First Layer UI

This section explains what's essential to review in your first layer UI (cookie banner) to adhere to the TCF Policies:

  1. Must include information about the fact that information is stored on and/or accessed from the user’s device (e.g. use of cookies, device identifiers, or other device data);

    The 1st layer of the UI refers to the Cookie Banner that the site visitor is shown on the initial visit. Our IAB TCF v2.4. template provides the necessary disclosures of those elements communicating the access/storage via cookies (or similar identifiers) through user’s device. We use the verbiage “use cookies to store and/or access personal data on user’s device.”

    To guarantee adherence to this policy check if you want to customize your banner, it’s recommended to target the following elements:

    • The banner must explicitly convey the message that information is stored on and/or accessed from the user's device.

    • Use clear and concise language to inform users about the types of data storage or access methods employed, such as cookies, device identifiers, or other device data.

    • Ensure transparency in the language used to describe the data practices. Avoid technical jargon and use terms that are easily understandable by the average user.

    • Provide a brief explanation of how and why the information is stored or accessed.

  2. Must include information about the fact that personal data is processed, and the nature of the personal data processed (e.g. unique identifiers, browsing data);

    Our IAB TCF v2.4. template discloses the fact that personal data is processed, and the nature of personal data processed, via the following clause in our out of the box template:

    “We and our [VENDOR_NUMBER] partners use cookies to store and/or access personal data on user’s device, such as unique IDs.”

    • Convey the message that personal data is processed.

    • Disclose what kind of processing is used (e.g., storing or accessing).

    • Use clear and concise language to inform users about the nature of the personal data processed, such as unique identifiers, browsing data, or any other relevant information.

  3. Must include information about the fact that third party Vendors will be storing and/or accessing information from the user’s device and processing their personal data, the number of third-party Vendors (which may also include Vendors not participating in the Framework); and a link to the list of named third parties;

    Our IAB TCF v2.4. template discloses the fact that a specified number of third-party Vendors will be storing and/or accessing information from the user’s device. The number of vendors is a variable [VENDOR_NUMBER] automatically calculated based on what partners you have registered throughout your tracker’s classification journey.

    We disclose the list of named third parties via a specific link (the “List of Partners”), enabling user’s access to the second layer UI (Preference Center) for a detailed description of each vendor’s processing element, such as purposes and technologies enabled.

    To guarantee adherence to this policy check if you want to customize your banner, it’s recommended to target the following elements:

    • Convey the message that third-party vendors will be storing and/or accessing information from the user's device and processing their personal data.

    • Disclose the number of third-party vendors engaged in this processing activity.

    • Include a link within the banner leading to a list of named third parties. This list should encompass all relevant vendors, even those not participating in the Framework.

  4. Must include the list of the distinct and separate Purposes for which the Vendors are processing data, using at least the standardized names and/or Stack names as defined in Appendix A;

    Our IAB TCF v2.4. template discloses automatically under the section Data Processing Declaration the special features, purposes, and/or stacks your organization utilizes. When you customize your Preference Center, this information dynamically populates based on what elements you enable or disable through IAB Groups.

    To guarantee adherence to this policy check if you want to customize your banner, it’s recommended to target the following elements:

    • Include a clear and easily accessible list of distinct and separate purposes for which vendors are processing data. This list should align with the standardized names and/or Stack names defined in Appendix A of the framework. This information must mirror what you have disclosed as IAB Groups for purposes, stacks, features, and special features in your Preference Center.

    • Ensure that the purposes are presented in a transparent and understandable manner, avoiding technical jargon, and providing terms that are user-friendly. It’s advisable to use as maximum as possible the descriptions provided by IAB as User-friendly text for each element (Appendix A).

    • Regularly update the list to reflect any changes in data processing purposes adopted. Keeping the information current enhances user trust and compliance with framework policies.

    CAUTION:

    The IAB Europe TCF Policies do not explicitly prohibit the creation of new stacks. However, creating new stacks is considered a CMP customization at the Publisher level, impacting overall compliance with the Framework. Publishers intending to create new stacks should be aware of specific obligations outlined in Sections 7 and 8 of the Policies.

    Publishers customizing stacks must take responsibility for compliance with CMP Policies as they will need to register a private CMP within the Framework and obtain a designated private CMP ID. Additionally, modified stack descriptions should accurately cover all purposes within the stack, meeting the same level of detail and coverage as standard descriptions.

    Any customization outside the specified logic may be considered a violation (Section 8 – Accountability). Such violations could lead to temporary suspension by the MO, who may inform CMPs of the non-compliance.

  5. Must include information about the Special Features used by the Vendors when processing data;

    Our IAB TCF v2.4. template discloses automatically under the section Data Processing Declaration the special features, purposes, and/or stacks your organization utilizes. When you customize your Preference Center, this information dynamically populates based on what elements you enable or disable through IAB Groups.

    To guarantee adherence to this policy check if you want to customize your banner, it’s recommended to target the following elements:

    • Include explicitly the disclosure of special features used in combination with adopted purposes. Those features are the ones listed on Appendix A – Section D (Special Features) in the Policies:

      1. Use precise geolocation data.

      2. Actively scan device characteristics for identification.

  6. Should include information about the consequences (if any) of consenting or not consenting (including withdrawing consent);

    Our IAB TCF v2.4. template discloses brief information about how users can modify their preferences at any time: “You may accept manage your choices by clicking below or at any time in the privacy policy page”. As this requirement is optional for the first layer UI, our template contains detailed information about the consequences of consenting or not consenting under the second layer UI.

  7. Must include information about the scope of the consent choice, i.e. service-specific consent, or group-specific consent. If group-specific consent, a link with information about the group;

    Our IAB TCF v2.4. template provides a customizable text-based variable called CONSENT_SCOPE. This variable provides the ability to select the specific domain, application, or group of domains/applications reading and respecting user’s choice.

    When selecting CONSENT_SCOPE, you will be able to determine the consent coverage using one of our default expressions to fulfill the sentence, “Your choices will have effect in our [CONSENT_SCOPE]”.

    • Website

    • Application

    • Service

    • Group of Websites

    • Group of Applications

    • Affiliated Companies

    • Affiliated Websites

For TCF 2.4, custom text should accurately explain both where the choice applies and, where applicable, the browsers, devices, or authenticated experiences affected by that choice.

Recommended custom text structure:

Your choices will have effect within our [CONSENT_SCOPE] and will affect [INSERT_DEVICE(S)_SCOPE].

Implementation Example custom text How the placeholders are used
Single website and device Your choices will have effect within this website only and will affect only the browser and device you are currently using. [CONSENT_SCOPE] = Website; device scope = current browser and device.
Group of websites, current device Your choices will have effect within our Group of Websites, which includes website-a.com, website-b.com, and website-c.com, and will affect only the browser and device you are currently using. The websites define the group-specific scope. The final clause defines device scope.
Group of websites, authenticated devices Your choices will have effect within our Group of Websites, which includes website-a.com, website-b.com, and website-c.com, and will affect all browsers and devices associated with your account. The group identifies the covered properties. The device scope explains cross-device persistence.
Website and application Your choices will have effect within our Website and Application and will affect your mobile application and authenticated web browsers. Use only when the configured scope spans both channels.
Digital services across devices Your choices will have effect within our Digital Services and will affect the devices associated with your account, including your mobile application, tablet, and desktop browser. Use only when the implementation applies choices across the listed experiences.
Important: [INSERT_DEVICE(S)_SCOPE] is a drafting placeholder, not a separate predefined OneTrust configuration option. Replace it with wording that accurately reflects the implementation. Do not imply that choices apply across websites, applications, browsers, or devices when that behavior is not implemented.

To guarantee adherence to this policy check if you want to customize your banner, it’s recommended to target the following elements:

  • Clearly inform users about the scope of the consent choice. Specify whether the consent is service-specific or group-specific.
  • If the consent is group-specific, provide a link within the consent banner leading to detailed information about the group. This information should include a comprehensive overview of the entities or services included in the group and their respective data processing activities.
  1. Must include information about the fact that the user can withdraw their consent at any time, and how to resurface the Framework UI in order to do so;

    Our IAB TCF v2.4 template discloses brief information about how users can modify their preferences at anytime:

    We and our [VENDOR_NUMBER] partners store and access personal data, like browsing data or unique identifiers, on your device. Selecting "I Accept" enables tracking technologies to support the purposes shown under "we and our partners process data to provide," whereas selecting "Reject All" or withdrawing your consent will disable them. If trackers are disabled, some content and ads you see may not be as relevant to you. You can resurface this menu to change your choices or withdraw consent at any time by clicking the [PRIVACY_PREFERENCES] link on the bottom of the webpage [or the floating icon on the bottom-left of the webpage, if applicable]. Your choices will have effect within our [CONSENT_SCOPE] and will affect [INSERT_DEVICE(S)_SCOPE]. For more details, refer to our Privacy Policy.

    To guarantee adherence to this policy check if you customize your banner, it’s recommended to target the following elements:

    • Clearly communicate to users that they have the right to withdraw their consent at any time.
    • Demonstrate in which way users can resurface the framework UI (e.g., by clicking a floating icon or by clicking a link at the bottom of a webpage).
    • Clearly describe how users can withdraw their consent at any time.
  2. Should include information about the fact that some Vendors (if any) are not requesting consent, but processing the user’s data on the basis of their legitimate interest; the fact that the user has a right to object to such processing; and a link to the relevant layer of the Framework UI dealing with processing on the basis of legitimate interests where more information can be found;

    Our IAB TCF v2.4. template discloses this information at the second layer UI as this is not a mandatory requirement for the first layer UI. Users can review the second layer UI accessing the Preference Center through the button “Show Purposes”.

  3. Must include a call to action for the user to express their consent (for example, “Accept”, “Okay”, “Approve”, etc.);

    Our IAB TCF v2.4. template has the button to “I Accept” to display the clear call for action to user’s consent. As our first layer UI presents a global consent option, OneTrust provides both at the banner and preference center a symmetrical global rejection option “Reject All” when leveraging an IAB TCF 2.4 template. The Reject All button and its text is now required by the IAB for the preference center to be TCF 2.4 compliant.

    To guarantee adherence to this policy check if you want to customize your banner, it’s recommended to target the following elements:

    • Clearly include a call to action prompting the user to express their consent. Common examples include "Accept," "Okay," "Approve," or other equally affirmative terms.
    • Ensure that the call to action is prominently displayed and easily distinguishable from other elements on the banner, making it clear to the user what action is expected.
    • Use clear and concise language in the call to action, avoiding ambiguity and ensuring that users understand that, by taking this action, for what they are providing consent.
  4. Must include a call to action for the user to customise their choices (for example “Advanced Settings”, “Customise Choices”, etc.).

    Our IAB TCF v2.4. template has the button to “Show Purposes” to display the call for action considering user’s ability to customize their choices.

    To guarantee adherence to this policy check if you want to customize your banner, it’s recommended to target the following elements:

    • Ensure that the call to action for customization is prominently displayed and easily distinguishable from other elements on the banner. This helps users identify and access the option to customize their consent choices.
    • Use clear and concise language in the call to action, avoiding ambiguity and ensuring that users understand that, by selecting this option, they can modify their consent preferences.