nothing errors. Nothing appears in a dashboard. The in-game ad call simply behaves as if every European player refused.

And the postMessage half of the bridge is code inside the game build. If the licensor's ad SDK does not implement the iframe path — plenty of older HTML5 builds were compiled against a wrapper that only ever ran first-party — your consent never reaches it no matter how correct your side is.

Sandbox the frame and the message arrives from "null"

Portals sandbox game iframes, and they are right to. But a sandbox attribute without allow-same-origin forces the frame into an opaque origin, and messages it posts arrive at the parent with origin: "null". A CMP or wrapper that validates the origin of inbound messages against an allowlist will drop them. The same restriction denies that frame cookies and local storage, so the ad code inside has nowhere to persist anything even if consent did arrive.

This is testable in an afternoon. Load a game, open the console on the parent page, and confirm the frame receives a __tcfapiReturn with a TC String. If it does not, you have found where your European fill went.

🔐 A Certified CMP Is a Serving Condition, Not a Compliance Nicety

Since 16 January 2024, Google has required partners using AdSense, Ad Manager or AdMob to run a Google-certified CMP integrated with the IAB TCF when serving ads in the EEA and UK. Switzerland was added on 31 July 2024. Google's publisher documentation is direct about the consequence: "Only traffic from a certified CMP is eligible for personalized ads."

Read what that does and does not say. Traffic from a certified CMP stays eligible for personalised, non-personalised and limited ads. Traffic without one drops to the cheaper tiers. Google also notes that certification is assessed against Google's own criteria and is not a check for full compliance with the TCF or with privacy law — passing certification is not a legal opinion.

Two framework changes matter for anyone auditing an older integration. TCF v2.2, launched in May 2023, removed legitimate interest as an available legal basis for Purposes 3 through 6 — creating and selecting personalised ad and content profiles. Consent became the only route. Then IAB Europe published v2.3 in June 2025, with a migration window that CMP vendors and IAB guidance placed at 28 February 2026, after which strings built to the older version stop validating. That date has passed. If your portal was integrated years ago and nobody has touched the CMP since, that is an audit item this month, not next year.

⚖️ The Framework Itself Has Been Through Court

Worth knowing, because it explains why the rules keep moving.

In Case C-604/22, decided 7 March 2024, the Court of Justice of the European Union held that the TC String is personal data, because it can be linked back to the end user, and that IAB Europe acts as a joint controller for its processing within the framework — with joint controllership limited to the operations IAB Europe actually influences, not automatically extending down the chain.

The case returned to Belgium, and on 14 May 2025 the Brussels Market Court upheld the infringements the Belgian DPA had identified and reimposed the €250,000 fine on IAB Europe.

Nothing in either judgment makes the TCF unusable, and Google's serving requirement still points at it. The practical read for an operator: the consent layer is the most actively litigated part of your ad stack, so treat "we integrated a CMP once" as a maintenance liability rather than a finished project. It is the same problem as any other dependency in a licensed catalogue — a thing that was correct on the day it shipped and drifts afterward.

🚫 Five Ways Portal Operators Get This Wrong

1. Modelling on the consent rate. Putting 79% into the spreadsheet when the number that multiplies impressions is 60%. That is a third of your assumed personalised inventory, gone before launch.
2. Assuming the game frame inherits consent. It does not. Cross-origin means cross-origin, and the bridge is code that somebody has to have written on both sides.
3. Sandboxing the frame and never testing the consent path. The security posture is right and the side effect is silent. Test it per title, not per portal.
4. Optimising the banner without watching bounce. A blocking wall raises consent rate and can cost you more sessions than it converts, particularly on search traffic landing on a single game page.
5. Treating the CMP as done. Certification requirements, TCF versions and court rulings have all moved since 2023. An integration that has not been reviewed in two years is probably serving a version of the framework that no longer validates.

📝 What to Put in the Catalogue Licence

Most of this belongs in the technical schedule, not the commercial terms, and it costs nothing to ask for at signature.

• A named list of every third-party SDK and network call in each build. You cannot establish a legal basis for vendors you cannot enumerate, and TCF v2.3 pushed disclosed-vendor transparency in exactly this direction.
• A warranty that in-build ad and analytics code implements the TCF iframe path — that it looks for __tcfapiLocator in ancestor frames and honours what comes back.
• Self-hosting rights on the game files. Serving the build from your own origin removes the cross-origin problem outright. This is a licence term, not an engineering choice, and it is far easier to get before signature than after.
• A defined behaviour when consent is absent. The build should degrade to non-personalised serving, not fail to load or silently retry.
• Who is the publisher of record for the in-frame ad call. If the licensor monetises inside the frame, they are the publisher for that impression and the consent obligations follow them, not you. Get it written down.

🌲 Where a Licensed Catalogue Fits

Forestry Games has licensed games since 2017 and its catalogue runs to 1,049 titles across HTML5 and Android, including in-house HTML5 development and work with branded IP. The reason that matters to this topic is unglamorous: when a catalogue comes with the files, a documented list of what each build calls out to, and a licensor who will answer a question about an ad SDK, the consent plumbing is a one-week job. When it comes as a feed of embed URLs pointing at somebody else's domain, it is a permanent tax on your European revenue. Browse the catalogue or the monetization notes if you are sizing this for a specific portal.

🧭 What to Do This Week

Three checks, none of which need a developer for more than a day.

1. Pull your CMP's opt-in rate, not its consent rate, split by market. If your dashboard only shows one number, find out which denominator it uses before you quote it to anyone.
2. Open a game on your live portal and verify the frame receives a TC String. Do it on three titles from different upstream sources — the answer varies by build, not by portal.
3. Confirm your CMP is on Google's certified list and running TCF v2.3. The migration deadline is behind us; an unmigrated integration is losing personalised eligibility right now, quietly.

The revenue difference between doing this and not doing it is not a rounding error, and it is entirely in your control — which is more than can be said for most of the variables in a portal's ad stack.