The IAB Transparency & Consent Framework (TCF) is an open standard jointly developed by the European digital advertising industry. It was launched in 2018 to help market participants comply with EU data protection regulations, namely the GDPR and the ePrivacy Directive, particularly in the context of programmatic advertising. It enables websites and technology providers to manage user consent in a transparent and standardised way across the entire advertising supply chain.
For years, TCF has been at the centre of European digital advertising—and at the same time a source of ongoing legal uncertainty. However, a series of legal proceedings and court rulings between 2022 and 2026 have significantly clarified the legal status of TCF, the responsibilities of IAB Europe, and what publishers are required to do in practice. In this article, we summarise where things stand today and what this means specifically for publishers.
TCF is built around a technical identifier called the TC String (Transparency and Consent String). It is a string of characters that records a user’s consent choices, such as which vendors have been granted permission and for which purposes personal data may be processed. The TC String travels through the programmatic advertising chain and acts as a signal of what the user has agreed to and under what conditions.
The TCF legal process: key rulings
In February 2022, the Belgian Data Protection Authority (APD) issued a decision questioning the lawfulness of TCF. The APD concluded that the TC String constitutes personal data and that IAB Europe acts as a data controller in its processing—not only in documenting consent but also in the downstream use of the data in the programmatic advertising chain. IAB Europe was fined €250,000 and ordered to submit a corrective action plan.
In January 2023, the APD approved IAB Europe’s proposed action plan and set a six-month deadline for its implementation. However, this decision was based on a broad interpretation of IAB Europe’s responsibility. The case then moved to the EU level, and in spring 2024, the Court of Justice of the European Union issued a preliminary ruling that significantly limited IAB Europe’s role. In May 2025, the Belgian Market Court confirmed this interpretation. According to the court, IAB Europe is not responsible for data processing carried out by other parties, such as targeted advertising. Its role is limited to governing the TCF framework and generating the TC String.
In January 2026, the process reached another decisive milestone when the Belgian Market Court annulled the APD’s January 2023 decision approving the action plan. The court found that the decision was based on an incorrect assumption about IAB Europe’s responsibility and exceeded the authority’s powers. The case was sent back to the APD for a new decision.
TCF’s legal status today and what it means for publishers
As a result of these rulings, the legal position of TCF has become much clearer. While TCF has not been declared unlawful, responsibility for data processing does not shift to IAB Europe. It remains with each individual actor, including the publisher. The use of the TC String does not remove the publisher’s role as a data controller, and consent documentation and legal bases must be carefully managed to ensure GDPR compliance. It has also been confirmed that the TC String can, in certain circumstances, qualify as personal data—particularly when it can be linked to other identifiers such as an IP address. In such cases, its processing requires a valid legal basis under the GDPR.
With the January 2026 ruling, the APD’s previously approved action plan was annulled in its entirety, and the authority must now issue a new decision based on IAB Europe’s more limited scope of responsibility. This creates a more legally robust and realistic foundation for the market going forward.
TCF v2.3 and what publishers need to do now
While the legal interpretation of TCF is now clearer, technical development continues. TCF v2.3 was released in June 2025, and the transition period ends on February 28, 2026. The new version introduces a mandatory disclosedVendors segment, designed to eliminate ambiguity around whether a vendor has been genuinely and transparently presented to the user in the CMP interface
From March 1, 2026 onward, any new TC Strings missing this segment will be considered invalid. Although this change primarily affects CMP providers and vendors from a technical standpoint, its implications extend to publishers as well. Publishers must ensure that their CMP supports the update and handles TC Strings correctly.
In the broader picture, TCF is not illegal, and its legal status is now clearer than it has been in years. For publishers, the key is to ensure they use an up-to-date TCF version, that their CMP supports TCF v2.3 updates—especially the disclosedVendors segment—and that their consent management and privacy practices align with GDPR requirements.
The January 2026 ruling brings greater stability to a process that has been uncertain for years. While the story is not entirely over, the legal framework is now clearer, and the market can rely on TCF evolving in a more constrained and realistic way. Now is a good time for publishers to review their practices and ensure that consent management is transparent for both users and regulators.