From 8b1eddbd7beada498d92e9b4da11bc7236317c25 Mon Sep 17 00:00:00 2001
From: VasN <pnvasanth@users.noreply.github.com>
Date: Tue, 28 Jul 2026 12:10:58 +0200
Subject: [PATCH] feat: iubenda CMP with TCF consent for ads tracking

Load the iubenda Cookie Solution (TCF mode) for GDPR-covered webapp
users behind the iubenda_cmp flag, mirror its consent into the existing
ilikecookies* cookies, populate the ad tracker consent macros from
__tcfapi, send gdpr/gdpr_consent/addtl_consent on ad requests, attach
the iubenda consent id to analytics events, and forward the stored TC
string to boot via the x-gdpr-consent header.
---
 packages/shared/src/components/Feed.spec.tsx  |  10 +-
 .../cards/ad/common/AdMeasurement.tsx         |  10 +-
 .../features/monetization/adConsent.spec.ts   |  45 ++++---
 .../src/features/monetization/adConsent.ts    |  36 ++---
 .../features/monetization/measurementFrame.ts |   5 +-
 .../monetization/useAdMacroContext.ts         |   9 +-
 .../src/features/monetization/useAdQuery.ts   |   8 +-
 .../src/features/monetization/useFetchAd.ts   |   5 +-
 .../features/monetization/useTcfConsent.ts    |  12 ++
 packages/shared/src/hooks/log/useLogQueue.ts  |   2 +
 .../shared/src/hooks/log/useLogSharedProps.ts |   2 +
 .../shared/src/hooks/useCookieBanner.spec.tsx |  28 ++++
 packages/shared/src/hooks/useCookieBanner.ts  |  10 ++
 packages/shared/src/hooks/useCookieConsent.ts |  12 +-
 packages/shared/src/lib/ads.spec.ts           |  28 ++++
 packages/shared/src/lib/ads.ts                |  46 ++++++-
 packages/shared/src/lib/boot.ts               |   5 +
 packages/shared/src/lib/featureManagement.ts  |   4 +
 packages/shared/src/lib/iubenda.spec.ts       |  12 +-
 packages/shared/src/lib/iubenda.ts            |  15 ++-
 packages/shared/src/lib/tcf.spec.ts           |  91 +++++++++++++
 packages/shared/src/lib/tcf.ts                |  88 ++++++++++++
 packages/webapp/__tests__/BookmarksPage.tsx   |   4 +-
 packages/webapp/__tests__/MyFeedPage.tsx      |   4 +-
 packages/webapp/__tests__/SourcePage.tsx      |   4 +-
 packages/webapp/__tests__/SquadFeedPage.tsx   |   4 +-
 packages/webapp/__tests__/TagPage.tsx         |   4 +-
 packages/webapp/components/Iubenda.tsx        | 127 ++++++++++++++++++
 packages/webapp/pages/_app.tsx                |   2 +
 packages/webapp/pages/embed/mf.tsx            |   8 +-
 packages/webapp/pages/settings/privacy.tsx    |  32 ++++-
 31 files changed, 597 insertions(+), 75 deletions(-)
 create mode 100644 packages/shared/src/features/monetization/useTcfConsent.ts
 create mode 100644 packages/shared/src/lib/tcf.spec.ts
 create mode 100644 packages/shared/src/lib/tcf.ts
 create mode 100644 packages/webapp/components/Iubenda.tsx

diff --git a/packages/shared/src/components/Feed.spec.tsx b/packages/shared/src/components/Feed.spec.tsx
index 38a9653a692..cf216b24fdb 100644
--- a/packages/shared/src/components/Feed.spec.tsx
+++ b/packages/shared/src/components/Feed.spec.tsx
@@ -240,7 +240,9 @@ function renderComponent(
   const resolvedUser = arguments.length < 2 ? defaultUser : user;
 
   mocks.forEach(mockGraphQL);
-  nock('http://localhost:3000').get('/v1/a?active=false').reply(200, [ad]);
+  nock('http://localhost:3000')
+    .get('/v1/a?active=false&gdpr=0')
+    .reply(200, [ad]);
   const settingsContext: SettingsContextData = {
     ...baseSettingsContext,
     setTheme: jest.fn(),
@@ -1807,9 +1809,11 @@ const renderWithHighlightLayout = ({
   mockGraphQL(createFeedMock(buildFeedPage(posts)));
   // First ad page uses active=false, subsequent pages use active=true. Mock
   // both up to a handful of refills so multi-ad scenarios don't run dry.
-  nock('http://localhost:3000').get('/v1/a?active=false').reply(200, [ad]);
   nock('http://localhost:3000')
-    .get('/v1/a?active=true')
+    .get('/v1/a?active=false&gdpr=0')
+    .reply(200, [ad]);
+  nock('http://localhost:3000')
+    .get('/v1/a?active=true&gdpr=0')
     .times(10)
     .reply(200, [ad]);
 
diff --git a/packages/shared/src/components/cards/ad/common/AdMeasurement.tsx b/packages/shared/src/components/cards/ad/common/AdMeasurement.tsx
index 5ff7ed2e986..d05594c18cd 100644
--- a/packages/shared/src/components/cards/ad/common/AdMeasurement.tsx
+++ b/packages/shared/src/components/cards/ad/common/AdMeasurement.tsx
@@ -57,6 +57,8 @@ interface FramedProps {
   tags: AdMeasurementTag[];
   overlay: boolean;
   gdprApplies?: boolean;
+  consentString?: string;
+  addtlConsent?: string;
 }
 
 /**
@@ -68,6 +70,8 @@ const FramedMeasurement = ({
   tags,
   overlay,
   gdprApplies,
+  consentString,
+  addtlConsent,
 }: FramedProps): ReactElement => {
   const iframeRef = useRef<HTMLIFrameElement>(null);
   const [frameReady, setFrameReady] = useState(false);
@@ -106,10 +110,12 @@ const FramedMeasurement = ({
         type: 'init',
         tags,
         gdprApplies,
+        consentString,
+        addtlConsent,
       },
       frameOrigin,
     );
-  }, [frameReady, tags, gdprApplies, frameOrigin]);
+  }, [frameReady, tags, gdprApplies, consentString, addtlConsent, frameOrigin]);
 
   return (
     <iframe
@@ -159,6 +165,8 @@ export const AdMeasurement = ({ ad }: { ad: Ad }): ReactElement | null => {
             tags={tags}
             overlay={overlay}
             gdprApplies={ctx?.gdprApplies}
+            consentString={ctx?.consentString}
+            addtlConsent={ctx?.addtlConsent}
           />
         ) : (
           <InlineMeasurement tags={tags} ctx={ctx} overlay={overlay} />
diff --git a/packages/shared/src/features/monetization/adConsent.spec.ts b/packages/shared/src/features/monetization/adConsent.spec.ts
index 153d18b0c8a..350749a91d6 100644
--- a/packages/shared/src/features/monetization/adConsent.spec.ts
+++ b/packages/shared/src/features/monetization/adConsent.spec.ts
@@ -1,27 +1,40 @@
 import { resolveAdConsent } from './adConsent';
 
-const clearCookies = () => {
-  document.cookie.split(';').forEach((c) => {
-    const name = c.split('=')[0].trim();
-    document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT`;
-  });
-};
-
 describe('resolveAdConsent', () => {
-  beforeEach(clearCookies);
-  afterEach(clearCookies);
-
   it('does not apply GDPR when the user is outside scope', () => {
-    expect(resolveAdConsent(false).gdprApplies).toBe(false);
+    expect(resolveAdConsent(false)).toEqual({
+      gdprApplies: false,
+      consentString: undefined,
+      addtlConsent: undefined,
+    });
     expect(resolveAdConsent(undefined).gdprApplies).toBe(false);
   });
 
-  it('applies GDPR for an in-scope user who has not consented', () => {
-    expect(resolveAdConsent(true).gdprApplies).toBe(true);
+  it('applies GDPR without a consent string for an in-scope user before the CMP answers', () => {
+    expect(resolveAdConsent(true)).toEqual({
+      gdprApplies: true,
+      consentString: undefined,
+      addtlConsent: undefined,
+    });
+  });
+
+  it('uses the TCF snapshot when available', () => {
+    expect(
+      resolveAdConsent(true, {
+        gdprApplies: true,
+        tcString: 'tc-string',
+        addtlConsent: '1~1.2',
+      }),
+    ).toEqual({
+      gdprApplies: true,
+      consentString: 'tc-string',
+      addtlConsent: '1~1.2',
+    });
   });
 
-  it('treats an in-scope user who accepted marketing cookies as consented', () => {
-    document.cookie = 'ilikecookies_marketing=true';
-    expect(resolveAdConsent(true).gdprApplies).toBe(false);
+  it('prefers the TCF gdprApplies over the geo fallback', () => {
+    expect(resolveAdConsent(true, { gdprApplies: false }).gdprApplies).toBe(
+      false,
+    );
   });
 });
diff --git a/packages/shared/src/features/monetization/adConsent.ts b/packages/shared/src/features/monetization/adConsent.ts
index 53b70bc545d..14ab900852b 100644
--- a/packages/shared/src/features/monetization/adConsent.ts
+++ b/packages/shared/src/features/monetization/adConsent.ts
@@ -1,29 +1,17 @@
-import { getIubendaConsent } from '../../lib/iubenda';
-import { getCookies } from '../../lib/cookie';
-import { isExtension } from '../../lib/func';
-import { GdprConsentKey } from '../../hooks/useCookieBanner';
+import type { TcfConsent } from '../../lib/tcf';
 import type { AdMacroContext } from './adMacros';
 
 /**
- * Resolves ad-measurement consent from the user's first-party cookie choice.
- * Accepted marketing cookies or outside GDPR scope → `gdpr=0` and measurement
- * proceeds; in scope without consent → `gdpr=1`, which tags treat as
- * not-consented. The extension is treated as consented (accepted on install),
- * mirroring `useConsentCookie`.
+ * Consent context for ad tracker macros. `gdprApplies` states whether GDPR
+ * applies to this user (regardless of their choice); the TC string carries
+ * the actual consent. In scope without a TC string, vendors must treat the
+ * request as not-consented.
  */
-export const hasMarketingConsent = (): boolean => {
-  if (isExtension) {
-    return true;
-  }
-
-  if (getIubendaConsent()?.marketing) {
-    return true;
-  }
-
-  const key = GdprConsentKey.Marketing;
-  return !!getCookies([key])?.[key];
-};
-
-export const resolveAdConsent = (isGdprCovered?: boolean): AdMacroContext => ({
-  gdprApplies: !!isGdprCovered && !hasMarketingConsent(),
+export const resolveAdConsent = (
+  isGdprCovered?: boolean,
+  tcf?: TcfConsent,
+): AdMacroContext => ({
+  gdprApplies: tcf?.gdprApplies ?? !!isGdprCovered,
+  consentString: tcf?.tcString,
+  addtlConsent: tcf?.addtlConsent,
 });
diff --git a/packages/shared/src/features/monetization/measurementFrame.ts b/packages/shared/src/features/monetization/measurementFrame.ts
index 4e39897d33e..10087366327 100644
--- a/packages/shared/src/features/monetization/measurementFrame.ts
+++ b/packages/shared/src/features/monetization/measurementFrame.ts
@@ -30,8 +30,11 @@ export interface MeasurementInitMessage {
   type: 'init';
   tags: AdMeasurementTag[];
   // Resolved by the parent from the user's consent state; when true the frame
-  // emits gdpr=1 and the tags skip measurement.
+  // emits gdpr=1 and the tags skip measurement unless a consent string grants
+  // it. The extension parent never sets the strings (no CMP there).
   gdprApplies?: boolean;
+  consentString?: string;
+  addtlConsent?: string;
 }
 
 export const isMeasurementReadyMessage = (
diff --git a/packages/shared/src/features/monetization/useAdMacroContext.ts b/packages/shared/src/features/monetization/useAdMacroContext.ts
index 9d2b65b94ed..f2331e1f9ee 100644
--- a/packages/shared/src/features/monetization/useAdMacroContext.ts
+++ b/packages/shared/src/features/monetization/useAdMacroContext.ts
@@ -2,17 +2,20 @@ import { useMemo } from 'react';
 import { useAuthContext } from '../../contexts/AuthContext';
 import type { AdMacroContext } from './adMacros';
 import { resolveAdConsent } from './adConsent';
+import { useTcfConsent } from './useTcfConsent';
 
 /**
  * Resolves the consent context used to fill ad tracker macros. Shared by
  * `AdPixel` and `AdMeasurement`. Returns null while disabled (i.e. the ad
- * isn't near the viewport yet).
+ * isn't near the viewport yet). Recomputes when the CMP reports a consent
+ * change.
  */
 export const useAdMacroContext = (enabled: boolean): AdMacroContext | null => {
   const { isGdprCovered } = useAuthContext();
+  const tcf = useTcfConsent();
 
   return useMemo(
-    () => (enabled ? resolveAdConsent(isGdprCovered) : null),
-    [enabled, isGdprCovered],
+    () => (enabled ? resolveAdConsent(isGdprCovered, tcf) : null),
+    [enabled, isGdprCovered, tcf],
   );
 };
diff --git a/packages/shared/src/features/monetization/useAdQuery.ts b/packages/shared/src/features/monetization/useAdQuery.ts
index 16f4ed21041..3d4266fc339 100644
--- a/packages/shared/src/features/monetization/useAdQuery.ts
+++ b/packages/shared/src/features/monetization/useAdQuery.ts
@@ -6,6 +6,7 @@ import type { Ad } from '../../graphql/posts';
 import { fetchAdByPlacement, resolveAdFetchOptions } from '../../lib/ads';
 import type { FetchAdByPlacementOptions } from '../../lib/ads';
 import { featurePostBoostAds } from '../../lib/featureManagement';
+import { useAdMacroContext } from './useAdMacroContext';
 
 interface UseAdQueryOptions {
   queryKey: QueryKey;
@@ -23,18 +24,21 @@ export const useAdQuery = ({
   active,
 }: UseAdQueryOptions) => {
   const boostsEnabled = useFeature(featurePostBoostAds);
+  const consent = useAdMacroContext(enabled);
   const fetchOptions = useMemo(
     () =>
       resolveAdFetchOptions({
         placement,
         active,
         boostsEnabled,
+        consent: consent ?? undefined,
       }),
-    [placement, active, boostsEnabled],
+    [placement, active, boostsEnabled, consent],
   );
 
   return useQuery<Ad | null>({
-    queryKey,
+    // consent fingerprint so ads refetch when the user answers the CMP banner
+    queryKey: [...queryKey, consent?.gdprApplies, consent?.consentString ?? ''],
     queryFn: () => fetchAdByPlacement(fetchOptions),
     enabled,
     staleTime,
diff --git a/packages/shared/src/features/monetization/useFetchAd.ts b/packages/shared/src/features/monetization/useFetchAd.ts
index 43b528f8f06..9f54d589624 100644
--- a/packages/shared/src/features/monetization/useFetchAd.ts
+++ b/packages/shared/src/features/monetization/useFetchAd.ts
@@ -7,6 +7,7 @@ import {
   resolveAdFetchOptions,
 } from '../../lib/ads';
 import { featurePostBoostAds } from '../../lib/featureManagement';
+import { useAdMacroContext } from './useAdMacroContext';
 
 interface UseFetchAds {
   fetchAd: (params: {
@@ -17,6 +18,7 @@ interface UseFetchAds {
 
 export const useFetchAd = (): UseFetchAds => {
   const boostsEnabled = useFeature(featurePostBoostAds);
+  const consent = useAdMacroContext(true);
 
   const fetchAdQuery: UseFetchAds['fetchAd'] = useCallback(
     ({ active, placement = AdPlacement.Feed }) => {
@@ -25,10 +27,11 @@ export const useFetchAd = (): UseFetchAds => {
           placement,
           active,
           boostsEnabled,
+          consent: consent ?? undefined,
         }),
       );
     },
-    [boostsEnabled],
+    [boostsEnabled, consent],
   );
 
   return {
diff --git a/packages/shared/src/features/monetization/useTcfConsent.ts b/packages/shared/src/features/monetization/useTcfConsent.ts
new file mode 100644
index 00000000000..d1deb6ce2f9
--- /dev/null
+++ b/packages/shared/src/features/monetization/useTcfConsent.ts
@@ -0,0 +1,12 @@
+import { useSyncExternalStore } from 'react';
+import type { TcfConsent } from '../../lib/tcf';
+import { getTcfSnapshot, subscribeTcf } from '../../lib/tcf';
+
+const getServerSnapshot = (): TcfConsent | undefined => undefined;
+
+/**
+ * Reactive view over the CMP's TCF consent state. Undefined until the CMP
+ * loads and the user's consent is known (extension and SSR stay undefined).
+ */
+export const useTcfConsent = (): TcfConsent | undefined =>
+  useSyncExternalStore(subscribeTcf, getTcfSnapshot, getServerSnapshot);
diff --git a/packages/shared/src/hooks/log/useLogQueue.ts b/packages/shared/src/hooks/log/useLogQueue.ts
index f8761de1077..81b0b480e6b 100644
--- a/packages/shared/src/hooks/log/useLogQueue.ts
+++ b/packages/shared/src/hooks/log/useLogQueue.ts
@@ -14,6 +14,8 @@ export interface LogEvent extends Record<string, unknown> {
   extra?: string;
   device_id?: string;
   cookies?: string;
+  // iubenda consent-record correlator (see getIubendaConsent)
+  consent_id?: string;
 }
 
 export type PushToQueueFunc = (events: LogEvent[]) => void;
diff --git a/packages/shared/src/hooks/log/useLogSharedProps.ts b/packages/shared/src/hooks/log/useLogSharedProps.ts
index 300e132581f..29499fd4dfb 100644
--- a/packages/shared/src/hooks/log/useLogSharedProps.ts
+++ b/packages/shared/src/hooks/log/useLogSharedProps.ts
@@ -5,6 +5,7 @@ import type { LogEvent } from './useLogQueue';
 import SettingsContext from '../../contexts/SettingsContext';
 import AuthContext from '../../contexts/AuthContext';
 import { getCookies } from '../../lib/cookie';
+import { getIubendaConsent } from '../../lib/iubenda';
 
 const COOKIES = ['_ga', '_fbp', '_fbc', 'gbuuid'];
 
@@ -76,6 +77,7 @@ export default function useLogSharedProps(
         visit_id: visitId,
         device_id: _deviceId,
         cookies: cookies === '{}' ? undefined : cookies,
+        consent_id: getIubendaConsent()?.consentId,
       };
       setSharedPropsSet(true);
     });
diff --git a/packages/shared/src/hooks/useCookieBanner.spec.tsx b/packages/shared/src/hooks/useCookieBanner.spec.tsx
index 69d3533468e..3dfba48789a 100644
--- a/packages/shared/src/hooks/useCookieBanner.spec.tsx
+++ b/packages/shared/src/hooks/useCookieBanner.spec.tsx
@@ -8,6 +8,7 @@ import { useConsentCookie } from './useCookieConsent';
 import { useAuthContext } from '../contexts/AuthContext';
 import { getIubendaConsent } from '../lib/iubenda';
 import { isIOSNative } from '../lib/func';
+import { useFeature } from '../components/GrowthBookProvider';
 
 jest.mock('./useCookieConsent', () => ({
   useConsentCookie: jest.fn(),
@@ -26,6 +27,10 @@ jest.mock('../lib/func', () => ({
   isIOSNative: jest.fn(),
 }));
 
+jest.mock('../components/GrowthBookProvider', () => ({
+  useFeature: jest.fn(),
+}));
+
 const mockUseConsentCookie = useConsentCookie as jest.MockedFunction<
   typeof useConsentCookie
 >;
@@ -36,6 +41,7 @@ const mockGetIubendaConsent = getIubendaConsent as jest.MockedFunction<
   typeof getIubendaConsent
 >;
 const mockIsIOSNative = isIOSNative as jest.MockedFunction<typeof isIOSNative>;
+const mockUseFeature = useFeature as jest.MockedFunction<typeof useFeature>;
 
 const saveCookies = jest.fn();
 
@@ -65,6 +71,7 @@ describe('useCookieBanner', () => {
   beforeEach(() => {
     jest.clearAllMocks();
     mockIsIOSNative.mockReturnValue(false);
+    mockUseFeature.mockReturnValue(false);
     localStorage.clear();
   });
 
@@ -134,6 +141,27 @@ describe('useCookieBanner', () => {
     expect(localStorage.getItem('cookie_acknowledged')).toBe('true');
   });
 
+  it('suppresses the homegrown banner for GDPR users when the iubenda CMP is on', () => {
+    setup({ isGdprCovered: true, user: null });
+    mockUseFeature.mockReturnValue(true);
+    mockGetIubendaConsent.mockReturnValue(undefined);
+
+    const { result } = renderHook(() => useCookieBanner());
+
+    expect(saveCookies).not.toHaveBeenCalled();
+    expect(result.current.showBanner).toBe(false);
+  });
+
+  it('keeps the homegrown banner for non-GDPR users when the iubenda CMP is on', () => {
+    setup({ isGdprCovered: false, user: null });
+    mockUseFeature.mockReturnValue(true);
+    mockGetIubendaConsent.mockReturnValue(undefined);
+
+    const { result } = renderHook(() => useCookieBanner());
+
+    expect(result.current.showBanner).toBe(true);
+  });
+
   it('uses the marketing consent key for the additional cookie', () => {
     expect(otherGdprConsents).toEqual([GdprConsentKey.Marketing]);
   });
diff --git a/packages/shared/src/hooks/useCookieBanner.ts b/packages/shared/src/hooks/useCookieBanner.ts
index f10cf2e3102..c08ae7df668 100644
--- a/packages/shared/src/hooks/useCookieBanner.ts
+++ b/packages/shared/src/hooks/useCookieBanner.ts
@@ -4,6 +4,8 @@ import type { AcceptCookiesCallback } from './useCookieConsent';
 import { useConsentCookie } from './useCookieConsent';
 import { isIOSNative } from '../lib/func';
 import { getIubendaConsent } from '../lib/iubenda';
+import { useFeature } from '../components/GrowthBookProvider';
+import { featureIubendaCmp } from '../lib/featureManagement';
 
 export const cookieAcknowledgedKey = 'cookie_acknowledged';
 
@@ -42,6 +44,7 @@ interface UseCookieBanner {
 
 export function useCookieBanner(): UseCookieBanner {
   const { isAuthReady, user, isGdprCovered } = useAuthContext();
+  const iubendaCmp = useFeature(featureIubendaCmp);
   const isInitializedRef = useRef(false);
   const [isOpen, setIsOpen] = useState(false);
   const { saveCookies, cookieExists: hasAccepted } = useConsentCookie(
@@ -73,6 +76,12 @@ export function useCookieBanner(): UseCookieBanner {
       }
     }
 
+    // iubenda owns the banner for GDPR-covered users when the CMP is on; its
+    // consent is mirrored into our cookies by the Iubenda component.
+    if (iubendaCmp && isGdprCovered) {
+      return;
+    }
+
     if (!isGdprCovered) {
       if (hasAccepted) {
         return;
@@ -112,6 +121,7 @@ export function useCookieBanner(): UseCookieBanner {
     user,
     hasAccepted,
     isGdprCovered,
+    iubendaCmp,
   ]);
 
   return {
diff --git a/packages/shared/src/hooks/useCookieConsent.ts b/packages/shared/src/hooks/useCookieConsent.ts
index bf78dc58c5a..36c95376ef6 100644
--- a/packages/shared/src/hooks/useCookieConsent.ts
+++ b/packages/shared/src/hooks/useCookieConsent.ts
@@ -67,6 +67,14 @@ export const useConsentCookie = (key: string): UseConsentCookie => {
     [client],
   );
 
+  const onCookieRemoved = useCallback(
+    (cacheKey: string) => {
+      expireBrowserCookie(cacheKey);
+      client.setQueryData(['cookie', cacheKey], false);
+    },
+    [client],
+  );
+
   const saveCookies: AcceptCookiesCallback = useCallback(
     (additional, toRemove) => {
       if (isExtension) {
@@ -82,10 +90,10 @@ export const useConsentCookie = (key: string): UseConsentCookie => {
       }
 
       if (toRemove) {
-        toRemove.forEach(expireBrowserCookie);
+        toRemove.forEach(onCookieRemoved);
       }
     },
-    [key, onCookieAccepted, isExtension],
+    [key, onCookieAccepted, onCookieRemoved, isExtension],
   );
 
   return { saveCookies, cookieExists: exists };
diff --git a/packages/shared/src/lib/ads.spec.ts b/packages/shared/src/lib/ads.spec.ts
index e629a088ddb..2aef5b5bc8e 100644
--- a/packages/shared/src/lib/ads.spec.ts
+++ b/packages/shared/src/lib/ads.spec.ts
@@ -97,5 +97,33 @@ describe('ads', () => {
         { credentials: 'include' },
       );
     });
+
+    it('should append IAB consent params when a consent context is provided', async () => {
+      await fetchAdByPlacement({
+        placement: AdPlacement.Feed,
+        consent: {
+          gdprApplies: true,
+          consentString: 'tc-string',
+          addtlConsent: '1~1.2',
+        },
+      });
+
+      expect(global.fetch).toHaveBeenCalledWith(
+        'http://localhost:3000/v1/a?active=false&gdpr=1&gdpr_consent=tc-string&addtl_consent=1%7E1.2',
+        { credentials: 'include' },
+      );
+    });
+
+    it('should send gdpr=0 without consent strings outside GDPR scope', async () => {
+      await fetchAdByPlacement({
+        placement: AdPlacement.PostComment,
+        consent: { gdprApplies: false },
+      });
+
+      expect(global.fetch).toHaveBeenCalledWith(
+        'http://localhost:3000/v1/a/post?gdpr=0',
+        { credentials: 'include' },
+      );
+    });
   });
 });
diff --git a/packages/shared/src/lib/ads.ts b/packages/shared/src/lib/ads.ts
index fed26654a64..2e464bbe7b0 100644
--- a/packages/shared/src/lib/ads.ts
+++ b/packages/shared/src/lib/ads.ts
@@ -1,5 +1,6 @@
 import { apiUrl } from './config';
 import type { Ad } from '../graphql/posts';
+import type { AdMacroContext } from '../features/monetization/adMacros';
 
 export enum AdActions {
   Click = 'click',
@@ -19,8 +20,31 @@ export interface FetchAdByPlacementOptions {
   active?: boolean;
   allowPostBoost?: boolean;
   allowSquadBoost?: boolean;
+  consent?: AdMacroContext;
 }
 
+// IAB-standard consent params; the ad server promotes them to typed request
+// metadata, so names must match its extraction (gdpr, gdpr_consent,
+// addtl_consent).
+const appendConsentParams = (
+  params: URLSearchParams,
+  consent?: AdMacroContext,
+): URLSearchParams => {
+  if (typeof consent?.gdprApplies !== 'undefined') {
+    params.set('gdpr', consent.gdprApplies ? '1' : '0');
+  }
+
+  if (consent?.consentString) {
+    params.set('gdpr_consent', consent.consentString);
+  }
+
+  if (consent?.addtlConsent) {
+    params.set('addtl_consent', consent.addtlConsent);
+  }
+
+  return params;
+};
+
 const skadiGenerationIdHeader = 'x-generation-id';
 
 const addGenerationIdHeader = ({
@@ -66,18 +90,21 @@ export const resolveAdFetchOptions = ({
   placement = AdPlacement.Feed,
   active,
   boostsEnabled = false,
+  consent,
 }: {
   placement?: AdPlacement;
   active?: boolean;
   boostsEnabled?: boolean;
+  consent?: AdMacroContext;
 }): FetchAdByPlacementOptions => {
   switch (placement) {
     case AdPlacement.PostComment:
-      return { placement };
+      return { placement, consent };
     case AdPlacement.SquadDirectory:
       return {
         placement,
         allowSquadBoost: true,
+        consent,
       };
     case AdPlacement.PostSidebar:
     case AdPlacement.Feed:
@@ -87,6 +114,7 @@ export const resolveAdFetchOptions = ({
         active,
         allowPostBoost: boostsEnabled,
         allowSquadBoost: boostsEnabled,
+        consent,
       };
   }
 };
@@ -96,17 +124,24 @@ export const fetchAdByPlacement = async ({
   active = false,
   allowPostBoost = false,
   allowSquadBoost = false,
+  consent,
 }: FetchAdByPlacementOptions): Promise<Ad | null> => {
   switch (placement) {
     case AdPlacement.PostComment:
-      return fetchAdRequest({ path: '/v1/a/post' });
+      return fetchAdRequest({
+        path: '/v1/a/post',
+        params: appendConsentParams(new URLSearchParams(), consent),
+      });
     case AdPlacement.SquadDirectory: {
       const params = new URLSearchParams();
       if (allowSquadBoost) {
         params.set('allow_squad_boost', 'true');
       }
 
-      return fetchAdRequest({ path: '/v1/a/squads_directory', params });
+      return fetchAdRequest({
+        path: '/v1/a/squads_directory',
+        params: appendConsentParams(params, consent),
+      });
     }
     case AdPlacement.PostSidebar:
     case AdPlacement.Feed:
@@ -123,7 +158,10 @@ export const fetchAdByPlacement = async ({
         params.append('allow_squad_boost', 'true');
       }
 
-      return fetchAdRequest({ path: '/v1/a', params });
+      return fetchAdRequest({
+        path: '/v1/a',
+        params: appendConsentParams(params, consent),
+      });
     }
   }
 };
diff --git a/packages/shared/src/lib/boot.ts b/packages/shared/src/lib/boot.ts
index e9967e847f8..7d20a90c96b 100644
--- a/packages/shared/src/lib/boot.ts
+++ b/packages/shared/src/lib/boot.ts
@@ -13,6 +13,7 @@ import type {
 import type { Feed } from '../graphql/feed';
 import type { Continent } from './geo';
 import type { EngagementCreative } from './engagementAds';
+import { getStoredTcString } from './tcf';
 
 interface NotificationsBootData {
   unreadNotificationsCount: number;
@@ -162,12 +163,16 @@ export async function getBootData({
   pathname,
 }: GetBootDataParams): Promise<Boot> {
   const bootURL = getBootURL(app, url, pathname);
+  // Stored by the CMP's TCF listener on a previous page view — the CMP script
+  // loads after boot fires, so the live __tcfapi is never available here.
+  const tcString = getStoredTcString();
   const res = await fetch(bootURL, {
     method: 'GET',
     credentials: 'include',
     headers: {
       app,
       'Content-Type': 'application/json',
+      ...(tcString && { 'x-gdpr-consent': tcString }),
       ...(cookies && { Cookie: cookies }),
     },
   });
diff --git a/packages/shared/src/lib/featureManagement.ts b/packages/shared/src/lib/featureManagement.ts
index a7d61e52f0f..426b8f27096 100644
--- a/packages/shared/src/lib/featureManagement.ts
+++ b/packages/shared/src/lib/featureManagement.ts
@@ -121,6 +121,10 @@ export const featureStreakFreeze = new Feature('streak_freeze', isDevelopment);
 // does not necessarily mean they can't boost a post if they have access to cores
 export const featurePostBoostAds = new Feature('post_boost_ads', isDevelopment);
 
+// iubenda CMP (TCF banner) for GDPR-covered users; when on, iubenda owns the
+// cookie banner and the homegrown one is suppressed for those users
+export const featureIubendaCmp = new Feature('iubenda_cmp', false);
+
 export const briefCardFeedFeature = new Feature(
   'brief_card_feed',
   isDevelopment,
diff --git a/packages/shared/src/lib/iubenda.spec.ts b/packages/shared/src/lib/iubenda.spec.ts
index 11099dde1a7..f5cddaf6279 100644
--- a/packages/shared/src/lib/iubenda.spec.ts
+++ b/packages/shared/src/lib/iubenda.spec.ts
@@ -73,6 +73,16 @@ describe('getIubendaConsent', () => {
   it('should parse the url-encoded fixture from the ticket', () => {
     setCookieValue(ticketFixture);
 
-    expect(getIubendaConsent()).toEqual({ necessary: true, marketing: true });
+    expect(getIubendaConsent()).toEqual({
+      necessary: true,
+      marketing: true,
+      consentId: '831c24',
+    });
+  });
+
+  it('should leave consentId unset when the cookie has no cons record', () => {
+    setCookieValue(encode({ '1': true, '5': true }));
+
+    expect(getIubendaConsent()?.consentId).toBeUndefined();
   });
 });
diff --git a/packages/shared/src/lib/iubenda.ts b/packages/shared/src/lib/iubenda.ts
index b77fbf7b867..37fd80e708b 100644
--- a/packages/shared/src/lib/iubenda.ts
+++ b/packages/shared/src/lib/iubenda.ts
@@ -3,9 +3,13 @@ import { getCookies } from './cookie';
 interface IubendaConsent {
   necessary: boolean;
   marketing: boolean;
+  // Correlates with iubenda's consent log for this consent record. Comes from
+  // `cons.rand` in the `_iub_cs-*` cookie; the top-level `id` is the cookie
+  // policy id, not a per-consent identifier.
+  consentId?: string;
 }
 
-export const getIubendaConsent = (): IubendaConsent | undefined => {
+const getRawIubendaCookie = (): string | undefined => {
   const policyId = process.env.NEXT_PUBLIC_IUBENDA_POLICY_ID;
 
   if (!policyId) {
@@ -13,18 +17,23 @@ export const getIubendaConsent = (): IubendaConsent | undefined => {
   }
 
   const name = `_iub_cs-${policyId}`;
-  const raw = getCookies([name])?.[name];
+  return getCookies([name])?.[name];
+};
+
+export const getIubendaConsent = (): IubendaConsent | undefined => {
+  const raw = getRawIubendaCookie();
 
   if (!raw) {
     return undefined;
   }
 
   try {
-    const { purposes } = JSON.parse(raw);
+    const { purposes, cons } = JSON.parse(raw);
 
     return {
       necessary: purposes?.['1'] === true,
       marketing: purposes?.['5'] === true,
+      consentId: typeof cons?.rand === 'string' ? cons.rand : undefined,
     };
   } catch {
     return undefined;
diff --git a/packages/shared/src/lib/tcf.spec.ts b/packages/shared/src/lib/tcf.spec.ts
new file mode 100644
index 00000000000..7b7dc7b153f
--- /dev/null
+++ b/packages/shared/src/lib/tcf.spec.ts
@@ -0,0 +1,91 @@
+/* eslint-disable no-underscore-dangle -- __tcfapi is the IAB-mandated global */
+import type * as TcfModuleType from './tcf';
+
+type TcfListener = (tcData: Record<string, unknown>, success: boolean) => void;
+
+type TcfModule = typeof TcfModuleType;
+
+describe('tcf store', () => {
+  let tcfListener: TcfListener | undefined;
+
+  const loadStore = async (): Promise<TcfModule> => {
+    jest.resetModules();
+    const store = (await import('./tcf')) as TcfModule;
+    store.startTcfSubscription();
+    return store;
+  };
+
+  beforeEach(() => {
+    localStorage.clear();
+    tcfListener = undefined;
+    (globalThis.window as { __tcfapi?: unknown }).__tcfapi = (
+      command: string,
+      version: number,
+      callback: TcfListener,
+    ) => {
+      tcfListener = callback;
+    };
+  });
+
+  afterEach(() => {
+    delete (globalThis.window as { __tcfapi?: unknown }).__tcfapi;
+  });
+
+  it('updates the snapshot and mirrors the tc string on user action', async () => {
+    const store = await loadStore();
+    const listener = jest.fn();
+    store.subscribeTcf(listener);
+
+    tcfListener?.(
+      {
+        eventStatus: 'useractioncomplete',
+        gdprApplies: true,
+        tcString: 'tc-string',
+        addtlConsent: '1~1.2',
+      },
+      true,
+    );
+
+    expect(store.getTcfSnapshot()).toEqual({
+      gdprApplies: true,
+      tcString: 'tc-string',
+      addtlConsent: '1~1.2',
+    });
+    expect(store.getStoredTcString()).toBe('tc-string');
+    expect(listener).toHaveBeenCalled();
+  });
+
+  it('ignores unsuccessful callbacks and irrelevant event statuses', async () => {
+    const store = await loadStore();
+
+    tcfListener?.({ eventStatus: 'useractioncomplete', tcString: 'x' }, false);
+    tcfListener?.({ eventStatus: 'cmpuishown', tcString: 'y' }, true);
+
+    expect(store.getTcfSnapshot()).toBeUndefined();
+    expect(store.getStoredTcString()).toBeUndefined();
+  });
+
+  it('clears the stored tc string when consent is withdrawn to empty', async () => {
+    const store = await loadStore();
+
+    tcfListener?.(
+      { eventStatus: 'useractioncomplete', tcString: 'tc-string' },
+      true,
+    );
+    tcfListener?.(
+      { eventStatus: 'useractioncomplete', gdprApplies: true },
+      true,
+    );
+
+    expect(store.getStoredTcString()).toBeUndefined();
+    expect(store.getTcfSnapshot()?.tcString).toBeUndefined();
+  });
+
+  it('does not subscribe when __tcfapi is absent', async () => {
+    delete (globalThis.window as { __tcfapi?: unknown }).__tcfapi;
+    const store = await loadStore();
+
+    expect(tcfListener).toBeUndefined();
+    expect(store.getTcfSnapshot()).toBeUndefined();
+  });
+});
diff --git a/packages/shared/src/lib/tcf.ts b/packages/shared/src/lib/tcf.ts
new file mode 100644
index 00000000000..baf00434869
--- /dev/null
+++ b/packages/shared/src/lib/tcf.ts
@@ -0,0 +1,88 @@
+/* eslint-disable no-underscore-dangle -- __tcfapi is the IAB-mandated global */
+/**
+ * Minimal store over the IAB TCF v2 API (`__tcfapi`) exposed by the CMP
+ * (iubenda). Keeps the latest consent snapshot for synchronous consumers (ad
+ * macros, ad requests) and mirrors the TC string into localStorage so the
+ * next boot request can send it — the CMP script loads after boot fires.
+ * No-op wherever `__tcfapi` is absent (extension, SSR, CMP disabled).
+ */
+
+export type TcfConsent = {
+  gdprApplies?: boolean;
+  tcString?: string;
+  addtlConsent?: string;
+};
+
+type TcData = TcfConsent & {
+  eventStatus?: string;
+  listenerId?: number;
+};
+
+type TcfApi = (
+  command: 'addEventListener',
+  version: 2,
+  callback: (tcData: TcData, success: boolean) => void,
+) => void;
+
+declare global {
+  interface Window {
+    __tcfapi?: TcfApi;
+  }
+}
+
+export const TCF_STORAGE_KEY = 'dd:tcf';
+
+let snapshot: TcfConsent | undefined;
+let subscribed = false;
+const listeners = new Set<() => void>();
+
+const onTcData = (tcData: TcData, success: boolean): void => {
+  if (
+    !success ||
+    !['tcloaded', 'useractioncomplete'].includes(tcData.eventStatus ?? '')
+  ) {
+    return;
+  }
+
+  snapshot = {
+    gdprApplies: tcData.gdprApplies,
+    tcString: tcData.tcString,
+    addtlConsent: tcData.addtlConsent,
+  };
+
+  try {
+    if (snapshot.tcString) {
+      globalThis?.localStorage?.setItem(TCF_STORAGE_KEY, snapshot.tcString);
+    } else {
+      globalThis?.localStorage?.removeItem(TCF_STORAGE_KEY);
+    }
+  } catch {
+    // storage unavailable (quota/private mode): the boot header is skipped
+  }
+
+  listeners.forEach((listener) => listener());
+};
+
+export const startTcfSubscription = (): void => {
+  if (subscribed || typeof globalThis.window?.__tcfapi !== 'function') {
+    return;
+  }
+
+  subscribed = true;
+  globalThis.window.__tcfapi('addEventListener', 2, onTcData);
+};
+
+export const subscribeTcf = (callback: () => void): (() => void) => {
+  listeners.add(callback);
+  return () => listeners.delete(callback);
+};
+
+export const getTcfSnapshot = (): TcfConsent | undefined => snapshot;
+
+export const getStoredTcString = (): string | undefined => {
+  try {
+    return globalThis?.localStorage?.getItem(TCF_STORAGE_KEY) || undefined;
+  } catch {
+    return undefined;
+  }
+};
diff --git a/packages/webapp/__tests__/BookmarksPage.tsx b/packages/webapp/__tests__/BookmarksPage.tsx
index 23eba403857..edc969c7146 100644
--- a/packages/webapp/__tests__/BookmarksPage.tsx
+++ b/packages/webapp/__tests__/BookmarksPage.tsx
@@ -75,7 +75,9 @@ function renderComponent(
   client = new QueryClient();
 
   mocks.forEach(mockGraphQL);
-  nock('http://localhost:3000').get('/v1/a?active=false').reply(200, [ad]);
+  nock('http://localhost:3000')
+    .get('/v1/a?active=false&gdpr=0')
+    .reply(200, [ad]);
 
   return render(
     <TestBootProvider client={client} auth={{ user: resolvedUser }}>
diff --git a/packages/webapp/__tests__/MyFeedPage.tsx b/packages/webapp/__tests__/MyFeedPage.tsx
index 66f5150a5ca..5debd7a2c7f 100644
--- a/packages/webapp/__tests__/MyFeedPage.tsx
+++ b/packages/webapp/__tests__/MyFeedPage.tsx
@@ -97,7 +97,9 @@ function renderComponent(
   client = new QueryClient();
 
   mocks.forEach(mockGraphQL);
-  nock('http://localhost:3000').get('/v1/a?active=false').reply(200, [ad]);
+  nock('http://localhost:3000')
+    .get('/v1/a?active=false&gdpr=0')
+    .reply(200, [ad]);
   return render(
     <TestBootProvider
       client={client}
diff --git a/packages/webapp/__tests__/SourcePage.tsx b/packages/webapp/__tests__/SourcePage.tsx
index 7685244bb8f..d4ccfc7d35a 100644
--- a/packages/webapp/__tests__/SourcePage.tsx
+++ b/packages/webapp/__tests__/SourcePage.tsx
@@ -129,7 +129,9 @@ const renderComponent = (
   client = new QueryClient();
 
   mocks.forEach(mockGraphQL);
-  nock('http://localhost:3000').get('/v1/a?active=false').reply(200, [ad]);
+  nock('http://localhost:3000')
+    .get('/v1/a?active=false&gdpr=0')
+    .reply(200, [ad]);
   const settingsContext: SettingsContextData = {
     spaciness: 'eco',
     openNewTab: true,
diff --git a/packages/webapp/__tests__/SquadFeedPage.tsx b/packages/webapp/__tests__/SquadFeedPage.tsx
index 680f6b2677e..477889dd536 100644
--- a/packages/webapp/__tests__/SquadFeedPage.tsx
+++ b/packages/webapp/__tests__/SquadFeedPage.tsx
@@ -241,7 +241,9 @@ const renderComponent = (
   client = new QueryClient();
 
   mocks.forEach(mockGraphQL);
-  nock('http://localhost:3000').get('/v1/a?active=false').reply(200, [ad]);
+  nock('http://localhost:3000')
+    .get('/v1/a?active=false&gdpr=0')
+    .reply(200, [ad]);
 
   return render(
     <TestBootProvider
diff --git a/packages/webapp/__tests__/TagPage.tsx b/packages/webapp/__tests__/TagPage.tsx
index 1b5335a865e..e0d5daec3b3 100644
--- a/packages/webapp/__tests__/TagPage.tsx
+++ b/packages/webapp/__tests__/TagPage.tsx
@@ -155,7 +155,9 @@ const renderComponent = (
 
   (mocks ?? [createFeedMock(), createTagsSettingsMock()]).forEach(mockGraphQL);
   mockGraphQL(createArchiveIndexMock());
-  nock('http://localhost:3000').get('/v1/a?active=false').reply(200, [ad]);
+  nock('http://localhost:3000')
+    .get('/v1/a?active=false&gdpr=0')
+    .reply(200, [ad]);
   const settingsContext: SettingsContextData = {
     spaciness: 'eco',
     openNewTab: true,
diff --git a/packages/webapp/components/Iubenda.tsx b/packages/webapp/components/Iubenda.tsx
new file mode 100644
index 00000000000..ec8bc14ea52
--- /dev/null
+++ b/packages/webapp/components/Iubenda.tsx
@@ -0,0 +1,127 @@
+/* eslint-disable no-underscore-dangle -- _iub is iubenda's mandated global */
+import type { ReactElement } from 'react';
+import { useEffect, useRef } from 'react';
+import { useAuthContext } from '@dailydotdev/shared/src/contexts/AuthContext';
+import { useFeature } from '@dailydotdev/shared/src/components/GrowthBookProvider';
+import { featureIubendaCmp } from '@dailydotdev/shared/src/lib/featureManagement';
+import {
+  cookieAcknowledgedKey,
+  GdprConsentKey,
+  otherGdprConsents,
+} from '@dailydotdev/shared/src/hooks/useCookieBanner';
+import { useConsentCookie } from '@dailydotdev/shared/src/hooks/useCookieConsent';
+import { isIOSNative } from '@dailydotdev/shared/src/lib/func';
+import { startTcfSubscription } from '@dailydotdev/shared/src/lib/tcf';
+
+/**
+ * Loads the iubenda Cookie Solution (IAB TCF mode) for GDPR-covered users and
+ * mirrors its consent into the first-party `ilikecookies*` cookies so all
+ * existing gating (Pixels, settings, ad consent fallback) keeps working.
+ * The homegrown banner is suppressed for these users in `useCookieBanner`.
+ */
+
+type IubendaPreference = {
+  purposes?: Record<string, boolean>;
+};
+
+type IubendaWindow = typeof globalThis & {
+  _iub?: {
+    csConfiguration?: Record<string, unknown>;
+    cs?: { api?: { openPreferences?: () => void } };
+  };
+};
+
+const IUBENDA_SCRIPTS = [
+  'https://cdn.iubenda.com/cs/tcf/stub-v2.js',
+  'https://cdn.iubenda.com/cs/tcf/safe-tcf-v2.js',
+  'https://cdn.iubenda.com/cs/iubenda_cs.js',
+];
+
+export const openIubendaPreferences = (): boolean => {
+  const api = (globalThis as IubendaWindow)._iub?.cs?.api;
+
+  if (!api?.openPreferences) {
+    return false;
+  }
+
+  api.openPreferences();
+  return true;
+};
+
+export const Iubenda = (): ReactElement | null => {
+  const { isAuthReady, isGdprCovered, isFunnel } = useAuthContext();
+  const cmpEnabled = useFeature(featureIubendaCmp);
+  const { saveCookies } = useConsentCookie(GdprConsentKey.Necessary);
+  const injectedRef = useRef(false);
+
+  // The config callback must not go stale when React re-renders.
+  const onPreferenceRef = useRef<(pref: IubendaPreference) => void>();
+  onPreferenceRef.current = (pref) => {
+    const marketing = pref?.purposes?.['5'] === true;
+    saveCookies(
+      marketing ? otherGdprConsents : [],
+      marketing ? [] : otherGdprConsents,
+    );
+    globalThis?.localStorage?.setItem(cookieAcknowledgedKey, 'true');
+  };
+
+  const enabled =
+    isAuthReady && isGdprCovered && cmpEnabled && !isFunnel && !isIOSNative();
+
+  useEffect(() => {
+    if (!enabled || injectedRef.current) {
+      return;
+    }
+
+    const win = globalThis as IubendaWindow;
+
+    if (win._iub?.csConfiguration) {
+      return;
+    }
+
+    injectedRef.current = true;
+
+    win._iub = win._iub || {};
+    win._iub.csConfiguration = {
+      siteId: Number(process.env.NEXT_PUBLIC_IUBENDA_SITE_ID),
+      cookiePolicyId: Number(process.env.NEXT_PUBLIC_IUBENDA_POLICY_ID),
+      lang: 'en',
+      enableTcf: true,
+      googleAdditionalConsentMode: true,
+      perPurposeConsent: true,
+      askConsentAtCookiePolicyUpdate: true,
+      invalidateConsentWithoutLog: true,
+      // consent cookie shared across *.daily.dev, matching the existing
+      // `_iub_cs-*` bridge from the marketing homepage
+      localConsentDomain: process.env.NEXT_PUBLIC_DOMAIN,
+      floatingPreferencesButtonDisplay: false,
+      banner: {
+        position: 'float-bottom-center',
+        acceptButtonDisplay: true,
+        rejectButtonDisplay: true,
+        customizeButtonDisplay: true,
+        closeButtonDisplay: false,
+        listPurposes: true,
+      },
+      callback: {
+        onPreferenceExpressed: (pref: IubendaPreference) =>
+          onPreferenceRef.current?.(pref),
+      },
+    };
+
+    IUBENDA_SCRIPTS.forEach((src) => {
+      const script = document.createElement('script');
+      script.src = src;
+      // dynamically injected scripts default to async; force in-order
+      // execution — iubenda requires the TCF stub before the core script
+      script.async = false;
+      document.head.appendChild(script);
+    });
+
+    // The stub queues __tcfapi calls until the core script loads, so the
+    // subscription can start immediately.
+    startTcfSubscription();
+  }, [enabled]);
+
+  return null;
+};
diff --git a/packages/webapp/pages/_app.tsx b/packages/webapp/pages/_app.tsx
index ada55763638..3026cad70c8 100644
--- a/packages/webapp/pages/_app.tsx
+++ b/packages/webapp/pages/_app.tsx
@@ -60,6 +60,7 @@ import Seo, { defaultSeo, defaultSeoTitle, robotsProps } from '../next-seo';
 import useWebappVersion from '../hooks/useWebappVersion';
 import { getAppOrigin, getSiteOrigin } from '../lib/seo';
 import { PixelsProvider } from '../context/PixelsContext';
+import { Iubenda } from '../components/Iubenda';
 
 structuredCloneJsonPolyfill();
 
@@ -485,6 +486,7 @@ function InternalApp({ Component, pageProps, router }: AppProps): ReactElement {
             trigger={loginState?.trigger}
           />
         )}
+        {!isImageGenerator && <Iubenda />}
         {showBanner && !isFunnel && !isImageGenerator && (
           <CookieBanner
             onAccepted={onAcceptCookies}
diff --git a/packages/webapp/pages/embed/mf.tsx b/packages/webapp/pages/embed/mf.tsx
index 933c50333f5..ed61dc7fbfc 100644
--- a/packages/webapp/pages/embed/mf.tsx
+++ b/packages/webapp/pages/embed/mf.tsx
@@ -56,8 +56,12 @@ export default function MeasurementFrame(): ReactElement {
         return;
       }
 
-      const { tags, gdprApplies } = event.data;
-      injectMeasurementTags(document.body, tags, { gdprApplies });
+      const { tags, gdprApplies, consentString, addtlConsent } = event.data;
+      injectMeasurementTags(document.body, tags, {
+        gdprApplies,
+        consentString,
+        addtlConsent,
+      });
     };
 
     globalThis.addEventListener('message', onMessage);
diff --git a/packages/webapp/pages/settings/privacy.tsx b/packages/webapp/pages/settings/privacy.tsx
index 3530d363158..598b750b569 100644
--- a/packages/webapp/pages/settings/privacy.tsx
+++ b/packages/webapp/pages/settings/privacy.tsx
@@ -17,6 +17,11 @@ import {
 import { GdprConsentKey } from '@dailydotdev/shared/src/hooks/useCookieBanner';
 import { CookieConsentItem } from '@dailydotdev/shared/src/components/modals/user/CookieConsentItem';
 import { useConsentCookie } from '@dailydotdev/shared/src/hooks/useCookieConsent';
+import { useFeature } from '@dailydotdev/shared/src/components/GrowthBookProvider';
+import { featureIubendaCmp } from '@dailydotdev/shared/src/lib/featureManagement';
+import { Button } from '@dailydotdev/shared/src/components/buttons/Button';
+import { ButtonVariant } from '@dailydotdev/shared/src/components/buttons/common';
+import { openIubendaPreferences } from '../../components/Iubenda';
 import AccountContentSection from '../../components/layouts/SettingsLayout/AccountContentSection';
 import { AccountPageContainer } from '../../components/layouts/SettingsLayout/AccountPageContainer';
 import { getSettingsLayout } from '../../components/layouts/SettingsLayout';
@@ -33,6 +38,7 @@ const AccountInvitePage = (): ReactElement | null => {
   const router = useRouter();
   const { saveCookies } = useConsentCookie(GdprConsentKey.Marketing);
   const { user, isAuthReady, isGdprCovered } = useAuthContext();
+  const iubendaCmp = useFeature(featureIubendaCmp);
 
   useEffect(() => {
     if (!isAuthReady) {
@@ -90,13 +96,25 @@ const AccountInvitePage = (): ReactElement | null => {
           >
             Cookie Policy →
           </Typography>
-          <div className="mt-4 flex flex-col gap-4">
-            <CookieConsentItem consent={GdprConsentKey.Necessary} />
-            <CookieConsentItem
-              consent={GdprConsentKey.Marketing}
-              onToggle={onToggleMarketing}
-            />
-          </div>
+          {iubendaCmp ? (
+            // the custom toggles can't regenerate a TCF consent string, so
+            // consent edits must go through the CMP's own preferences UI
+            <Button
+              className="mt-4 self-start"
+              variant={ButtonVariant.Secondary}
+              onClick={() => openIubendaPreferences()}
+            >
+              Manage cookie preferences
+            </Button>
+          ) : (
+            <div className="mt-4 flex flex-col gap-4">
+              <CookieConsentItem consent={GdprConsentKey.Necessary} />
+              <CookieConsentItem
+                consent={GdprConsentKey.Marketing}
+                onToggle={onToggleMarketing}
+              />
+            </div>
+          )}
         </AccountContentSection>
       )}
       <AccountContentSection