IAB TCF — The Transparency & Consent Framework
What the IAB Europe TCF is, how it standardized consent strings, and what v2.3 changed.
The IAB Europe Transparency & Consent Framework (TCF) is not a law. It’s a technical standard, a way for publishers, advertisers, and consent platforms to communicate consent decisions across the programmatic advertising ecosystem. Our GDPR guide covers the legal backdrop; TCF is the plumbing that carries those decisions through the ad chain.
If you run ads on your site through Google AdSense, OpenRTB, or any real-time bidding system, TCF is how your consent signals reach the ad networks.
Why TCF exists
Programmatic advertising is a chain. A publisher’s consent banner collects consent. Then dozens of ad tech vendors need to know what the user consented to. Without a standard format, each vendor would need its own consent API.
TCF provides:
- A standardized consent string (the “TC string”)
- A global vendor list (GVL), where every ad tech vendor registers and declares their data practices
- A protocol for CMPs (consent management platforms) to transmit consent to vendors
How it works
- A publisher runs a TCF-registered CMP (like Zest)
- The CMP presents a consent banner with purposes, vendors, and legitimate interest disclosures
- The user makes choices
- The CMP encodes these choices into a TC string
- Ad tech vendors read the TC string and respect the choices
The TC string travels in the OpenRTB bid request. Every vendor in the chain sees whether they have consent or not. For Google-specific ad tags, that string also feeds into Google Consent Mode; for non-Google trackers, the same choices govern tracking pixels.
TCF v2.3: what changed
Version 2.3 (effective 2024) tightened rules. Key changes:
- Removed legitimate interest as a legal basis for advertising and content personalization. Vendors must get explicit consent for these purposes. No more “legitimate interest” workaround for targeted ads.
- Clearer purpose descriptions: purposes must be described in plain language that users can understand.
- Stricter vendor disclosure requirements: vendors must be more specific about what data they collect and why.
- Better transparency for users: the consent banner must make it obvious how many vendors are requesting data and for what.
This was a big deal. TCF 2.3 essentially aligned with GDPR’s strict consent interpretation. “Legitimate interest” was the loophole for years. v2.3 closed it.
CMP registration
To participate in TCF, a CMP must be registered with IAB Europe and certified for compliance. Zest is pursuing TCF registration.
How Zest handles it
Zest collects granular consent by purpose and vendor, generates TC strings, and integrates with ad delivery systems. If your revenue depends on programmatic ads, TCF support is not optional, and Zest delivers it.