IAB TCF 2.4 Policy Checklist & Custom Text Requirements

This section explains what's essential to review in your first layer UI (cookie banner) to adhere to the TCF Policies:

1. Must include information about the fact that information is stored on and/or accessed from the user’s device (e.g. use of cookies, device identifiers, or other device data);

   The 1st layer of the UI refers to the Cookie Banner that the site visitor is shown on the initial visit. Our IAB TCF v2.4. template provides the necessary disclosures of those elements communicating the access/storage via cookies (or similar identifiers) through user’s device. We use the verbiage “use cookies to store and/or access personal data on user’s device.”

   To guarantee adherence to this policy check if you want to customize your banner, it’s recommended to target the following elements:

   • The banner must explicitly convey the message that information is stored on and/or accessed from the user's device.

   • Use clear and concise language to inform users about the types of data storage or access methods employed, such as cookies, device identifiers, or other device data.

   • Ensure transparency in the language used to describe the data practices. Avoid technical jargon and use terms that are easily understandable by the average user.

   • Provide a brief explanation of how and why the information is stored or accessed.

2. Must include information about the fact that personal data is processed, and the nature of the personal data processed (e.g. unique identifiers, browsing data);

   Our IAB TCF v2.4. template discloses the fact that personal data is processed, and the nature of personal data processed, via the following clause in our out of the box template:

   “We and our [VENDOR_NUMBER] partners use cookies to store and/or access personal data on user’s device, such as unique IDs.”

   • Convey the message that personal data is processed.

   • Disclose what kind of processing is used (e.g., storing or accessing).

   • Use clear and concise language to inform users about the nature of the personal data processed, such as unique identifiers, browsing data, or any other relevant information.

3. Must include information about the fact that third party Vendors will be storing and/or accessing information from the user’s device and processing their personal data, the number of third-party Vendors (which may also include Vendors not participating in the Framework); and a link to the list of named third parties;

   Our IAB TCF v2.4. template discloses the fact that a specified number of third-party Vendors will be storing and/or accessing information from the user’s device. The number of vendors is a variable [VENDOR_NUMBER] automatically calculated based on what partners you have registered throughout your tracker’s classification journey.

   We disclose the list of named third parties via a specific link (the “List of Partners”), enabling user’s access to the second layer UI (Preference Center) for a detailed description of each vendor’s processing element, such as purposes and technologies enabled.

   To guarantee adherence to this policy check if you want to customize your banner, it’s recommended to target the following elements:

   • Convey the message that third-party vendors will be storing and/or accessing information from the user's device and processing their personal data.

   • Disclose the number of third-party vendors engaged in this processing activity.

   • Include a link within the banner leading to a list of named third parties. This list should encompass all relevant vendors, even those not participating in the Framework.

4. Must include the list of the distinct and separate Purposes for which the Vendors are processing data, using at least the standardized names and/or Stack names as defined in Appendix A;

   Our IAB TCF v2.4. template discloses automatically under the section Data Processing Declaration the special features, purposes, and/or stacks your organization utilizes. When you customize your Preference Center, this information dynamically populates based on what elements you enable or disable through IAB Groups.

   To guarantee adherence to this policy check if you want to customize your banner, it’s recommended to target the following elements:

   • Include a clear and easily accessible list of distinct and separate purposes for which vendors are processing data. This list should align with the standardized names and/or Stack names defined in Appendix A of the framework. This information must mirror what you have disclosed as IAB Groups for purposes, stacks, features, and special features in your Preference Center.

   • Ensure that the purposes are presented in a transparent and understandable manner, avoiding technical jargon, and providing terms that are user-friendly. It’s advisable to use as maximum as possible the descriptions provided by IAB as User-friendly text for each element (Appendix A).

   • Regularly update the list to reflect any changes in data processing purposes adopted. Keeping the information current enhances user trust and compliance with framework policies.

   CAUTION:

   The IAB Europe TCF Policies do not explicitly prohibit the creation of new stacks. However, creating new stacks is considered a CMP customization at the Publisher level, impacting overall compliance with the Framework. Publishers intending to create new stacks should be aware of specific obligations outlined in Sections 7 and 8 of the Policies.

   Publishers customizing stacks must take responsibility for compliance with CMP Policies as they will need to register a private CMP within the Framework and obtain a designated private CMP ID. Additionally, modified stack descriptions should accurately cover all purposes within the stack, meeting the same level of detail and coverage as standard descriptions.

   Any customization outside the specified logic may be considered a violation (Section 8 – Accountability). Such violations could lead to temporary suspension by the MO, who may inform CMPs of the non-compliance.

5. Must include information about the Special Features used by the Vendors when processing data;

   Our IAB TCF v2.4. template discloses automatically under the section Data Processing Declaration the special features, purposes, and/or stacks your organization utilizes. When you customize your Preference Center, this information dynamically populates based on what elements you enable or disable through IAB Groups.

   To guarantee adherence to this policy check if you want to customize your banner, it’s recommended to target the following elements:

   • Include explicitly the disclosure of special features used in combination with adopted purposes. Those features are the ones listed on Appendix A – Section D (Special Features) in the Policies:

     1. Use precise geolocation data.

     2. Actively scan device characteristics for identification.

6. Should include information about the consequences (if any) of consenting or not consenting (including withdrawing consent);

   Our IAB TCF v2.4. template discloses brief information about how users can modify their preferences at any time: “You may accept manage your choices by clicking below or at any time in the privacy policy page”. As this requirement is optional for the first layer UI, our template contains detailed information about the consequences of consenting or not consenting under the second layer UI.

7. Must include information about the scope of the consent choice, i.e. service-specific consent, or group-specific consent. If group-specific consent, a link with information about the group;

   Our IAB TCF v2.4. template provides a customizable text-based variable called CONSENT_SCOPE. This variable provides the ability to select the specific domain, application, or group of domains/applications reading and respecting user’s choice.

   When selecting CONSENT_SCOPE, you will be able to determine the consent coverage using one of our default expressions to fulfill the sentence, “Your choices will have effect in our [CONSENT_SCOPE]”.

   • Website

   • Application

   • Service

   • Group of Websites

   • Group of Applications

   • Affiliated Companies

   • Affiliated Websites

This section explains what's essential to review in your second layer UI (preference center) to pledge adherence with the TCF Policies.

1. Users must be able to review:

   • the list of named Vendors and a link to each Vendor’s privacy policy,

   • their Purposes, Special Purposes, associated Legal Bases and corresponding retention period,

   • their Features and Special Features and

   • the categories of data collected and processed;

   Our IAB TCF v2.4. template has a dedicated Vendor List, located in the Preference Center, enabling users to see additional Vendor information, such as Categories of Data Collected, Purposes, retention periods on a per-purpose basis, Special purposes, Features, Special Features, and associated legal grounds.

   To guarantee adherence to this policy check if you want to customize your Preference Center, you need to make sure that your custom vendor list will follow the necessary parameters of this policy check as well as the necessary technical specifications for the General Vendor List (GVL) in light of Chapter II Section 4 (Adherence to the Specifications) from the Policies.

   Note:

   A Publisher shall not be required to allow a user to make granular and specific consent or opt-in choices if the Publisher implements a way for the user to access its content without consenting through other means, for example by offering paid access that does not require consenting to any Purposes. For the avoidance of doubt, all other Policies remain applicable.

2. Users must be able to review the list of Purposes, Special Purposes, Features, and Special Features including their standard name, their full standard user-friendly text and where applicable their illustrations, as defined in Appendix A, the number of Vendors seeking consent for each of the Purposes (which may also include Vendors not participating in the Framework), and have a way to see those Vendors

   Our IAB TCF v2.4. template provides the detailed information for Purposes which the Publisher chooses to obtain consent on behalf of one or more Vendors in the second layer UI (Preference Center). Users have the ability to see individual disclosures for all Purposes (including their Features and Special Features) enabled through the IAB Groups panel.

   Below each purpose name, the number of Vendors seeking consent per purpose is dynamically displayed considering the number of third-parties you are allowing to engage into the processing.

   To guarantee adherence to this policy check if you want to customize your Preference Center, it’s recommended to target the following elements:

   • Provide a comprehensive and organized list of purposes, special purposes, features, and special features associated with your processing.

   • Include the standard names, full standard user-friendly text, and any applicable illustrations as defined in Appendix A of the Framework.

   • Ensure that the information is presented in a user-friendly manner, making it easy for users to navigate and understand.

   • Clearly indicate the number of vendors seeking consent for each processing purpose.

   • Include a clear link or option that allows users to view the list of vendors associated with each processing purpose.

3. Users must be able to make granular and specific consent choices with respect to each Vendor, and, separately, with respect to each Purpose for which the Publisher chooses to obtain consent on behalf of one or more Vendors

   Our IAB TCF v2.4. template has a friendly UI under the second layer to provide the necessary requirements for an easy navigation through the Vendor List and purposes. Users can easily find specific toggles to enable/disable the processing under different levels (Vendors, Purposes, or Stacks), expressing the possibility of their granular consent.

   Each Preference Center accordion layer has its own consent toggle, and clicking on each accordion layer reveals a link entitled “List of IAB Vendors” which navigates to consent toggles with respect to each individual Vendor requesting consent for that purpose. This enables users to make granular and specific consent choices with respect to each purpose and Vendor.

   To guarantee adherence to this policy check if you want to customize your Preference Center, it’s recommended to target the following elements:

   • Provide users with the ability to make granular consent choices for each named vendor.

   • Clearly present each vendor along with checkboxes, toggles, or similar elements that allow users to individually consent or withhold consent for data processing by each vendor.

   • Clearly outline each purpose for data processing and provide corresponding checkboxes or toggles for users to express their consent or opt-out for each specific purpose.

   • If a singular vendor is associated with multiple purposes, provide clear navigation through the UI to not mislead user’s choices and guarantee that consent is respecting the informed requirement.

4. Users must be able to make granular and specific opt-in choices with respect to each Special Feature for which the Publisher chooses to obtain opt-ins on behalf of one or more Vendors

   Our IAB TCF v2.4. template provides information for Special Features which the Publisher chooses to obtain consent on behalf of one or more Vendors in the second layer UI (Preference Center).

5. Where applicable and not disclosed in a 1st layer, users must be able to view information about:

   1. the fact that some Vendors (if any) are processing the user’s data on the basis of their legitimate interest;

   2. the fact that the user has a right to object to such processing; and

   3. a link to the relevant layer of the Framework UI dealing with processing on the basis of legitimate interests where more information could be found and the right to object exercised.

   Our IAB TCF v2.4. template has the capability to indicate specific Vendors (if any) justifying further processing under their legitimate interest. For those Vendors, users will have the ability to see a specific field Object to Legitimate Interests. In our text for the second layer UI we have an option to include the standard disclosure for one of the Preference Center versions: "You also have the right to object to processing based on Legitimate Interest by choosing to 'Object to Legitimate Interests' if there’s any Vendor processing the data adopting this lawful ground."

6. Where not disclosed in a 1st layer, users must be able to view information about the consequences (if any) of consenting or not consenting (including withdrawing consent)

   Our IAB TCF v2.4. template has the disclosure of consequences about giving or not giving consent in our second layer UI: “You may customise your choices either for a specific purpose, or at partner level in the link under each purpose. You can also choose to “Allow All” the purposes. If you do not consent, or if you withdraw your consent, we will only enable essential technologies and we won't be able to deliver a personalized experience”.

   To guarantee adherence to this policy check if you want to customize your Preference Center, it’s recommended to target the following elements:

   • Provide transparent information about the consequences of not consenting to data processing. This could include limitations on access to certain features, services, or a less personalized user experience.

   • Emphasize the user's ability to exercise their right to withdraw consent at any time and the consequences if user revoke their consent afterwards.

7. Where applicable, users must be able to review Vendors’ maximum device storage duration and whether Vendors refresh such duration (by stating, for example, that “duration may expire [n] months/days from your last interaction with the property”, where [n] represents the maximum duration for which the Vendor considers the user consent as valid) as well as, where applicable, review any additional purpose specific storage and access information provided by a Vendor in accordance with the Specifications

   Our IAB TCF v2.4. template allows users to review detailed information about each vendor's data storage and processing practices when selecting the individual vendor option at List of IAB Vendors‎. Each single vendor displays detailed information about Storage Duration, Purpose-Specific Storage, Access Information, and Device Storage Disclosure. Furthermore, information about “Lifespan” in each vendor’s purpose indicate the maximum duration for which consent is considered valid as well as the timeframe for when vendors refresh user’s choice.

   To guarantee adherence to this policy check if you want to customize your Preference Center, it’s recommended to target the following elements:

   • Present a comprehensive list of vendors along with their maximum device storage duration for user consent considering each technology enabled.

   • For each vendor, provide a detailed breakdown of additional purpose-specific storage and access information in accordance with the Specifications.

   • Include information such as the types of data stored, the purposes for which the data is accessed, and any specific methods used for storage or access beyond cookies.

   • Disclose vendor-specific details in a standardized format for all vendors.