Building a Native, TCF-compliant, Consent Manager for GDPR, DMA and GPC.

Twitch operates globally, which means complying with a patchwork of privacy regulations—including the GDPR, CCPA, DMA, and the ePrivacy Directive. These laws require clear user consent for data collection, particularly for advertising and tracking.At the time, our approach was fragmented: multiple frontends, unclear messaging, and no unified backend for managing consent states. It left us exposed to compliance risk, created poor user experiences, and made consent auditing nearly impossible.We needed a single, scalable, policy-compliant system for collecting, managing, and honoring user consent.

At Twitch, we built a centralized Consent Management Platform from the ground up—a system crafted to navigate the complex, ever-evolving landscape of global privacy laws while adapting seamlessly to regional legislation. At its core was a high-scale backend service capable of storing and evaluating user consent states in real time. On the front end, we developed a modular banner and modal system, multilingual by design and configurable to meet region-specific legal requirements. The platform integrated with the IAB’s Transparency & Consent Framework (TCF v2), aligning our advertising practices with industry standards.From GDPR to CCPA, the DMA, and the ePrivacy Directive, the platform was built to meet the strictest regulatory demands. Users were offered fine-grained control, with clear opt-in and opt-out options for each category of data use. Consent decisions were instantly propagated across Twitch’s internal systems and to relevant third-party vendors, ensuring consistency and compliance at every touchpoint.But beyond technical compliance, we prioritized user trust. The UX was intentionally simple and transparent, using plain language to explain what data would be collected and why—because building trust means putting users in control, and making that control easy to understand.

The platform consistently delivered 95%+ opt-in rates across global regions, dramatically outperforming industry averages. We achieved IAB TCF certification, enabling transparent, standards-compliant data sharing with advertisers and partners.The service scaled to handle billions of consent events monthly and became a cornerstone of our privacy infrastructure, supporting downstream compliance and enforcement across the Twitch ecosystem.Beyond just meeting the letter of the law, the project demonstrated that compliance and user trust are not at odds—when consent is asked for clearly and respectfully, users are willing to say yes.‍‍