IAB Transparency and Consent Framework (TCF)

Last updated: April 9, 2025

Overview

The Interactive Advertising Bureau (IAB) Transparency and Consent Framework (TCF) is a standardized framework designed to assist all parties in the digital advertising supply chain in complying with European data protection laws, notably the General Data Protection Regulation (GDPR) and the ePrivacy Directive.

Gravito CMP provides a TCF 2.2 compliant consent management platform recognized by IAB with ID 302. With Gravito you can customize the look and feel of your CMP so that it blends well with your website. Gravito TCF 2.2 CMP is also listed as one of the Google Certified TCF CMP's (Web and App)

Purpose of the TCF

The TCF aims to:

  • Standardize the process of obtaining, managing, and communicating user consent for data processing in digital advertising.
  • Facilitate Compliance with legal requirements by providing a common language and set of protocols for publishers, advertisers, and technology vendors.
  • Enhance Transparency by informing users about how their data will be used and obtaining their explicit consent.

Key Components

  • Global Vendor List (GVL):

    • A registry of vendors participating in the TCF, detailing their data processing purposes and legal bases.

  • Consent Management Platform (CMP):

    • Tools or services that help publishers collect, manage, and transmit user consent choices to vendors in a standardized manner.

  • Transparency & Consent String (TC String):

    • A compressed, encoded data structure that records user consent choices and preferences, which is then shared with vendors to inform them of the user's decisions.

Evolution of the TCF

TCF v1.1

  • Launched: April 2018
  • Objective: Establish an initial framework for managing user consent in line with GDPR requirements.

TCF v2.0

  • Launched: August 2019
  • Enhancements:
  • Provided users with more granular control over data processing purposes.
  • Allowed users to object to data processing based on legitimate interests.
  • Improved transparency regarding vendors' data processing activities.

TCF v2.1

  • Launched: August 2020
  • Updates:
  • Aligned the framework with the Planet49 ruling by the Court of Justice of the European Union.
  • Standardized the disclosure of the duration of operation of cookies.

TCF v2.2

  • Launched: May 16, 2023
  • Key Changes:
    • Removal of Legitimate Interest for Certain Purposes: Vendors can no longer use legitimate interest as a legal basis for processing personal data for advertising and content personalization; consent is now required.
    • Enhanced Transparency: Introduction of user-friendly descriptions and real-use case examples to better inform users about data processing purposes.
    • Standardized Vendor Information: Vendors must provide detailed information about data categories collected, retention periods, and any legitimate interests claimed.
    • Disclosure of Vendor Count: Consent Management Platforms (CMPs) are required to disclose the total number of vendors seeking to establish a legal basis on the first layer of their user interfaces.
    • Facilitated Withdrawal of Consent: Users must be able to easily withdraw consent, with CMPs ensuring that their interfaces can be resurfaced for users to change their preferences at any time.

Implications for Stakeholders

  • Publishers:

    • Must ensure that their CMPs are updated to comply with TCF v2.2 requirements.
    • Need to provide clear and accessible information to users about data processing activities and their rights.

  • Advertisers and Vendors:

    • Required to register with the GVL and adhere to the updated policies.
    • Must rely solely on user consent for processing personal data for advertising and content personalization purposes.

  • Consent Management Platforms (CMPs):

    • Need to implement the new user interface and transparency requirements.
    • Ensure mechanisms are in place for users to easily withdraw consent.

Additional Resources

Note: This document reflects the state of the IAB TCF as of April 9, 2025. For the most current information and guidance, please refer to the official IAB Europe resources linked above.