IAB TCF 2.2: Transparency & Consent Framework Explained

The General Data Protection Regulation (GDPR) and ePrivacy Directive fundamentally changed how digital advertising operates in Europe. To provide a standardized mechanism for collecting, storing, and transmitting user consent across the programmatic supply chain, the IAB Europe created the Transparency & Consent Framework (TCF). The latest version, TCF 2.2, represents significant improvements in user transparency and technical robustness.

What Is the TCF?

The TCF is a standardized protocol that enables publishers, consent management platforms (CMPs), ad tech vendors, and advertisers to communicate user consent preferences across the digital advertising ecosystem. It defines a common language for expressing which data processing purposes a user has consented to, which vendors have been granted consent, and what legal basis applies to each processing activity.

Without the TCF, every publisher would need to build custom integrations with hundreds of ad tech vendors to communicate consent. The framework provides a universal standard that all participants can implement, dramatically reducing integration complexity while ensuring regulatory compliance.

The Three Pillars

1. Transparency: Users are informed about which vendors process their data and for what purposes.
2. Consent: Users can grant or withhold consent for specific purposes and vendors.
3. Portability: Consent signals are transmitted through the supply chain via a standardized string format, enabling all parties to act on the same information.

Version History: From TCF 1.0 to 2.2

What Changed in TCF 2.2

TCF 2.2 introduced several critical changes driven by regulatory feedback and enforcement actions:

• Legitimate interest removed for key purposes: Vendors can no longer rely on legitimate interest as a legal basis for purposes 3 (ad selection) and 4 (ad delivery). These purposes now require explicit consent.
• Data retention disclosure: Vendors must disclose their data retention periods for each purpose, providing greater transparency to users.
• Enhanced CMP requirements: CMPs must present vendor information in a more user-friendly manner, including the number of vendors seeking consent and their data retention policies.
• Improved consent quality: The framework aims to produce more informed and meaningful consent by making information more accessible.

Consent String Format

The TC (Transparency & Consent) String is a compact, base64url-encoded data structure that captures all consent information for a single user. It is transmitted through the programmatic supply chain via OpenRTB bid requests, cookies, and the CMP API.

Core Segments

A complete TC String in TCF 2.2 consists of multiple segments separated by dots:

# Example TC String (simplified)
CPyXXMAPyXXMAPAGABCABAEIAAACgAAQgABAAgABgAAAAAA
    |           |
    |           +-- Publisher TC segment (publisher-specific consent)
    +-------------- Core TC segment (vendor consent + legitimate interest)

# Full structure:
# CoreTC.PublisherTC.DVString (optional disclosed vendors)
# CoreTC.PublisherTC.PubRestrictions (optional)

Key Fields in the Core Segment

The Global Vendor List (GVL)

The Global Vendor List is a centrally maintained JSON file hosted by IAB Europe that defines all registered vendors, their declared purposes, and their privacy policies. Every participant in the TCF ecosystem references the same GVL to ensure consistency.

# GVL structure (simplified)
{
  "gvlSpecificationVersion": 3,
  "vendorListVersion": 284,
  "tcfPolicyVersion": 4,
  "lastUpdated": "2026-10-15T00:00:00Z",
  "purposes": {
    "1": { "id": 1, "name": "Store and/or access information on a device", ... },
    "2": { "id": 2, "name": "Use basic ads", ... },
    "3": { "id": 3, "name": "Create a personalised ads profile", ... }
  },
  "vendors": {
    "1": {
      "id": 1,
      "name": "Example Ad Tech Inc.",
      "purposes": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10],
      "legIntPurposes": [],
      "specialFeatures": [1],
      "policyUrl": "https://example.com/privacy",
      "dataRetention": { "stdRetention": 90, "purposes":  }
    }
  }
}

Vendor Registration

To be included in the GVL, a vendor must register with IAB Europe, declare their data processing purposes, provide privacy policy URLs, and pass a compliance review. As of 2026, the GVL contains over 1,000 registered vendors. The list is updated weekly, and all TCF participants must refresh their local copies regularly.

Legal Basis Signals

One of TCF 2.0's most important additions (carried forward to 2.2) is support for multiple legal bases under GDPR:

Consent (Article 6(1)(a))

The user has given explicit, informed consent for a specific processing purpose. In the TC String, this is represented by the VendorConsents and PurposeConsents bitfields.

Legitimate Interest (Article 6(1)(f))

The vendor has established a legitimate interest for processing, and the user has not objected. Represented by VendorLegitimateInterest and PurposeLegitimateInterest bitfields.

Publisher Restrictions

Publishers can override vendor legal basis declarations through publisher restrictions. For example, a publisher might allow a vendor to process data for purpose 7 (ad measurement) only under legitimate interest, not consent. These restrictions are encoded in the publisher TC segment.

A DSP receiving a bid request with TCF data must evaluate both the consent signal AND the legal basis signal for each vendor and purpose combination. If a vendor requires consent for purpose 4, and the user has not consented, the vendor must not process that user's data regardless of legitimate interest status.

CMP Integration

What Is a CMP?

A Consent Management Platform is the user-facing component that collects consent choices. CMPs display consent banners, preference centers, and vendor lists to users, then generate and store the resulting TC String.

CMP API

TCF-compliant CMPs expose a JavaScript API (__tcfapi) on web pages and a corresponding native API on mobile. Other scripts and SDKs on the page call this API to read the current consent state:

// Web: Reading consent via the CMP API
window.__tcfapi('getTCData', 2, function(tcData, success) {
  if (success) {
    console.log('TC String:', tcData.tcString);
    console.log('Purpose 1 consent:', tcData.purpose.consents[1]);
    console.log('Vendor 42 consent:', tcData.vendor.consents[42]);
  }
});

// Web: Listening for consent changes
window.__tcfapi('addEventListener', 2, function(tcData, success) {
  if (success && tcData.eventStatus === 'tcloaded') {
    // Consent data is available
    processConsent(tcData);
  }
});

TC String in OpenRTB

In programmatic bid requests, the TC String is transmitted through the OpenRTB regs.ext.gdpr and user.ext.consent fields (OpenRTB 2.5) or through the regs.gdpr and user.consent fields (OpenRTB 2.6). The SSP passes these values from the publisher's CMP through to all potential buyers.

// OpenRTB 2.6 bid request with TCF data
{
  "regs": {
    "gdpr": 1
  },
  "user": {
    "consent": "CPyXXMAPyXXMAPAGABCABAEIAAACgAAQgABAAgABg..."
  }
}

GDPR Compliance Considerations

Implementing TCF correctly is necessary but not sufficient for full GDPR compliance. Organizations should consider:

• Validity of consent: The CJEU and European Data Protection Board have clarified that pre-ticked boxes, cookie walls (with limited exceptions), and bundled consent do not constitute valid consent under GDPR.
• Withdrawal mechanism: Users must be able to withdraw consent as easily as they gave it. CMPs must provide persistent access to preference controls.
• Consent lifespan: While the TCF does not define a mandatory consent expiry period, many CMPs implement a 13-month maximum lifespan aligned with cookie consent guidelines from several EU data protection authorities.
• CMP certification: IAB Europe maintains a CMP compliance program. Publishers should use certified CMPs to ensure their consent collection meets TCF standards.

Implementation Guide

For Publishers

1. Select a certified CMP from the IAB Europe CMP registry.
2. Configure the CMP with your vendor list, ensuring only GVL-registered vendors are included.
3. Implement publisher-level restrictions if you want to override vendor legal basis declarations.
4. Ensure the TC String is passed to your SSP partners through the appropriate OpenRTB fields.
5. Test your implementation using the IAB's validation tools to confirm TC String integrity.

For DSPs and Ad Tech Vendors

1. Register in the GVL with accurate purpose declarations and privacy policy URLs.
2. Parse the TC String from incoming bid requests using IAB-provided decoder libraries.
3. For each bid, verify that consent exists for your vendor ID and all required purposes before processing personal data.
4. Respect publisher restrictions and legal basis configurations.
5. Maintain audit logs of consent-based processing decisions for regulatory inquiries.

Challenges and Regulatory Outlook

The TCF has faced significant regulatory scrutiny. In February 2022, the Belgian Data Protection Authority (APD) ruled that the TCF 2.0 did not fully comply with GDPR, particularly regarding the legal basis for processing. IAB Europe appealed and subsequently released TCF 2.2 to address several concerns.

Key ongoing challenges include:

• Ensuring CMPs present information in a genuinely user-friendly manner rather than using dark patterns to maximize consent rates
• Addressing the tension between the TCF's legitimate interest provisions and regulatory guidance requiring consent for most ad tech processing
• Supporting emerging regulations beyond GDPR, including Brazil's LGPD and state-level US privacy laws
• Preventing TC String manipulation and ensuring the integrity of consent signals throughout the supply chain