IAB Europe’s Transparency & Consent Framework program helps publishers, technology vendors, agencies and advertisers ensure they are GDPR compliant regarding the access and processing of data and/or personal data. The Framework is especially relevant for publishers (first parties), who have partnered up with third parties, to enable those third parties to process user data. The program provides a standardised mechanism for requesting, storing and sharing user consent along the supply chain.
Ongoing changes in legal practices and guidelines from Data Protection Authorities (DPAs) are imposing increasingly stringent requirements on market participants. In May 2023, the TCF Steering Group has approved updates to the framework and released TCF 2.2, which aims to better align with regulatory expectations and end-user needs. In this text, we will go through key changes, the implementation timeline, and sources where you can find more information.
TCF v2.2 Main Policy Amendments:
1. Removal of the legitimate interest legal basis for advertising & content personalisation: within the scope of the TCF, Vendors will only be able to select consent as an acceptable legal basis for purposes 3, 4, 5 and 6 at registration level;
2. Improvements to the information provided to end-users: the purposes and features’ names and descriptions have changed. The legal text has been removed and replaced by user-friendly descriptions – supplemented by examples of real-use cases (illustrations);
3. Standardisation of additional information about Vendors: Vendors will be required to provide additional information about their data processing operations – so that this information can in turn be disclosed to end-users;
- Categories of data collected
- Retention periods on a per-purpose basis
- Legitimate interest(s) at stake – where applicable
4. Transparency over the number of Vendors: CMPs will be required to disclose the total number of Vendors seeking to establish a legal basis on the first layer of their UIs;
5. Specific requirements to facilitate users’ withdrawal of consent: Publishers and CMPs will need to ensure that users can resurface the CMP UIs and withdraw consent easily.
Please consult the relevant sections of the updated Policies for further details and IAB Europe’s blogpost here.
TCF v2.2 Technical Specifications Updates:
With a view to implementing these policy changes, IAB Tech Lab has updated the technical specifications for the Transparency & Consent Framework. These changes include:
1. Deprecation of the getTCData and requirement for Vendors to use eventListeners, where applicable.
2. Updates to the GVL: the version will be incremented to 3 and the GVL will include additional data:
- New fields for taxonomy of categories of data
- Inclusion of data retention periods per purpose
- Support for multiple languages URL declaration
Please consult the updated Technical Specifications for further details and IAB Tech Lab’s blogpost here.
The Javascript Library that supports TCF participants’ implementation is also being updated to accommodate TCF v2.2 here.
Implementation Timeline
By 30 June 2023 - Vendors must update their GVL registration with the new required information in order to be included in the new version of the GVL (v3). Updates can be made by logging into the GVL registration portal. Only those vendors who update their GVL registration in accordance with the requirements will be published in the new GVL version (v3). The updated GVL v3 will be released weekly as vendors update their information.
By 31 July - Consent Management Platforms (CMPs) are required to host their scripts on domains other than subdomains of consensu.org, in accordance with this announcement. In addition, vendors are required to complete the TCF compliance assessment form and submit it through the GVL registration portal as part of the updated TCF compliance programs, as described here.
By 20 November - CMPs and vendors are required to comply with the requirements of TCF 2.2. Compliance will be regularly monitored by IAB Europe. IAB Europe has released the CMP Validator Chrome extension to support development.
Please visit the TCF section of IAB Europe’s website for more information or read the FAQs document here.
Webinar recording for Publishers can be watched here and the presentation deck can be downloaded here.
Ensure that the CMP in use supports version 2.2.
Compliance with the standard is absolutely critical, particularly for ensuring the functionality of programmatic ad sales. However, in practice, supporting the standard is also extremely important, or even essential, for the operation of direct sales campaigns. For example, many ad servers tie basic functionalities, such as the management of direct sales campaign frequency cap, to TCF.
Ensure by November 20, that the CMP in use supports version 2.2. You can find a list of v2.2-compatible CMP providers on the IAB Europe website here.
Finnish company Gravito Oy, which specialises in user identity management, has developed a TCF v2.2 compatible CMP. Relevant Digital and Gravito collaborate closely, and Relevant Digital resells Gravito's solution to its customers. The majority of Finnish media houses rely on Gravito's solution. Relevant Digital provides implementation and user support for it. Read more about Gravito here.
For more information contact: Petri Kokkonen, +358 40 833 5077, petri.kokkonen(a)relevant-digital.com