IAB TCF FAQ

Why would I use IAB Transparency and Consent Framework (TCF)?

The IAB TCF was created to support parties who display and manage digital advertising and targeted content comply with the European Union's General Data Protection Regulation (GDPR) and ePrivacy Directive (ePD). The framework helps to clarify how data is collected and use as well as the legal basis for processing data.

What's new for IAB TCF 2.0?

IAB TCF 2.0 is the result of continuous consultation with it's users and a broad base of stakeholders. The new version introduces the "right to object" to a processors "legitimate processing" legal basis for data processing. IAB TCF 2.0 has been designed to give enhanced transparency and choice to consumers while providing enhanced control to publishers. This is accomplished by incorporating the following changes:

Enhanced Purpose Granularity

The purposes of data processing have been extensively revised to provide additional granularity. Individual purposes have been further subdivided increasing the total number purposes from five to ten. Two Special Purposes have also been added. Features have also been increased to five with two of the Features being designated Special Features requiring opt-in.

Right to Object

Users will be able to communicate their Right to Object to processing on the basis of the Legitimate Interest for processing directly to CMPs. The objections will be communicated by the CMP to Vendors by Purpose.

More Complete Accommodation of Legitimate Interests

Vendors will be more accountable for whether their "legitimate interest" legal basis has been acknowledged. The vendor will receive an explicit signal that it has been acknowledged.

Granular Controls

New, more granular controls give publishers more control over the data processing purposes allowed on a per vendor basis. Publishers can create different rules for each Vendor or group of Vendors.

Application of Policies

Greater support for the users of the framework in the application of the policies, terms and conditions, and technical specifications.

Flexible Vendor Legal Bases

Vendors are able to register flexible and default legal basis to accommodate regional legal differences.

Where can I access the full IAB TCF documentation?

You can find all of the documentation from the IAB TCF here.

Is IAB TCF 2.0 compatible with the previous version?

There is no backwards compatibility for previous versions of the IAB TCF. The TCF purposes have changed and must be reassigned. Re-consent is required.

The banner and preference center text is locked down for my TCF v2.0 template. Am I able to input my own text in the template?

This is done due to the strict IAB TCF 2.0 policies. You are able to input custom text for the banner and preference center. If you choose to put together custom text to override the standard template IAB Europe approved notice description for the first or second layer, any adjustments to text must adhere to TCF standards. To ensure compliance with IAB TCF policies, this article details the steps required to review and address requirements of disclosures for the first layer (Banner), and second layer (Preference Center) of the CMP. All checks must be accounted for and the text in English provided to your OneTrust Implementation Consultant or the OneTrust Support Team to process for approval by IAB Europe. If you do not have a consultant, please contact OneTrust Support using the Create a Case web form. The approval process can take up to four to six weeks.

I would like to change the look and feel of my TCF v2.0 banner, including the buttons. How can I ensure that the calls to action on my banner are compliant with the IAB TCF v2.0 policy?

TCF v2.0 policies have been updated to require identical text treatment and a minimum contrast ratio of 5:1 for the calls to action on the first layer, the I Accept and Show Purposes buttons on the banner. You can see examples of what is compliant here and test your contrast ratio here. Keep this policy in mind when updating styling or using any custom CSS.

Are cookies required for working with the Universal Consent & Preference Management Provider API?

Yes, IAB TCF 2.0 depends on cookies to store consent data. The consent data is stored in the euconsentV2 cookie.

If I make a custom change to my vendor list in the Cookie Consent application will the user automatically be forced to re-consent?

No, if you make a custom change to your vendor list and want users to re-consent, you must select the option in the publish modal when re-publishing the script.

Does a Vendor has to be part of TCF 2.0 framework to claim Legal Basis outside of TCF? Who declares the Legal Basis, the Vendor or the Publisher?

Yes, the Vendor must register with the IAB TCF as this signal is relayed by a vendor ID which comes from the IAB Global Vendor List.

How are Vendors that have not joined the IAB framework reflected in the TC string?

These Vendors are not relayed in the TC string. OneTrust can disclose these separately if desired and leverages the base tracking control tools to manage these Vendors.

If user provided consent to a site, then visited a second site and rejected the consent, which user consent status will be applicable to first site?

The consent given on the first site will be taken from the euconsent third-party cookie.

What if I don't receive the Transparency and Consent string?

If the transparency or consent is not received, you will not be able to process the user's data.

What’s the TC String format?

The format is [ Core String ].[ Disclosed Vendors ].[ Allowed Vendors ].[ Publisher TC ]. See IAB TCF 2.0 Consent String for further detail. IAB TCF 2.0 Consent String

CODE 
BObdrPUOevsguAfDqFENCNAAAAAmeAAA.PVAfDObdrA.DqFENCAmeAENCDA.OevsguAfDq

Does DisclosedVendors represents vendors we choose to disclose to capture consent without establishing OOB legal basis?

This signals that generally you support OOB and that these vendors have been disclosed at some point in the global context.

For OOB legal basis establishment, is the AllowedVendor segment supported in the service-specific string?

Yes, this is specific to service-specific string as it is dictated by the publisher.

Do we need to establish data processing purposes for our own uses via CMP consent?

This may be done for enhanced transparency and consolidation. This may also be achieved through the standard cookie categories and controls.

How is the Global Vendor List updated? How often is it updated.

The Global Vendor List (GVL) is automatically updated once a week.