Debug Sourcepoint in Chrome DevTools

What Sourcepoint traffic looks like

Sourcepoint is the big-publisher CMP: wrapper, message, and consent calls spread across several hosts, very often CNAMEd first-party.

Endpoint pattern

wrapperMessagingWithoutDetection.js from sp-prod.net, or from a first-party subdomain CNAMEd to privacy-mgmt.com (think sourcepoint.example-news-site.com) to stay clear of ad blockers; message and consent calls hit mms.sp-prod.net and numbered message*.sp-prod.net hosts; US privacy flows use ccpa.sp-prod.net; TCF-era deployments also touch sourcepoint.mgr.consensu.org

Transport

Script loads plus message and consent calls; sites bundling LiveRamp ATS through Sourcepoint also pull ats-wrapper.privacymanager.io and geo.privacymanager.io

Consent signals

The IAB TC string is the granular output, surfaced via the standard window.__tcfapi and typically persisted in the euconsent-v2 cookie, not a proprietary category cookie

Data layer objects

GTM integration announces lifecycle moments on the dataLayer: sp.onMessageReady, sp.onMessageChoiceSelect, and sp.consent

Debugging Sourcepoint with Event Watcher

• Detects Sourcepoint across all hosts above, including the CNAMEd first-party wrappers, and badges each request in the live stream.
• No dedicated payload parser: you work from the raw request with parsed query and body parameters and the cookies section per event.
• The sp.* dataLayer pushes are captured with stack-trace attribution.
• The Script Tree shows what the wrapper loaded downstream, useful on publisher pages where the CMP, ad stack, and identity scripts arrive tangled together.

Sourcepoint and consent

Sourcepoint is consent infrastructure. Event Watcher runs no consent check against it. There is no Sourcepoint-specific cookie or window API reader either: the proprietary surface does not expose category state the way OneTrust or Cookiebot do.

Instead the extension detects the sp.consent / sp.onMessageChoiceSelect pushes as consent activity and, on TCF deployments (nearly all Sourcepoint sites in Europe), queries __tcfapi('getTCData', …) and parses euconsent-v2.

TCF purposes map to the unified analytics / marketing / functional categories, driving every event's granted / denied / pre-consent verdict.

Common debugging scenarios

• Ad calls fire before the message is answered. Publisher stacks race hard; pre-consent events are flagged and totaled in the violations counter. The approach in GA4 fires before consent applies to prebid and ad-server calls too.
• Is the wrapper first-party? The raw request view shows the CNAMEd host; confirm it resolves into privacy-mgmt.com patterns rather than assuming the subdomain is the publisher's own code.
• TC string says denied, tags disagree. Group events by Consent Category to enumerate what ignored the TCF signal. Vendors reading the string themselves versus tags gated only by GTM behave differently.
• sp.onMessageReady never arrives. Check whether the message calls to mms.sp-prod.net returned at all; a blocked or misconfigured property ID stalls the whole choreography.
• Consent Mode on top of TCF. Many Sourcepoint sites also emit Google consent commands. See debugging Consent Mode v2 and the Google Consent Mode page.