IAB TCF Overview
How the Transparency & Consent Framework works for programmatic ad compliance.
What is the TCF?
The IAB Transparency and Consent Framework (TCF) is an industry standard designed to help organisations in the digital advertising supply chain comply with GDPR and ePrivacy regulations. It provides a standardised way to:
- Collect user consent and legitimate interest opt-outs
- Encode those choices as a consent string
- Pass the consent string to ad tech vendors in the supply chain
- Allow vendors to read the string and act on the encoded consent choices
The current version is TCF v2.2 (as of 2023). IAB Europe maintains the framework and the Global Vendor List (GVL) — a registry of ad tech vendors who have agreed to the TCF policies.
How It Works in Practice
1. CMP Presents Choices
A Consent Management Platform (CMP) — registered on the IAB's CMP list — displays a consent banner to users. The banner presents:
- The purposes for which vendors want to process data (e.g. "Store and/or access information on a device")
- The vendors requesting consent or claiming legitimate interests
2. User Makes a Choice
The user accepts, rejects, or configures preferences by purpose and/or vendor.
3. Consent String is Generated
The CMP encodes the user's choices into a TC string — a base64-encoded string stored in a first-party cookie and/or local storage. The string records:
- Timestamp and CMP ID
- Consent and legitimate interest signals per purpose
- Consent and legitimate interest signals per vendor
4. Vendors Read the String
Ad tech vendors (ad server, SSP, DSP, measurement) read the TC string via the CMP API (window.__tcfapi). Vendors are required by the TCF policy to:
- Check whether they have the consent or legitimate interest needed for their processing
- Refrain from processing if they do not have the required signal
TCF and CTV
TCF was primarily designed for web environments. CTV presents challenges:
- No standardised cookie storage on CTV devices
- TCF string transmission typically happens via URL parameters in ad requests or via server-side mediation
- Some SSPs have implemented CTV-specific TCF signal passing — check with your specific partners
- GPP (see GPP overview) is increasingly the preferred framework for multi-environment consent signal transmission
Key Limitations
- TCF compliance does not guarantee GDPR compliance — it is a tool to help implement consent, not a complete compliance solution
- The "legitimate interests" mechanism within TCF has been subject to regulatory scrutiny — confirm with legal counsel how it applies to your use cases
- Non-EEA/UK contexts: TCF is an EU/UK-centric framework; other markets require different or additional signals
Need to implement TCF for your CTV ad stack?
Book a call to review your CMP selection, vendor configuration, and signal propagation setup.