Digital advertisers and publishers face a deadline of February 28, 2026, to adopt the latest iteration of the Transparency & Consent Framework (TCF), version 2.3, according to IAB Europe. The update, launched in April 2025, addresses ambiguities surrounding “legitimate interest” as a legal basis for data processing under the General Data Protection Regulation (GDPR).
The TCF, initially launched in 2018 in anticipation of GDPR’s enforcement, is a collaborative effort involving over 70 member companies and trade associations, supported by IAB Europe staff. Its purpose is to establish an industry standard for obtaining user consent for data processing, aiming to balance user privacy with the needs of the digital advertising ecosystem. Version 1.1 followed in April 2018, with subsequent versions – 2.0 in August 2019, 2.1 in August 2020, and 2.2 in May 2023 – responding to evolving legal interpretations and industry needs.
TCF v2.3 repurposes and mandates the use of the “Disclosed Vendors” section within the Transparency and Consent String (TC string). Previously, this section was optional. The change aims to provide greater clarity to users regarding which vendors are processing their data, even when legitimate interest is invoked as the legal basis. The IAB Tech Lab stewards the technical specifications for the TCF, working in collaboration with IAB Europe to maintain and iterate the framework.
The framework consists of technical specifications and policies applicable to publishers, advertisers, technology providers, and Consent Management Platform (CMP) providers. Participants are required to adhere to these policies to maintain their involvement and are prohibited from modifying the framework’s implementation without explicit authorization. Participants must also comply with applicable privacy and data protection laws, with legal requirements taking precedence over framework policies in cases of conflict.
The TCF’s development has been influenced by rulings from the Court of Justice of the European Union, such as the Planet49 ruling, which prompted changes to standardize the disclosure of cookie durations. The latest version builds upon an Action Plan submitted to and validated by the Belgian Data Protection Authority (APD). Technical specifications, including the Consent Management Platform API v2.2 and the Transparency and Consent String with Global Vendor List Format v3.0, are maintained by the IAB Tech Lab and are available on GitHub.
Questions regarding the framework can be directed to framework@iabeurope.eu for policy-related inquiries and transparencyframework@iabtechlab.com for technical questions. The IAB Europe Transparency & Consent Framework Policies, version 2025-01-16.5.0.a, outline the obligations and requirements for each participant category.
