What Is the IAB TCF v2.2?

Many businesses process users’ personal information to create personalized content and enhance digital advertising.

To help you do so while respecting the EU’s privacy laws, Europe’s branch of the Interactive Advertising Bureau (IAB) created the Transparency and Consent Framework (TCF).

The TCF is a voluntary accountability tool, and in May 2023, IAB Europe released version 2.2.

Read this simplified overview of IAB Europe’s TCF v2.2 to learn more about what it is, why it’s important, its role in respecting user consent choices, and its implications for businesses and third-party data processors.

What Is the IAB?

The Interactive Advertising Bureau, or IAB, helps set the online advertising industry standard.

It provides guidelines and best practices so businesses can effectively implement digital advertising while respecting user privacy.

Headquartered in New York, the IAB has a network of 45 organizations worldwide, including the IAB Europe, which focuses on tailoring principles to align with regulatory guidelines impacting the European market.

IAB Europe addresses the unique challenges of online advertising under European laws like the ePrivacy Directive and the General Data Protection Regulation (GDPR).

What Is the IAB TCF v2.2?

Created by IAB Europe, the transparency and consent framework, or TCF, helps address the complexities of digital advertising under European laws like the GDPR and ePrivacy Directive.

The framework is a voluntary accountability tool that aims to standardize how businesses obtain and handle user consent regarding processing personal information for digital advertising purposes.

It creates a set of standards that companies can follow to ensure they properly respect their users’ privacy and handle the data responsibly.

Over the years, IAB Europe has released several iterations of the TCF, adapting it to the industry’s needs and consumers’ rights, better aligning it with legal guidelines.

The current version is 2.2.

Key Terms and Definitions

IAB Europe uses some phrases with specific meanings, and it’s helpful to know what those are to better understand how the TCF works, which include the following:

• Publisher: The owner of a website that collects and processes personal information and shares it with third parties for the purposes of online marketing and advertising, e.g., (your business).
• Vendor: The third parties the personal information gets shared to who otherwise don’t have access to that data, e.g., (Google AdSense, Adobe Advertising Cloud, etc.)
• Consent Management Platform (CMP): Software that provides consent banners for websites to users, presenting them with details about trackers being used, how it’s stored, and the ability to choose a preference over the collection and processing of their data.

How Does the TCF Work?

The TCF works by having registered publishers and vendors integrate specific technical features the CMP provides into their systems.

• Step One: Publishers must enable a consent banner from their TCF v2.2 compliant CMP.
• Step Two: The consent banner enables the system to send a consent signal to vendors when a user visits their website, informing the vendor about their preference regarding data processing.
• Step Three: Users can mark their consent preference directly on the banner (called the first layer of the user interface by the IAB), including accepting, denying, or customizing their choices.
• Step Four: When customizing their choices, the users are taken to a preference center, allowing them to pick and choose individual preferences.
• Step Five: After their choice is confirmed, the system creates a consent string containing the user preferences and sends it to the vendors, who must respect the choices the string conveys.

The users must also have an easy way to go back and change their minds at any time.

Additionally, the TCF requires publishers to provide detailed information about the vendors they work with and their data processing activities and purposes.

It also includes a reporting mechanism that documents user consent and vendor interactions, which assists with GDPR compliance.

What Changes Were Made to the TCF?

The newest version of the TCF introduced the following changes to the framework:

• Legitimate Interest: Legitimate interest can no longer be used as a legal basis for targeted advertising or content personalization, and vendors can only select consent as their purpose for specific processing, aligning the framework better with the requirements of the GDPR.
• Vendor Information: Vendors must now provide more details about their data processing activities so publishers can more easily disclose to their users the categories of data collected by the third parties, their data retention periods, and the places where legitimate interest is at (only where applicable).
• Greater Transparency: Concerning the information presented to end-users, the purposes and feature names have been updated, and some legal text was replaced with more user-friendly descriptions so more people can understand the context.
• Number of Vendors: CMPs must now disclose the total number of vendors that seek to establish a legal basis on the initial banner presented to users.
• Withdrawal of Consent: Both publishers and CMPs must now ensure that users can easily access the consent banner to withdraw their consent at any time in an easy manner.

How Does the IAB TCF v2.2 Impact Businesses?

The IAB TCF v2.2 impacts businesses registered with the IAB — which they call publishers — by requiring them to no longer use legitimate interest as a legal basis for processing data for targeted advertising or content personalization.

By removing this choice from the framework, TCF v2.2 better aligns with Article 6 of the GDPR.

Additionally, businesses must now provide an easy way for website visitors to change their minds regarding their consent preferences at any time.

Such methods include adding a preference center to your consent banner where users can check and uncheck boxes for different cookies, vendors, and purposes.

It must be accessible from every page of your website.

How Does the IAB TCF v2.2 Impact Consent Management Platforms?

CMPs registered or interested in registering with IAB Europe’s TCF must ensure their software meets certain specifications, including:

• Providing constant access to a user consent preference center where they can update their choice at any time.
• Creating a means for publishers to provide their users with transparent, easy-to-understand details of all vendors, cookies (or other trackers), and purposes the publishers they work with use.
• Using a customer interface that meets all specifications described by IAB Europe, including the use of TC strings.
• Properly storing consent preferences in a way that meets the TCF v2.2 requirements.

IAB TCF v2.2 Deadlines and Important Dates

When IAB Europe introduced the TCF version 2.2, the following timeline impacted all existing registered publishers, vendors, and CMPs:

• May 16, 2023 — IAB Europe releases version 2.2 of the TCF, along with updated policies and information to help all impacted entities comply with the new requirements.
• June 30, 2023 — Vendors already registered with the TCF needed to update their global vendor list (GVL) registration by this date.
• July 31, 2023 — Vendors already registered with the TCF must have completed a TCF Compliance Assessment by this date.
• September 30, 2023 — CMPs already registered with the TCF had until this date to implement all new policies and specifications; however, this deadline was extended.
• November 20, 2023 — IAB Europe announced that they’re extending the deadline for TCF-registered CMPs and vendors, who now have until this date to complete the implementation of the new technical requirements described by version 2.2.

Any unregistered but interested publishers, vendors, and CMPs are welcome to register and join the TCF following the updated standards and procedures.

Additionally, the IAB encourages anyone interested in following their policies to do so, even if they cannot register at this time.

Google’s Additional Consent Mode and the IAB TCF

After the IAB Europe released the newest version of the TCF, Google announced in a blog post that they are introducing new requirements for their CMP partners that match the updated standards.

They plan to release a list of these CMPs later this year.

Websites using Google AdSense, Ad Manager, or AdMob and serving ads in the EU must use a Google-certified CMP that integrated the TCF by January 16, 2024.

Google is also providing Additional Consent Mode to act as an intermediary step to acknowledge the vendors that meet the TCF standards and don’t appear on the Global Vendor’s List but are on Google’s Ad Tech Providers (ATP) list.

Termly’s CMP and IAB TCF v2.2

Termly offers a CMP that is IAB TCF v2.2 certified and, as a Google CMP Partner, also meets Google’s Ad publisher requirements.

Our users can configure the consent banner that appears for European visitors to meet all TCF requirements in a few simple steps.

Plus, it supports all of our current language offerings.

Additionally, we provide a vendor scanning feature similar to what we use to detect and list the cookies that a website uses.

Our users can also manually add or delete any vendors as necessary.

After configuring your vendors, your consent banner will be updated to reflect the vendors you work with and the purposes for which they process data.

Your site visitors will be able to give or revoke their consent for each vendor and purpose individually, as the IAB TCF requires.

Summary

For businesses whose websites serve ads and customized content to users in the EU, the IAB TCF is an ideal resource for aligning your data processing activities with laws like the GDPR.

It’s essential to respect the privacy rights of your consumers, which means giving them a choice regarding whether their data gets collected, processed, and shared with third parties for behavioral targeting and precision marketing.

Termly’s CMP supports the TCF v2.2, making it easier than ever for businesses to set up a compatible, informative consent banner for their EU users.

More about the author

Written by Etienne Cussol CIPP/E, CIPM

Etienne is an Information Privacy professional and compliance analyst for Termly. He has been with us since 2021, managing our own compliance with data protection laws and participating in our marketing researches. His fields of expertise - and interest - include data protection (GDPR, ePrivacy Directive, CCPA), tracking technologies (third-party cookies, fingerprinting), and new forms of privacy management (GPC and the Google Privacy Sandbox). Etienne studied International Economic Affairs at the University of Toulouse, and graduated with a Masters in 2017. More about the author