IAB TCF: Detailed Overview and FAQ

The TCF (Transparency and Consent Framework) 2.2 is a set of guidelines and technical specifications developed by the Interactive Advertising Bureau (IAB) to facilitate transparency and consent in the online advertising ecosystem, particularly in relation to the General Data Protection Regulation (GDPR) in the European Union.

The TCF provides a standardized way for digital advertising companies, such as publishers, advertisers, and ad technology vendors, to communicate and obtain user consent for the processing of their personal data. It aims to ensure that users have control over their data and are informed about how their data is being used for targeted advertising purposes.

The IAB TCF helps businesses using behavioral advertising comply with the GDPR. If a business is not deploying behavioral advertising, the IAB TCF may not be appropriate. Implementing OneTrust with the IAB Europe Consent Framework empowers publishers to manage the vendors and advertising content which appears on their websites.

The TCF 2.2 is an updated version of the framework, introducing greater transparency and addressing issues identified in earlier versions.

Some key features and enhancements of TCF 2.2 include:

  • Removal of the Legitimate Interest legal basis for advertising and content personalization.

  • Improvements to the information provided to end users.

  • Standardization of additional information about vendors.

  • Transparency on the number of vendors.

  • Specific requirements to facilitate users’ withdrawal of consent.

TCF 2.2 applies to the following:

  • Users who leverage IAB TCF 2.1 across websites or mobile/CTV apps.

  • Users leveraging Google’s publisher products, including Google AdSense, Ad Manager, or AdMob.

For more information on implementing the IAB TCF on your websites, see Implementing TCF on your Website.

IAB Information Flow

OneTrust has partnered with IAB Europe to help publishers meet the transparency, notice, and choice requirements set out by the EU General Data Protection Regulation (GDPR) and ePrivacy Directive (ePD).

As an IAB Europe-approved Universal Consent & Preference Management Provider (CMP), OneTrust helps customers to pull vendor privacy declarations directly from the IAB Europe Global Vendor List and provide necessary information about the approved Vendors. OneTrust customers can capture a site visitor's consent where necessary before personal data is collected and, when approved, share the preferences to Vendors to ensure adherence to the site visitor's choice.



Updated Purpose Names and Descriptions

Purpose Name

Description (TCF 2.1)

Description (TCF 2.2)

Allowable Lawful Bases

Purpose 1

Store and/or access information on a device.

Store and/or access information on a device.

  • Consent

Purpose 2

Select basic ads.

Use limited data to select advertising.

  • Consent

  • Legitimate Interests

Purpose 3

Create a personalized ads profile.

Create profiles for personalized advertising.

  • Consent

Purpose 4

Select personalized ads.

Use profiles to select personalized advertising.

  • Consent

Purpose 5

Create a personalized content profile.

Create profiles to personalize content.

  • Consent

Purpose 6

Select personalized content.

Use profiles to select personalized content.

  • Consent

Purpose 7

Measure ad performance.

Measure advertising performance.

  • Consent

  • Legitimate Interests

Purpose 8

Measure content performance.

Measure content performance.

  • Consent

  • Legitimate Interests

Purpose 9

Apply market research to generate audience insights.

Understand audiences through statistics or combinations of data from different sources.

  • Consent

  • Legitimate Interests

Purpose 10

Develop and improve products.

Develop and improve services.

  • Consent

  • Legitimate Interests

New: Purpose 11

N/A

Use limited data to select content.

  • Consent

  • Legitimate Interests

Special Purposes

Special Purpose 1

Ensure security, prevent fraud, and debug.

Ensure security, prevent and detect fraud, and fix errors

N/A

Special Purpose 2

Technically deliver ads or content.

Deliver and present advertising and content.

N/A

New:

Special Purpose 3

Save and communicate privacy choices

Save and communicate privacy choices

N/A

Features

Feature 1

Match and combine offline data sources.

Match and combine data from other data sources.

N/A

Feature 2

Linking devices.

Link different devices.

N/A

Feature 3

Receive and use automatically-sent device characteristics for identification.

Identify devices based on information transmitted automatically.

N/A

Special Feature 1

Use precise geolocation data.

Use precise geolocation data.

N/A

Special Feature 2

Actively scan device characteristics for identification.

Actively scan device characteristics for identification.

N/A

A full list of stacks features and special features can be found in more detail on the policies here.

IAB TCF 2.2 Technical Specifications

For more information, see IAB Tech Lab: GDPR Transparency and Consent Framework.

TCF 2.2 Timeline

Date

Enhancement

16 May 2023

IAB TCF 2.2 launch.

30th June 2023

Deadline for vendors to update their GVL registration.

20th November 2023

Deadline for implementation.

Deadline for publishers to update their Digital Properties, including web, mobile, and CTV properties.

TCF 2.2 Enhancements

For web properties, users will need to republish their scripts. Mobile/CTV properties will require an update to the SDK.

For more information on implementing the IAB TCF on your websites, see Implementing TCF on your Website.

CMP Functionality Changes

Enhancement

Description

Impacts to Implementation

Removal of the Legitimate Interests legal basis for advertising and content personalization.

Within the scope of the TCF, vendors will only be able to select consent as a legal basis for Purposes 3, 4, 5, and 6 at the registration level.

Users will only be allowed to select consent for Purpose 3, 4, 5, and 6 from within the platform.

Improvements to the information provided to end users.

Names and descriptions of TCF purposes have been redrafted.

The legal text has been removed and replaced by user-friendly descriptions, supplemented by examples of real-world use cases (illustrations).

View Legal Text in layer 2 will be replaced with View Illustrations.

In the future, publishers will have the ability to provide their own custom illustrations.

Standardization of additional information about vendors.

Vendors will be required to provide the following additional information about their data processing operations:

  1. Categories of data collected.

  2. Retention periods on a per-purpose basis.

  3. Legitimate interest(s) at stake (where applicable).

OneTrust will implement an updated Global Vendor List that will disclose the required information per updates to the specification.

Transparency on the number of vendors.

CMPs will be required to disclose the total number of vendors seeking to establish a legal basis on the first layer of their UIs.

OneTrust will display the number of Active Vendors configured in the platform to show on the first layer of the CMP.

Specific requirements to facilitate users’ withdrawal of consent.

Publishers and CMPs will need to ensure that users can resurface the CMP UIs and withdraw consent easily.

OneTrust will provide an updated IAB Enforced Description that explains how to resurface the CMP to withdraw consent.

For more information, see Publishing and Implementing Cookie Consent Scripts or Banner SDK JavaScript API.

For more information, see IAB TCF 2.2 Launches: All You Need To Know.

Additional Implementation Considerations (custom implementation)

Mobile implementation: If you are explicitly updating user consent or Legitimate Interest for a purpose/feature or special purpose/feature, note the difference between the previous and new value for the String Value identifier.

More details on IAB TCF 2.2 for mobile implementations can be found on the Developer Portal.

Description

Previous Identifiers

New TCF 2.2 Identifiers

Purposes

IABV2

IAB2V2

Special purposes

ISPV2

ISP2V2

Features

IFEV2

IFE2V2

Special features

ISFV2

ISF2V2

FAQ

Which stakeholders are responsible for IAB TCF 2.2 updates?

Project Managers,Cookies Admins, and/or legal teams need to upgrade the IAB TCF 2.2 template in OneTrust, make any necessary changes to the template and Global Vendor List (GVL), and publish the website or mobile CMP in the updated version.

Mobile developers upgrade to a new SDK version (if not done already).

Your QA team should test the changes in the staging/production website.

What happens if publishers are not IAB TCF 2.2 compliant by the deadline?

TCStrings created before 20 November 2023 under TCF 2.1 remain valid after 20 November 2023.

TCStrings created after 20 November 2023 under TCF 2.1 will be considered invalid.

After the 20 November 2023 deadline, the OneTrust CMP will allow neither the creation of new TCF 2.1 templates nor publishing for TCF 2.1 templates.

To avoid any revenue impact, please enable TCF 2.2 by the deadline.

Example: if a user were to give consent and generate a TC string and this was created before the 20th of November this string is still valid after the 20th of November 2023.

Is there any deadline from Google to enable TCF 2.2, especially for serving ads in the EEA/UK region using Google Ad Solutions ?

Google requires all publishers and developers (especially any who are using GoGoogle AdSense, Ad Manager, or AdMob) to implement TCF 2.2 via certified CMP platform beginning January 16, 2024. OneTrust is Google’s CMP certified platform.

For more information, see here.

Is re-consent required while publishing the existing IAB-TCF 2.2 template?

Re-consent is not mandatory as the IAB-TCF 2.1 string generated before Nov 20th, 2023 is supported until it expires. It is the discretion of publishers to enable the Re-consent option in the publish screen to show the banner again to all users who have previously provided the consent.

Does the OneTrust platform support other languages for IAB TCF 2.2?

A list of supported languages for the Cookie Consent tool is available here.

OneTrust displays purpose translations outlined from the IAB TCF in the supported languages.

Can you provide an example of the custom Illustrations in Layer 2?

Custom illustrations are the responsibility of publishers. Please work with your legal team to provide illustrations collecting users' personal data for your business needs.

By default, OneTrust lists examples of illustrations provided from the IAB TCF, which can be leveraged as per the specification.

Are there any changes to  TCF API functions? If so, how will it impact publishers?

Yes, the CMP command getTCData has been deprecated. CMPs no longer need to support this command, and only three commands remain mandatory: 'ping', 'addEventListener' and 'removeEventListener'.

The TCF Technical Specifications will now require (not simply recommend) that vendors use event listeners to ensure that any changes to TC Strings are proactively communicated to them and other vendors. In the web environment, vendors with access to JavaScript will be required to register an event listener function (addEventListener) instead of using the getTCData command of the TCF API. This reduces the number of calls that the vendor would need to make to the API in order to obtain the latest TC String using getTCData. In the app environment, vendors must listen to IABTCF_* key updates to retrieve TC Strings from NSUserDefaults (iOS) or SharedPreferences (Android).

What's the procedure if customers need custom descriptions on their IAB TCF banner?

If you plan to customize the text, please contact your OneTrust implementation consultant or reach out to OneTrust Support via the Create a Case web form.

How do publishers need to handle non-IAB vendors?

Publishers need to leverage available OneTrust blocking methods based on how non-vendor tags are added to the site. See the section Third-Party Integrations and Blocking Guidance here.

For mobile consent, publishers can programmatically block or enable vendors based on recent consent changes.

Is IAB TCF for Canada the same as IAB TCF for EEA/UK ?

No, these are separate frameworks that will be handled with different template configurations.

For TCF Canada, there is change in the concept of Legitimate Interest, which is replaced with Implied Consent.