Digital advertisers and publishers face a deadline of February 28, 2026, to adopt the latest iteration of the IAB Transparency & Consent Framework (TCF), version 2.3. The update, launched in April 2025, aims to resolve ambiguities surrounding the use of “legitimate interest” as a legal basis for processing user data, according to IAB Europe.
The TCF, initially launched in 2017, was developed as a collaborative effort involving over 70 member companies and trade associations, in anticipation of the General Data Protection Regulation (GDPR) coming into force in May 2018. The GDPR sought to harmonize data privacy laws across Europe and grant individuals greater control over their personal information. Version 1.1 of the TCF followed in April 2018, and a significant overhaul, TCF 2.0, was released in August 2019, giving publishers more control over which third-party vendors could access user data and for what purposes.
Subsequent versions, 2.1 in August 2020 and 2.2 in May 2023, responded to rulings and guidance from data protection authorities. Version 2.1 addressed a ruling from the Court of Justice of the European Union regarding the disclosure of cookie durations, although version 2.2 removed “legitimate interest” as a permissible legal basis for advertising and content personalization, requiring explicit consent instead. The changes in 2.2 also focused on improving the user interface of consent management platforms (CMPs) to enhance transparency and user understanding.
TCF v2.3 repurposes the ‘Disclosed Vendors’ section, making it a mandatory component of the TC string. This change is intended to further strengthen transparency and ensure compliance with GDPR requirements. The IAB Framework is designed to support publishers, advertisers, and technology vendors in meeting the transparency and consent requirements defined by the GDPR, enabling the transmission of user choices across the advertising supply chain.
The framework applies to a range of online entities, including online newspapers, magazines, publishing houses, and media companies. The IAB TCF sets a standardized method for cooperation between these entities to meet GDPR requirements, according to Secure Privacy.
