---
title: Iab
description: React, Next.js and TanStack Start no longer take an `iab` provider
  option. Render `IABProvider` from `c15t/react/iab` inside `ConsentProvider` or
  `ConsentRoot`, around the IAB components. Its props are the options you passed
  to `iab()`, such as `cmpId`, `vendors`, `customVendors` and the new
  `publisherRestrictions`.
lastModified: "2026-10-12T12:44:54+01:00"
lastAuthor: Christopher Burns
---
## Move IAB setup to `IABProvider`

React, Next.js and TanStack Start no longer take an `iab` provider option.
Render `IABProvider` from `c15t/react/iab` inside `ConsentProvider` or
`ConsentRoot`, around the IAB components. Its props are the options you passed
to `iab()`, such as `cmpId`, `vendors`, `customVendors` and the new
`publisherRestrictions`.

The `iab-option-to-iab-provider` codemod marks the `iab` option with a
`TODO(c15t v3)` comment; move it by hand.

A `cmpId` that isn't an integer from 2 to 4095 now throws. Without a `cmpId`,
the CMP doesn't mount, so there is no `__tcfapi` and no TC string.

`@c15t/iab` no longer exports `createIABManager`, `decodeTCString`,
`generateTCString` or `c15tToIabPurposes`. Use `createIAB({ kernel, cmpId })`,
which returns a handle with `generateTCString()`, `acceptAll()`, `rejectAll()`
and `save()`. If your app depends on `@c15t/iab` directly, upgrade it to v3
too, on the same release as `c15t`. Remove it if
`IABProvider` now covers everything you used it for.

Server integrations now send a reference to the Global Vendor List instead of
the list, and the browser fetches it when the IAB module mounts. If you set a
Content Security Policy, allow the list's origin in `connect-src`, or `'self'`
for same-origin routes.