Managing the IAB TCF Global Vendor List

Note:

As of September 2021, global scope will no longer be supported per the recent TCF Policy and Technical Specifications. To view the formal notification, please refer to the IAB Europe PDF Notification and IAB Europe PDF Notification Update.

The IAB TCF Global Vendor List (GVL) consists of Vendors that have signed onto the Transparency and Consent Framework and been approved by the IAB. The GVL is maintained by the IAB and updated weekly. In the Cookie Consent module, OneTrust provides and maintains an up to date copy of the GVL. You can edit list this by inactivating individual Vendors or altering their legal bases for processing.

When a Vendor is added to the GVL, they choose Purposes and Features consistent with how data will be processed as well as the legal bases for processing. Their choices are Consent and Legitimate Interest. Some vendors choose to operate flexibly, meaning that they will operate on both Consent or Legitimate Interest for a purpose, but choose one as priority. If you override a legal basis for a vendor that operates flexibly on a purpose, this will set a Publisher Restriction in the tcData.



For Consent as a legal basis, the user must provide consent to that Purpose for the Vendor to be able to process data. When a Vendor chooses Legitimate Interest as a purpose of processing, the user does not need to consent for that purpose in order for the Vendor to process data.

To add an IAB Vendor List

  1. On the On the Cookie Consent menu, select Vendor.

    The Vendor List screen appears.

  2. Click the Add IAB Vendor button.

    Add IAB Vendor List modal

    The Add Vendor List modal appears.

  3. In the Name field, enter a unique name for the vendor list.
  4. In the Organization field, select the organization which is responsible for the vendor list.
  5. In the Description field, enter a brief description of the vendor list.
  6. Click the Add button.
  7. The list will contain the current IAB TCF Global Vendor list with all Vendors in the active status.
Note:

Using a custom list which has overrides Vendor List will set isIABGlobal to False in the OptanonConsent cookie due to IAB TCF 2.0 guidelines. The following scenarios are possible for isIABGlobal.

Setting

Explanation

True

Set Global EU Consent is enabled for the Geolocation Rule and you are using the IAB Global Vendor list or your Vendor List does not contain overrides. The euconsent-v2 cookie will write to the cookies.onetrust.mgr.consensu.org domain.

False

Set Global EU Consent is disabled and/or your Vendor List contains overrides. The eupubconsent-v2 cookie will set as a first-party cookie.

Prevent cross-site tracking is enabled in the Safari browser. For Safari, this is the default setting. The eupubconsent-v2 cookie will set as a first-party.

To edit vendor status and legal bases

  1. On the Cookie Compliance menu, select Vendor. The Vendor List screen appears.

  2. Navigate to the IAB Vendor tab.
  3. Select a version from the list. The Vendor Details screen appears.

  4. Select the Vendor List by clicking on the Name. The Vendor Details modal appears.

  5. Select a the Vendor to edit. The Vendor modal appears.


  6. Click the Edit button to change the Vendor's status or legal bases.
  7. Click the Save button.

To bulk edit vendor legal bases

  1. On the Cookie Compliance menu, select Vendor. The Vendor List screen appears.

  2. Navigate to the IAB Vendor tab.
  3. Select a version from the list. The Vendor Details screen appears.

  4. Use the checkbox to select one or more Vendors. The Manage Legal Basis and Edit Status buttons become active.


  5. Click the Manage Legal Bases button. The Manage Legal Bases modal appears.


    Note:

    You can enable one of the two following settings:

    Apply restrictions to all newly added vendors applies your current overrides to new vendors in the IAB Global Vendor List. This configuration will only be available when managing legal bases for all vendors.

    Add New Vendors as Inactive automatically adds vendors as inactive as part of the Global Vendor List Updates. This configuration will only be available when managing legal bases for all vendors.

  6. Enable or disable the Consent and Legitimate Interest legal bases for each purpose for the vendors that you have selected.
  7. Click the Save button.
Note:

If you override legal bases for any vendors, the CMP will operate at a Service Specific Scope.

Setting overrides on the vendor list creates Publisher Restrictions in the tcData. Publisher Restrictions are the restrictions of a vendor's data processing by a publisher within the context of the users trafficking their digital property. For more about Publisher Restrictions in the tcData, see IAB Publisher Restrictions.

Attention:

If you are overriding legal bases for all vendors, it could cause the Publisher Restrictions to enlarge the size of the eupubconsent-v2 cookie to a size that is incompatible with the browser. Make sure to disable any vendors that for which your website does not publish ads. This is an IAB issue and we are working together to find a solution.

To bulk edit vendor status

  1. On the Cookie Compliance menu, select Vendor. The Vendor List screen appears.

  2. Navigate to the IAB Vendor tab.
  3. Select a version from the list. The Vendor Details screen appears.

  4. Use the checkbox to select one or more Vendors. The Manage Legal Basis and Edit Status buttons become active.
  5. Click the Edit Status button. The Edit Status modal appears.


  6. Select the Active or Inactive status for the Vendor.
  7. Click the Save button.

To revert a Vendor List to default

If you have made edits to your vendor list and want to undo all overrides or get the vendor list back to the default state, use the Revert to Default button.

  1. On the Cookie Compliance menu, select Vendor. The Vendor List screen appears.

  2. Navigate to the IAB Vendor tab.
  3. Select a version from the list. The Vendor Details screen appears.

  4. Select the Revert to Default button in the upper right hand corner of your Vendor List.
  5. Confirm the action if you would like to revert your vendor list to the default state.


  6. Republish any domain scripts that are associated with the Vendor List for where you would like to see the changes applied.