diff --git a/packages/shared/src/components/cards/ad/common/AdMeasurement.tsx b/packages/shared/src/components/cards/ad/common/AdMeasurement.tsx
index 5ff7ed2e986..d05594c18cd 100644
--- a/packages/shared/src/components/cards/ad/common/AdMeasurement.tsx
+++ b/packages/shared/src/components/cards/ad/common/AdMeasurement.tsx
@@ -57,6 +57,8 @@ interface FramedProps {
   tags: AdMeasurementTag[];
   overlay: boolean;
   gdprApplies?: boolean;
+  consentString?: string;
+  addtlConsent?: string;
 }
 
 /**
@@ -68,6 +70,8 @@ const FramedMeasurement = ({
   tags,
   overlay,
   gdprApplies,
+  consentString,
+  addtlConsent,
 }: FramedProps): ReactElement => {
   const iframeRef = useRef<HTMLIFrameElement>(null);
   const [frameReady, setFrameReady] = useState(false);
@@ -106,10 +110,12 @@ const FramedMeasurement = ({
         type: 'init',
         tags,
         gdprApplies,
+        consentString,
+        addtlConsent,
       },
       frameOrigin,
     );
-  }, [frameReady, tags, gdprApplies, frameOrigin]);
+  }, [frameReady, tags, gdprApplies, consentString, addtlConsent, frameOrigin]);
 
   return (
     <iframe
@@ -159,6 +165,8 @@ export const AdMeasurement = ({ ad }: { ad: Ad }): ReactElement | null => {
             tags={tags}
             overlay={overlay}
             gdprApplies={ctx?.gdprApplies}
+            consentString={ctx?.consentString}
+            addtlConsent={ctx?.addtlConsent}
           />
         ) : (
           <InlineMeasurement tags={tags} ctx={ctx} overlay={overlay} />
diff --git a/packages/shared/src/features/monetization/adConsent.spec.ts b/packages/shared/src/features/monetization/adConsent.spec.ts
index 153d18b0c8a..02f5c035248 100644
--- a/packages/shared/src/features/monetization/adConsent.spec.ts
+++ b/packages/shared/src/features/monetization/adConsent.spec.ts
@@ -11,17 +11,42 @@ describe('resolveAdConsent', () => {
   beforeEach(clearCookies);
   afterEach(clearCookies);
 
-  it('does not apply GDPR when the user is outside scope', () => {
-    expect(resolveAdConsent(false).gdprApplies).toBe(false);
-    expect(resolveAdConsent(undefined).gdprApplies).toBe(false);
-  });
+  describe('without CMP (legacy compatibility)', () => {
+    it('does not apply GDPR when the user is outside scope', () => {
+      expect(resolveAdConsent(false).gdprApplies).toBe(false);
+      expect(resolveAdConsent(undefined).gdprApplies).toBe(false);
+    });
+
+    it('applies GDPR for an in-scope user who has not consented', () => {
+      expect(resolveAdConsent(true)).toEqual({ gdprApplies: true });
+    });
 
-  it('applies GDPR for an in-scope user who has not consented', () => {
-    expect(resolveAdConsent(true).gdprApplies).toBe(true);
+    it('treats an in-scope user who accepted marketing cookies as consented', () => {
+      document.cookie = 'ilikecookies_marketing=true';
+      expect(resolveAdConsent(true).gdprApplies).toBe(false);
+    });
   });
 
-  it('treats an in-scope user who accepted marketing cookies as consented', () => {
-    document.cookie = 'ilikecookies_marketing=true';
-    expect(resolveAdConsent(true).gdprApplies).toBe(false);
+  describe('with CMP (TCF) data', () => {
+    it('uses the TCF snapshot, ignoring the legacy cookie', () => {
+      document.cookie = 'ilikecookies_marketing=true';
+      expect(
+        resolveAdConsent(true, {
+          gdprApplies: true,
+          tcString: 'tc-string',
+          addtlConsent: '1~1.2',
+        }),
+      ).toEqual({
+        gdprApplies: true,
+        consentString: 'tc-string',
+        addtlConsent: '1~1.2',
+      });
+    });
+
+    it('prefers the TCF gdprApplies over the geo fallback', () => {
+      expect(resolveAdConsent(true, { gdprApplies: false }).gdprApplies).toBe(
+        false,
+      );
+    });
   });
 });
diff --git a/packages/shared/src/features/monetization/adConsent.ts b/packages/shared/src/features/monetization/adConsent.ts
index 53b70bc545d..d8cd7fda932 100644
--- a/packages/shared/src/features/monetization/adConsent.ts
+++ b/packages/shared/src/features/monetization/adConsent.ts
@@ -2,13 +2,12 @@ import { getIubendaConsent } from '../../lib/iubenda';
 import { getCookies } from '../../lib/cookie';
 import { isExtension } from '../../lib/func';
 import { GdprConsentKey } from '../../hooks/useCookieBanner';
+import type { TcfConsent } from '../../lib/tcf';
 import type { AdMacroContext } from './adMacros';
 
 /**
- * Resolves ad-measurement consent from the user's first-party cookie choice.
- * Accepted marketing cookies or outside GDPR scope → `gdpr=0` and measurement
- * proceeds; in scope without consent → `gdpr=1`, which tags treat as
- * not-consented. The extension is treated as consented (accepted on install),
+ * Whether the user granted marketing consent through the first-party cookie
+ * flow. The extension is treated as consented (accepted on install),
  * mirroring `useConsentCookie`.
  */
 export const hasMarketingConsent = (): boolean => {
@@ -24,6 +23,26 @@ export const hasMarketingConsent = (): boolean => {
   return !!getCookies([key])?.[key];
 };
 
-export const resolveAdConsent = (isGdprCovered?: boolean): AdMacroContext => ({
-  gdprApplies: !!isGdprCovered && !hasMarketingConsent(),
-});
+/**
+ * Consent context for ad tracker macros. With CMP (TCF) data, `gdprApplies`
+ * states whether GDPR applies to this user and the TC string carries the
+ * actual consent. Without it (CMP flag off, extension), the pre-TCF
+ * compatibility behavior applies: first-party marketing consent or being out
+ * of GDPR scope → `gdpr=0` and measurement proceeds; in scope without
+ * consent → `gdpr=1`, which tags treat as not-consented. Keep the fallback
+ * until the CMP is rolled out to everyone.
+ */
+export const resolveAdConsent = (
+  isGdprCovered?: boolean,
+  tcf?: TcfConsent,
+): AdMacroContext => {
+  if (typeof tcf?.gdprApplies !== 'undefined' || tcf?.tcString) {
+    return {
+      gdprApplies: tcf.gdprApplies,
+      consentString: tcf.tcString,
+      addtlConsent: tcf.addtlConsent,
+    };
+  }
+
+  return { gdprApplies: !!isGdprCovered && !hasMarketingConsent() };
+};
diff --git a/packages/shared/src/features/monetization/measurementFrame.ts b/packages/shared/src/features/monetization/measurementFrame.ts
index 4e39897d33e..10087366327 100644
--- a/packages/shared/src/features/monetization/measurementFrame.ts
+++ b/packages/shared/src/features/monetization/measurementFrame.ts
@@ -30,8 +30,11 @@ export interface MeasurementInitMessage {
   type: 'init';
   tags: AdMeasurementTag[];
   // Resolved by the parent from the user's consent state; when true the frame
-  // emits gdpr=1 and the tags skip measurement.
+  // emits gdpr=1 and the tags skip measurement unless a consent string grants
+  // it. The extension parent never sets the strings (no CMP there).
   gdprApplies?: boolean;
+  consentString?: string;
+  addtlConsent?: string;
 }
 
 export const isMeasurementReadyMessage = (
diff --git a/packages/shared/src/features/monetization/useAdMacroContext.ts b/packages/shared/src/features/monetization/useAdMacroContext.ts
index 9d2b65b94ed..f2331e1f9ee 100644
--- a/packages/shared/src/features/monetization/useAdMacroContext.ts
+++ b/packages/shared/src/features/monetization/useAdMacroContext.ts
@@ -2,17 +2,20 @@ import { useMemo } from 'react';
 import { useAuthContext } from '../../contexts/AuthContext';
 import type { AdMacroContext } from './adMacros';
 import { resolveAdConsent } from './adConsent';
+import { useTcfConsent } from './useTcfConsent';
 
 /**
  * Resolves the consent context used to fill ad tracker macros. Shared by
  * `AdPixel` and `AdMeasurement`. Returns null while disabled (i.e. the ad
- * isn't near the viewport yet).
+ * isn't near the viewport yet). Recomputes when the CMP reports a consent
+ * change.
  */
 export const useAdMacroContext = (enabled: boolean): AdMacroContext | null => {
   const { isGdprCovered } = useAuthContext();
+  const tcf = useTcfConsent();
 
   return useMemo(
-    () => (enabled ? resolveAdConsent(isGdprCovered) : null),
-    [enabled, isGdprCovered],
+    () => (enabled ? resolveAdConsent(isGdprCovered, tcf) : null),
+    [enabled, isGdprCovered, tcf],
   );
 };
diff --git a/packages/shared/src/features/monetization/useAdQuery.ts b/packages/shared/src/features/monetization/useAdQuery.ts
index 16f4ed21041..634ce132c65 100644
--- a/packages/shared/src/features/monetization/useAdQuery.ts
+++ b/packages/shared/src/features/monetization/useAdQuery.ts
@@ -5,7 +5,11 @@ import { useFeature } from '../../components/GrowthBookProvider';
 import type { Ad } from '../../graphql/posts';
 import { fetchAdByPlacement, resolveAdFetchOptions } from '../../lib/ads';
 import type { FetchAdByPlacementOptions } from '../../lib/ads';
-import { featurePostBoostAds } from '../../lib/featureManagement';
+import {
+  featureIubendaCmp,
+  featurePostBoostAds,
+} from '../../lib/featureManagement';
+import { useAdMacroContext } from './useAdMacroContext';
 
 interface UseAdQueryOptions {
   queryKey: QueryKey;
@@ -23,18 +27,25 @@ export const useAdQuery = ({
   active,
 }: UseAdQueryOptions) => {
   const boostsEnabled = useFeature(featurePostBoostAds);
+  const cmpEnabled = useFeature(featureIubendaCmp);
+  const macroContext = useAdMacroContext(enabled);
+  // consent params ride on ad requests only for CMP users; with the flag off
+  // the request is byte-identical to the pre-CMP one
+  const consent = cmpEnabled ? macroContext ?? undefined : undefined;
   const fetchOptions = useMemo(
     () =>
       resolveAdFetchOptions({
         placement,
         active,
         boostsEnabled,
+        consent,
       }),
-    [placement, active, boostsEnabled],
+    [placement, active, boostsEnabled, consent],
   );
 
   return useQuery<Ad | null>({
-    queryKey,
+    // consent fingerprint so ads refetch when the user answers the CMP banner
+    queryKey: [...queryKey, consent?.gdprApplies, consent?.consentString ?? ''],
     queryFn: () => fetchAdByPlacement(fetchOptions),
     enabled,
     staleTime,
diff --git a/packages/shared/src/features/monetization/useFetchAd.ts b/packages/shared/src/features/monetization/useFetchAd.ts
index 43b528f8f06..b03d976abe8 100644
--- a/packages/shared/src/features/monetization/useFetchAd.ts
+++ b/packages/shared/src/features/monetization/useFetchAd.ts
@@ -6,7 +6,11 @@ import {
   fetchAdByPlacement,
   resolveAdFetchOptions,
 } from '../../lib/ads';
-import { featurePostBoostAds } from '../../lib/featureManagement';
+import {
+  featureIubendaCmp,
+  featurePostBoostAds,
+} from '../../lib/featureManagement';
+import { useAdMacroContext } from './useAdMacroContext';
 
 interface UseFetchAds {
   fetchAd: (params: {
@@ -17,6 +21,11 @@ interface UseFetchAds {
 
 export const useFetchAd = (): UseFetchAds => {
   const boostsEnabled = useFeature(featurePostBoostAds);
+  const cmpEnabled = useFeature(featureIubendaCmp);
+  const macroContext = useAdMacroContext(true);
+  // consent params ride on ad requests only for CMP users; with the flag off
+  // the request is byte-identical to the pre-CMP one
+  const consent = cmpEnabled ? macroContext ?? undefined : undefined;
 
   const fetchAdQuery: UseFetchAds['fetchAd'] = useCallback(
     ({ active, placement = AdPlacement.Feed }) => {
@@ -25,10 +34,11 @@ export const useFetchAd = (): UseFetchAds => {
           placement,
           active,
           boostsEnabled,
+          consent,
         }),
       );
     },
-    [boostsEnabled],
+    [boostsEnabled, consent],
   );
 
   return {
diff --git a/packages/shared/src/features/monetization/useTcfConsent.ts b/packages/shared/src/features/monetization/useTcfConsent.ts
new file mode 100644
index 00000000000..d1deb6ce2f9
--- /dev/null
+++ b/packages/shared/src/features/monetization/useTcfConsent.ts
@@ -0,0 +1,12 @@
+import { useSyncExternalStore } from 'react';
+import type { TcfConsent } from '../../lib/tcf';
+import { getTcfSnapshot, subscribeTcf } from '../../lib/tcf';
+
+const getServerSnapshot = (): TcfConsent | undefined => undefined;
+
+/**
+ * Reactive view over the CMP's TCF consent state. Undefined until the CMP
+ * loads and the user's consent is known (extension and SSR stay undefined).
+ */
+export const useTcfConsent = (): TcfConsent | undefined =>
+  useSyncExternalStore(subscribeTcf, getTcfSnapshot, getServerSnapshot);
diff --git a/packages/shared/src/hooks/log/useLogQueue.ts b/packages/shared/src/hooks/log/useLogQueue.ts
index f8761de1077..81b0b480e6b 100644
--- a/packages/shared/src/hooks/log/useLogQueue.ts
+++ b/packages/shared/src/hooks/log/useLogQueue.ts
@@ -14,6 +14,8 @@ export interface LogEvent extends Record<string, unknown> {
   extra?: string;
   device_id?: string;
   cookies?: string;
+  // iubenda consent-record correlator (see getIubendaConsent)
+  consent_id?: string;
 }
 
 export type PushToQueueFunc = (events: LogEvent[]) => void;
diff --git a/packages/shared/src/hooks/log/useLogSharedProps.ts b/packages/shared/src/hooks/log/useLogSharedProps.ts
index 300e132581f..c1ad3b82b86 100644
--- a/packages/shared/src/hooks/log/useLogSharedProps.ts
+++ b/packages/shared/src/hooks/log/useLogSharedProps.ts
@@ -5,6 +5,9 @@ import type { LogEvent } from './useLogQueue';
 import SettingsContext from '../../contexts/SettingsContext';
 import AuthContext from '../../contexts/AuthContext';
 import { getCookies } from '../../lib/cookie';
+import { getIubendaConsent } from '../../lib/iubenda';
+import { useFeature } from '../../components/GrowthBookProvider';
+import { featureIubendaCmp } from '../../lib/featureManagement';
 
 const COOKIES = ['_ga', '_fbp', '_fbc', 'gbuuid'];
 
@@ -18,6 +21,7 @@ export default function useLogSharedProps(
   const { query } = useRouter();
   const { themeMode, spaciness, insaneMode } = useContext(SettingsContext);
   const { visit, anonymous, tokenRefreshed, user } = useContext(AuthContext);
+  const iubendaCmp = useFeature(featureIubendaCmp);
   const [sharedPropsSet, setSharedPropsSet] = useState(false);
 
   const [visitId, setVisitId] = useState<string>();
@@ -76,6 +80,7 @@ export default function useLogSharedProps(
         visit_id: visitId,
         device_id: _deviceId,
         cookies: cookies === '{}' ? undefined : cookies,
+        consent_id: iubendaCmp ? getIubendaConsent()?.consentId : undefined,
       };
       setSharedPropsSet(true);
     });
diff --git a/packages/shared/src/hooks/useCookieBanner.spec.tsx b/packages/shared/src/hooks/useCookieBanner.spec.tsx
index 69d3533468e..3dfba48789a 100644
--- a/packages/shared/src/hooks/useCookieBanner.spec.tsx
+++ b/packages/shared/src/hooks/useCookieBanner.spec.tsx
@@ -8,6 +8,7 @@ import { useConsentCookie } from './useCookieConsent';
 import { useAuthContext } from '../contexts/AuthContext';
 import { getIubendaConsent } from '../lib/iubenda';
 import { isIOSNative } from '../lib/func';
+import { useFeature } from '../components/GrowthBookProvider';
 
 jest.mock('./useCookieConsent', () => ({
   useConsentCookie: jest.fn(),
@@ -26,6 +27,10 @@ jest.mock('../lib/func', () => ({
   isIOSNative: jest.fn(),
 }));
 
+jest.mock('../components/GrowthBookProvider', () => ({
+  useFeature: jest.fn(),
+}));
+
 const mockUseConsentCookie = useConsentCookie as jest.MockedFunction<
   typeof useConsentCookie
 >;
@@ -36,6 +41,7 @@ const mockGetIubendaConsent = getIubendaConsent as jest.MockedFunction<
   typeof getIubendaConsent
 >;
 const mockIsIOSNative = isIOSNative as jest.MockedFunction<typeof isIOSNative>;
+const mockUseFeature = useFeature as jest.MockedFunction<typeof useFeature>;
 
 const saveCookies = jest.fn();
 
@@ -65,6 +71,7 @@ describe('useCookieBanner', () => {
   beforeEach(() => {
     jest.clearAllMocks();
     mockIsIOSNative.mockReturnValue(false);
+    mockUseFeature.mockReturnValue(false);
     localStorage.clear();
   });
 
@@ -134,6 +141,27 @@ describe('useCookieBanner', () => {
     expect(localStorage.getItem('cookie_acknowledged')).toBe('true');
   });
 
+  it('suppresses the homegrown banner for GDPR users when the iubenda CMP is on', () => {
+    setup({ isGdprCovered: true, user: null });
+    mockUseFeature.mockReturnValue(true);
+    mockGetIubendaConsent.mockReturnValue(undefined);
+
+    const { result } = renderHook(() => useCookieBanner());
+
+    expect(saveCookies).not.toHaveBeenCalled();
+    expect(result.current.showBanner).toBe(false);
+  });
+
+  it('keeps the homegrown banner for non-GDPR users when the iubenda CMP is on', () => {
+    setup({ isGdprCovered: false, user: null });
+    mockUseFeature.mockReturnValue(true);
+    mockGetIubendaConsent.mockReturnValue(undefined);
+
+    const { result } = renderHook(() => useCookieBanner());
+
+    expect(result.current.showBanner).toBe(true);
+  });
+
   it('uses the marketing consent key for the additional cookie', () => {
     expect(otherGdprConsents).toEqual([GdprConsentKey.Marketing]);
   });
diff --git a/packages/shared/src/hooks/useCookieBanner.ts b/packages/shared/src/hooks/useCookieBanner.ts
index f10cf2e3102..c08ae7df668 100644
--- a/packages/shared/src/hooks/useCookieBanner.ts
+++ b/packages/shared/src/hooks/useCookieBanner.ts
@@ -4,6 +4,8 @@ import type { AcceptCookiesCallback } from './useCookieConsent';
 import { useConsentCookie } from './useCookieConsent';
 import { isIOSNative } from '../lib/func';
 import { getIubendaConsent } from '../lib/iubenda';
+import { useFeature } from '../components/GrowthBookProvider';
+import { featureIubendaCmp } from '../lib/featureManagement';
 
 export const cookieAcknowledgedKey = 'cookie_acknowledged';
 
@@ -42,6 +44,7 @@ interface UseCookieBanner {
 
 export function useCookieBanner(): UseCookieBanner {
   const { isAuthReady, user, isGdprCovered } = useAuthContext();
+  const iubendaCmp = useFeature(featureIubendaCmp);
   const isInitializedRef = useRef(false);
   const [isOpen, setIsOpen] = useState(false);
   const { saveCookies, cookieExists: hasAccepted } = useConsentCookie(
@@ -73,6 +76,12 @@ export function useCookieBanner(): UseCookieBanner {
       }
     }
 
+    // iubenda owns the banner for GDPR-covered users when the CMP is on; its
+    // consent is mirrored into our cookies by the Iubenda component.
+    if (iubendaCmp && isGdprCovered) {
+      return;
+    }
+
     if (!isGdprCovered) {
       if (hasAccepted) {
         return;
@@ -112,6 +121,7 @@ export function useCookieBanner(): UseCookieBanner {
     user,
     hasAccepted,
     isGdprCovered,
+    iubendaCmp,
   ]);
 
   return {
diff --git a/packages/shared/src/hooks/useCookieConsent.ts b/packages/shared/src/hooks/useCookieConsent.ts
index bf78dc58c5a..36c95376ef6 100644
--- a/packages/shared/src/hooks/useCookieConsent.ts
+++ b/packages/shared/src/hooks/useCookieConsent.ts
@@ -67,6 +67,14 @@ export const useConsentCookie = (key: string): UseConsentCookie => {
     [client],
   );
 
+  const onCookieRemoved = useCallback(
+    (cacheKey: string) => {
+      expireBrowserCookie(cacheKey);
+      client.setQueryData(['cookie', cacheKey], false);
+    },
+    [client],
+  );
+
   const saveCookies: AcceptCookiesCallback = useCallback(
     (additional, toRemove) => {
       if (isExtension) {
@@ -82,10 +90,10 @@ export const useConsentCookie = (key: string): UseConsentCookie => {
       }
 
       if (toRemove) {
-        toRemove.forEach(expireBrowserCookie);
+        toRemove.forEach(onCookieRemoved);
       }
     },
-    [key, onCookieAccepted, isExtension],
+    [key, onCookieAccepted, onCookieRemoved, isExtension],
   );
 
   return { saveCookies, cookieExists: exists };
diff --git a/packages/shared/src/lib/ads.spec.ts b/packages/shared/src/lib/ads.spec.ts
index e629a088ddb..2aef5b5bc8e 100644
--- a/packages/shared/src/lib/ads.spec.ts
+++ b/packages/shared/src/lib/ads.spec.ts
@@ -97,5 +97,33 @@ describe('ads', () => {
         { credentials: 'include' },
       );
     });
+
+    it('should append IAB consent params when a consent context is provided', async () => {
+      await fetchAdByPlacement({
+        placement: AdPlacement.Feed,
+        consent: {
+          gdprApplies: true,
+          consentString: 'tc-string',
+          addtlConsent: '1~1.2',
+        },
+      });
+
+      expect(global.fetch).toHaveBeenCalledWith(
+        'http://localhost:3000/v1/a?active=false&gdpr=1&gdpr_consent=tc-string&addtl_consent=1%7E1.2',
+        { credentials: 'include' },
+      );
+    });
+
+    it('should send gdpr=0 without consent strings outside GDPR scope', async () => {
+      await fetchAdByPlacement({
+        placement: AdPlacement.PostComment,
+        consent: { gdprApplies: false },
+      });
+
+      expect(global.fetch).toHaveBeenCalledWith(
+        'http://localhost:3000/v1/a/post?gdpr=0',
+        { credentials: 'include' },
+      );
+    });
   });
 });
diff --git a/packages/shared/src/lib/ads.ts b/packages/shared/src/lib/ads.ts
index fed26654a64..2e464bbe7b0 100644
--- a/packages/shared/src/lib/ads.ts
+++ b/packages/shared/src/lib/ads.ts
@@ -1,5 +1,6 @@
 import { apiUrl } from './config';
 import type { Ad } from '../graphql/posts';
+import type { AdMacroContext } from '../features/monetization/adMacros';
 
 export enum AdActions {
   Click = 'click',
@@ -19,8 +20,31 @@ export interface FetchAdByPlacementOptions {
   active?: boolean;
   allowPostBoost?: boolean;
   allowSquadBoost?: boolean;
+  consent?: AdMacroContext;
 }
 
+// IAB-standard consent params; the ad server promotes them to typed request
+// metadata, so names must match its extraction (gdpr, gdpr_consent,
+// addtl_consent).
+const appendConsentParams = (
+  params: URLSearchParams,
+  consent?: AdMacroContext,
+): URLSearchParams => {
+  if (typeof consent?.gdprApplies !== 'undefined') {
+    params.set('gdpr', consent.gdprApplies ? '1' : '0');
+  }
+
+  if (consent?.consentString) {
+    params.set('gdpr_consent', consent.consentString);
+  }
+
+  if (consent?.addtlConsent) {
+    params.set('addtl_consent', consent.addtlConsent);
+  }
+
+  return params;
+};
+
 const skadiGenerationIdHeader = 'x-generation-id';
 
 const addGenerationIdHeader = ({
@@ -66,18 +90,21 @@ export const resolveAdFetchOptions = ({
   placement = AdPlacement.Feed,
   active,
   boostsEnabled = false,
+  consent,
 }: {
   placement?: AdPlacement;
   active?: boolean;
   boostsEnabled?: boolean;
+  consent?: AdMacroContext;
 }): FetchAdByPlacementOptions => {
   switch (placement) {
     case AdPlacement.PostComment:
-      return { placement };
+      return { placement, consent };
     case AdPlacement.SquadDirectory:
       return {
         placement,
         allowSquadBoost: true,
+        consent,
       };
     case AdPlacement.PostSidebar:
     case AdPlacement.Feed:
@@ -87,6 +114,7 @@ export const resolveAdFetchOptions = ({
         active,
         allowPostBoost: boostsEnabled,
         allowSquadBoost: boostsEnabled,
+        consent,
       };
   }
 };
@@ -96,17 +124,24 @@ export const fetchAdByPlacement = async ({
   active = false,
   allowPostBoost = false,
   allowSquadBoost = false,
+  consent,
 }: FetchAdByPlacementOptions): Promise<Ad | null> => {
   switch (placement) {
     case AdPlacement.PostComment:
-      return fetchAdRequest({ path: '/v1/a/post' });
+      return fetchAdRequest({
+        path: '/v1/a/post',
+        params: appendConsentParams(new URLSearchParams(), consent),
+      });
     case AdPlacement.SquadDirectory: {
       const params = new URLSearchParams();
       if (allowSquadBoost) {
         params.set('allow_squad_boost', 'true');
       }
 
-      return fetchAdRequest({ path: '/v1/a/squads_directory', params });
+      return fetchAdRequest({
+        path: '/v1/a/squads_directory',
+        params: appendConsentParams(params, consent),
+      });
     }
     case AdPlacement.PostSidebar:
     case AdPlacement.Feed:
@@ -123,7 +158,10 @@ export const fetchAdByPlacement = async ({
         params.append('allow_squad_boost', 'true');
       }
 
-      return fetchAdRequest({ path: '/v1/a', params });
+      return fetchAdRequest({
+        path: '/v1/a',
+        params: appendConsentParams(params, consent),
+      });
     }
   }
 };
diff --git a/packages/shared/src/lib/boot.ts b/packages/shared/src/lib/boot.ts
index e9967e847f8..416fef6af71 100644
--- a/packages/shared/src/lib/boot.ts
+++ b/packages/shared/src/lib/boot.ts
@@ -13,6 +13,7 @@ import type {
 import type { Feed } from '../graphql/feed';
 import type { Continent } from './geo';
 import type { EngagementCreative } from './engagementAds';
+import { getStoredTcString } from './tcf';
 
 interface NotificationsBootData {
   unreadNotificationsCount: number;
@@ -162,12 +163,17 @@ export async function getBootData({
   pathname,
 }: GetBootDataParams): Promise<Boot> {
   const bootURL = getBootURL(app, url, pathname);
+  // Persisted by the CMP in the euconsent-v2 cookie on a previous page view —
+  // the CMP script loads after boot fires, so the live __tcfapi is never
+  // available here.
+  const tcString = getStoredTcString();
   const res = await fetch(bootURL, {
     method: 'GET',
     credentials: 'include',
     headers: {
       app,
       'Content-Type': 'application/json',
+      ...(tcString && { 'x-gdpr-consent': tcString }),
       ...(cookies && { Cookie: cookies }),
     },
   });
diff --git a/packages/shared/src/lib/featureManagement.ts b/packages/shared/src/lib/featureManagement.ts
index 0d244dab67a..dfbdcf46071 100644
--- a/packages/shared/src/lib/featureManagement.ts
+++ b/packages/shared/src/lib/featureManagement.ts
@@ -121,6 +121,10 @@ export const featureStreakFreeze = new Feature('streak_freeze', isDevelopment);
 // does not necessarily mean they can't boost a post if they have access to cores
 export const featurePostBoostAds = new Feature('post_boost_ads', isDevelopment);
 
+// iubenda CMP (TCF banner) for GDPR-covered users; when on, iubenda owns the
+// cookie banner and the homegrown one is suppressed for those users
+export const featureIubendaCmp = new Feature('iubenda_cmp', false);
+
 export const briefCardFeedFeature = new Feature(
   'brief_card_feed',
   isDevelopment,
diff --git a/packages/shared/src/lib/iubenda.spec.ts b/packages/shared/src/lib/iubenda.spec.ts
index 11099dde1a7..f5cddaf6279 100644
--- a/packages/shared/src/lib/iubenda.spec.ts
+++ b/packages/shared/src/lib/iubenda.spec.ts
@@ -73,6 +73,16 @@ describe('getIubendaConsent', () => {
   it('should parse the url-encoded fixture from the ticket', () => {
     setCookieValue(ticketFixture);
 
-    expect(getIubendaConsent()).toEqual({ necessary: true, marketing: true });
+    expect(getIubendaConsent()).toEqual({
+      necessary: true,
+      marketing: true,
+      consentId: '831c24',
+    });
+  });
+
+  it('should leave consentId unset when the cookie has no cons record', () => {
+    setCookieValue(encode({ '1': true, '5': true }));
+
+    expect(getIubendaConsent()?.consentId).toBeUndefined();
   });
 });
diff --git a/packages/shared/src/lib/iubenda.ts b/packages/shared/src/lib/iubenda.ts
index b77fbf7b867..37fd80e708b 100644
--- a/packages/shared/src/lib/iubenda.ts
+++ b/packages/shared/src/lib/iubenda.ts
@@ -3,9 +3,13 @@ import { getCookies } from './cookie';
 interface IubendaConsent {
   necessary: boolean;
   marketing: boolean;
+  // Correlates with iubenda's consent log for this consent record. Comes from
+  // `cons.rand` in the `_iub_cs-*` cookie; the top-level `id` is the cookie
+  // policy id, not a per-consent identifier.
+  consentId?: string;
 }
 
-export const getIubendaConsent = (): IubendaConsent | undefined => {
+const getRawIubendaCookie = (): string | undefined => {
   const policyId = process.env.NEXT_PUBLIC_IUBENDA_POLICY_ID;
 
   if (!policyId) {
@@ -13,18 +17,23 @@ export const getIubendaConsent = (): IubendaConsent | undefined => {
   }
 
   const name = `_iub_cs-${policyId}`;
-  const raw = getCookies([name])?.[name];
+  return getCookies([name])?.[name];
+};
+
+export const getIubendaConsent = (): IubendaConsent | undefined => {
+  const raw = getRawIubendaCookie();
 
   if (!raw) {
     return undefined;
   }
 
   try {
-    const { purposes } = JSON.parse(raw);
+    const { purposes, cons } = JSON.parse(raw);
 
     return {
       necessary: purposes?.['1'] === true,
       marketing: purposes?.['5'] === true,
+      consentId: typeof cons?.rand === 'string' ? cons.rand : undefined,
     };
   } catch {
     return undefined;
diff --git a/packages/shared/src/lib/tcf.spec.ts b/packages/shared/src/lib/tcf.spec.ts
new file mode 100644
index 00000000000..56302013ff8
--- /dev/null
+++ b/packages/shared/src/lib/tcf.spec.ts
@@ -0,0 +1,82 @@
+/* eslint-disable no-underscore-dangle -- __tcfapi is the IAB-mandated global */
+import type * as TcfModuleType from './tcf';
+
+type TcfListener = (tcData: Record<string, unknown>, success: boolean) => void;
+
+type TcfModule = typeof TcfModuleType;
+
+describe('tcf store', () => {
+  let tcfListener: TcfListener | undefined;
+
+  const loadStore = async (): Promise<TcfModule> => {
+    jest.resetModules();
+    const store = (await import('./tcf')) as TcfModule;
+    store.startTcfSubscription();
+    return store;
+  };
+
+  beforeEach(() => {
+    tcfListener = undefined;
+    document.cookie = 'euconsent-v2=;expires=Thu, 01 Jan 1970 00:00:00 GMT';
+    (globalThis.window as { __tcfapi?: unknown }).__tcfapi = (
+      command: string,
+      version: number,
+      callback: TcfListener,
+    ) => {
+      tcfListener = callback;
+    };
+  });
+
+  afterEach(() => {
+    delete (globalThis.window as { __tcfapi?: unknown }).__tcfapi;
+  });
+
+  it('updates the snapshot and notifies listeners on user action', async () => {
+    const store = await loadStore();
+    const listener = jest.fn();
+    store.subscribeTcf(listener);
+
+    tcfListener?.(
+      {
+        eventStatus: 'useractioncomplete',
+        gdprApplies: true,
+        tcString: 'tc-string',
+        addtlConsent: '1~1.2',
+      },
+      true,
+    );
+
+    expect(store.getTcfSnapshot()).toEqual({
+      gdprApplies: true,
+      tcString: 'tc-string',
+      addtlConsent: '1~1.2',
+    });
+    expect(listener).toHaveBeenCalled();
+  });
+
+  it('ignores unsuccessful callbacks and irrelevant event statuses', async () => {
+    const store = await loadStore();
+
+    tcfListener?.({ eventStatus: 'useractioncomplete', tcString: 'x' }, false);
+    tcfListener?.({ eventStatus: 'cmpuishown', tcString: 'y' }, true);
+
+    expect(store.getTcfSnapshot()).toBeUndefined();
+  });
+
+  it('does not subscribe when __tcfapi is absent', async () => {
+    delete (globalThis.window as { __tcfapi?: unknown }).__tcfapi;
+    const store = await loadStore();
+
+    expect(tcfListener).toBeUndefined();
+    expect(store.getTcfSnapshot()).toBeUndefined();
+  });
+
+  it('reads the stored tc string from the CMP euconsent-v2 cookie', async () => {
+    const store = await loadStore();
+
+    expect(store.getStoredTcString()).toBeUndefined();
+
+    document.cookie = 'euconsent-v2=CQoHJkAQoHJkAAfG';
+    expect(store.getStoredTcString()).toBe('CQoHJkAQoHJkAAfG');
+  });
+});
diff --git a/packages/shared/src/lib/tcf.ts b/packages/shared/src/lib/tcf.ts
new file mode 100644
index 00000000000..b2c3193f949
--- /dev/null
+++ b/packages/shared/src/lib/tcf.ts
@@ -0,0 +1,76 @@
+/* eslint-disable no-underscore-dangle -- __tcfapi is the IAB-mandated global */
+/**
+ * Minimal store over the IAB TCF v2 API (`__tcfapi`) exposed by the CMP
+ * (iubenda). Keeps the latest consent snapshot in memory for synchronous
+ * consumers (ad macros, ad requests). Persistence stays with the CMP: it
+ * stores the TC string in the IAB-conventional `euconsent-v2` cookie, which
+ * `getStoredTcString` reads for the boot request (boot fires before the CMP
+ * script loads, so the live API is never available then). No-op wherever
+ * `__tcfapi` is absent (extension, SSR, CMP disabled).
+ */
+import { getCookies } from './cookie';
+
+export type TcfConsent = {
+  gdprApplies?: boolean;
+  tcString?: string;
+  addtlConsent?: string;
+};
+
+type TcData = TcfConsent & {
+  eventStatus?: string;
+  listenerId?: number;
+};
+
+type TcfApi = (
+  command: 'addEventListener',
+  version: 2,
+  callback: (tcData: TcData, success: boolean) => void,
+) => void;
+
+declare global {
+  interface Window {
+    __tcfapi?: TcfApi;
+  }
+}
+
+const TCF_COOKIE = 'euconsent-v2';
+
+let snapshot: TcfConsent | undefined;
+let subscribed = false;
+const listeners = new Set<() => void>();
+
+const onTcData = (tcData: TcData, success: boolean): void => {
+  if (
+    !success ||
+    !['tcloaded', 'useractioncomplete'].includes(tcData.eventStatus ?? '')
+  ) {
+    return;
+  }
+
+  snapshot = {
+    gdprApplies: tcData.gdprApplies,
+    tcString: tcData.tcString,
+    addtlConsent: tcData.addtlConsent,
+  };
+
+  listeners.forEach((listener) => listener());
+};
+
+export const startTcfSubscription = (): void => {
+  if (subscribed || typeof globalThis.window?.__tcfapi !== 'function') {
+    return;
+  }
+
+  subscribed = true;
+  globalThis.window.__tcfapi('addEventListener', 2, onTcData);
+};
+
+export const subscribeTcf = (callback: () => void): (() => void) => {
+  listeners.add(callback);
+  return () => listeners.delete(callback);
+};
+
+export const getTcfSnapshot = (): TcfConsent | undefined => snapshot;
+
+export const getStoredTcString = (): string | undefined =>
+  getCookies([TCF_COOKIE])?.[TCF_COOKIE] || undefined;
diff --git a/packages/webapp/components/Iubenda.tsx b/packages/webapp/components/Iubenda.tsx
new file mode 100644
index 00000000000..9e8fcb69add
--- /dev/null
+++ b/packages/webapp/components/Iubenda.tsx
@@ -0,0 +1,137 @@
+/* eslint-disable no-underscore-dangle -- _iub is iubenda's mandated global */
+import type { ReactElement } from 'react';
+import { useEffect, useRef } from 'react';
+import { useAuthContext } from '@dailydotdev/shared/src/contexts/AuthContext';
+import { useFeature } from '@dailydotdev/shared/src/components/GrowthBookProvider';
+import { featureIubendaCmp } from '@dailydotdev/shared/src/lib/featureManagement';
+import {
+  cookieAcknowledgedKey,
+  GdprConsentKey,
+  otherGdprConsents,
+} from '@dailydotdev/shared/src/hooks/useCookieBanner';
+import { useConsentCookie } from '@dailydotdev/shared/src/hooks/useCookieConsent';
+import { isIOSNative } from '@dailydotdev/shared/src/lib/func';
+import { startTcfSubscription } from '@dailydotdev/shared/src/lib/tcf';
+
+/**
+ * Loads the iubenda Cookie Solution (IAB TCF mode) for GDPR-covered users and
+ * mirrors its consent into the first-party `ilikecookies*` cookies so all
+ * existing gating (Pixels, settings, ad consent fallback) keeps working.
+ * The homegrown banner is suppressed for these users in `useCookieBanner`.
+ */
+
+type IubendaPreference = {
+  purposes?: Record<string, boolean>;
+};
+
+type IubendaWindow = typeof globalThis & {
+  _iub?: {
+    csConfiguration?: Record<string, unknown>;
+    cs?: { api?: { openPreferences?: () => void } };
+  };
+};
+
+const IUBENDA_SCRIPTS = [
+  'https://cdn.iubenda.com/cs/tcf/stub-v2.js',
+  'https://cdn.iubenda.com/cs/tcf/safe-tcf-v2.js',
+  'https://cdn.iubenda.com/cs/iubenda_cs.js',
+];
+
+export const openIubendaPreferences = (): boolean => {
+  const api = (globalThis as IubendaWindow)._iub?.cs?.api;
+
+  if (!api?.openPreferences) {
+    return false;
+  }
+
+  api.openPreferences();
+  return true;
+};
+
+export const Iubenda = (): ReactElement | null => {
+  const { isAuthReady, isGdprCovered, isFunnel } = useAuthContext();
+  const cmpEnabled = useFeature(featureIubendaCmp);
+  const { saveCookies } = useConsentCookie(GdprConsentKey.Necessary);
+  const injectedRef = useRef(false);
+
+  // The config callback must not go stale when React re-renders.
+  const onPreferenceRef = useRef<(pref: IubendaPreference) => void>();
+  onPreferenceRef.current = (pref) => {
+    const marketing = pref?.purposes?.['5'] === true;
+    saveCookies(
+      marketing ? otherGdprConsents : [],
+      marketing ? [] : otherGdprConsents,
+    );
+    globalThis?.localStorage?.setItem(cookieAcknowledgedKey, 'true');
+  };
+
+  const enabled =
+    isAuthReady && isGdprCovered && cmpEnabled && !isFunnel && !isIOSNative();
+
+  useEffect(() => {
+    if (!enabled || injectedRef.current) {
+      return;
+    }
+
+    const win = globalThis as IubendaWindow;
+
+    if (win._iub?.csConfiguration) {
+      return;
+    }
+
+    injectedRef.current = true;
+
+    win._iub = win._iub || {};
+    // Aligned with the marketing homepage's embed (same siteId/cookiePolicyId,
+    // countryDetection, LGPD/USPR) so both surfaces treat consent the same.
+    // Deliberate differences: enableTcf + ACM (the point of this integration)
+    // and no floating button (settings/privacy is the re-entry point).
+    win._iub.csConfiguration = {
+      siteId: Number(process.env.NEXT_PUBLIC_IUBENDA_SITE_ID),
+      cookiePolicyId: Number(process.env.NEXT_PUBLIC_IUBENDA_POLICY_ID),
+      lang: 'en',
+      enableTcf: true,
+      googleAdditionalConsentMode: true,
+      perPurposeConsent: true,
+      askConsentAtCookiePolicyUpdate: true,
+      invalidateConsentWithoutLog: true,
+      countryDetection: true,
+      enableLgpd: true,
+      enableUspr: true,
+      cookiePolicyInOtherWindow: true,
+      // consent cookie shared across *.daily.dev so the homepage recognizes
+      // webapp consent; the homepage embed should add this too for the
+      // reverse direction (its cookie is host-only today)
+      localConsentDomain: process.env.NEXT_PUBLIC_DOMAIN,
+      floatingPreferencesButtonDisplay: false,
+      banner: {
+        position: 'float-bottom-center',
+        acceptButtonDisplay: true,
+        rejectButtonDisplay: true,
+        customizeButtonDisplay: true,
+        closeButtonDisplay: false,
+        listPurposes: true,
+      },
+      callback: {
+        onPreferenceExpressed: (pref: IubendaPreference) =>
+          onPreferenceRef.current?.(pref),
+      },
+    };
+
+    IUBENDA_SCRIPTS.forEach((src, index) => {
+      const script = document.createElement('script');
+      script.src = src;
+      // dynamically injected scripts default to async; force in-order
+      // execution — iubenda requires the TCF stub before the core script
+      script.async = false;
+      if (index === 0) {
+        // __tcfapi only exists once the stub executes; the stub then queues
+        // the subscription until the core script loads
+        script.onload = () => startTcfSubscription();
+      }
+      document.head.appendChild(script);
+    });
+  }, [enabled]);
+
+  return null;
+};
diff --git a/packages/webapp/pages/_app.tsx b/packages/webapp/pages/_app.tsx
index d1fd5d4c89b..37b178bab88 100644
--- a/packages/webapp/pages/_app.tsx
+++ b/packages/webapp/pages/_app.tsx
@@ -57,6 +57,7 @@ import useWebappVersion from '../hooks/useWebappVersion';
 import { getAppOrigin, getSiteOrigin } from '../lib/seo';
 import { getOnboardingRedirect } from '../lib/onboardingRedirect';
 import { PixelsProvider } from '../context/PixelsContext';
+import { Iubenda } from '../components/Iubenda';
 
 structuredCloneJsonPolyfill();
 
@@ -401,6 +402,7 @@ function InternalApp({ Component, pageProps, router }: AppProps): ReactElement {
             trigger={loginState?.trigger}
           />
         )}
+        {!isImageGenerator && <Iubenda />}
         {showBanner && !isFunnel && !isImageGenerator && (
           <CookieBanner
             onAccepted={onAcceptCookies}
diff --git a/packages/webapp/pages/embed/mf.tsx b/packages/webapp/pages/embed/mf.tsx
index 933c50333f5..ed61dc7fbfc 100644
--- a/packages/webapp/pages/embed/mf.tsx
+++ b/packages/webapp/pages/embed/mf.tsx
@@ -56,8 +56,12 @@ export default function MeasurementFrame(): ReactElement {
         return;
       }
 
-      const { tags, gdprApplies } = event.data;
-      injectMeasurementTags(document.body, tags, { gdprApplies });
+      const { tags, gdprApplies, consentString, addtlConsent } = event.data;
+      injectMeasurementTags(document.body, tags, {
+        gdprApplies,
+        consentString,
+        addtlConsent,
+      });
     };
 
     globalThis.addEventListener('message', onMessage);
diff --git a/packages/webapp/pages/settings/privacy.tsx b/packages/webapp/pages/settings/privacy.tsx
index 3530d363158..598b750b569 100644
--- a/packages/webapp/pages/settings/privacy.tsx
+++ b/packages/webapp/pages/settings/privacy.tsx
@@ -17,6 +17,11 @@ import {
 import { GdprConsentKey } from '@dailydotdev/shared/src/hooks/useCookieBanner';
 import { CookieConsentItem } from '@dailydotdev/shared/src/components/modals/user/CookieConsentItem';
 import { useConsentCookie } from '@dailydotdev/shared/src/hooks/useCookieConsent';
+import { useFeature } from '@dailydotdev/shared/src/components/GrowthBookProvider';
+import { featureIubendaCmp } from '@dailydotdev/shared/src/lib/featureManagement';
+import { Button } from '@dailydotdev/shared/src/components/buttons/Button';
+import { ButtonVariant } from '@dailydotdev/shared/src/components/buttons/common';
+import { openIubendaPreferences } from '../../components/Iubenda';
 import AccountContentSection from '../../components/layouts/SettingsLayout/AccountContentSection';
 import { AccountPageContainer } from '../../components/layouts/SettingsLayout/AccountPageContainer';
 import { getSettingsLayout } from '../../components/layouts/SettingsLayout';
@@ -33,6 +38,7 @@ const AccountInvitePage = (): ReactElement | null => {
   const router = useRouter();
   const { saveCookies } = useConsentCookie(GdprConsentKey.Marketing);
   const { user, isAuthReady, isGdprCovered } = useAuthContext();
+  const iubendaCmp = useFeature(featureIubendaCmp);
 
   useEffect(() => {
     if (!isAuthReady) {
@@ -90,13 +96,25 @@ const AccountInvitePage = (): ReactElement | null => {
           >
             Cookie Policy →
           </Typography>
-          <div className="mt-4 flex flex-col gap-4">
-            <CookieConsentItem consent={GdprConsentKey.Necessary} />
-            <CookieConsentItem
-              consent={GdprConsentKey.Marketing}
-              onToggle={onToggleMarketing}
-            />
-          </div>
+          {iubendaCmp ? (
+            // the custom toggles can't regenerate a TCF consent string, so
+            // consent edits must go through the CMP's own preferences UI
+            <Button
+              className="mt-4 self-start"
+              variant={ButtonVariant.Secondary}
+              onClick={() => openIubendaPreferences()}
+            >
+              Manage cookie preferences
+            </Button>
+          ) : (
+            <div className="mt-4 flex flex-col gap-4">
+              <CookieConsentItem consent={GdprConsentKey.Necessary} />
+              <CookieConsentItem
+                consent={GdprConsentKey.Marketing}
+                onToggle={onToggleMarketing}
+              />
+            </div>
+          )}
         </AccountContentSection>
       )}
       <AccountContentSection