IAB TCF 2.3: What It Changes and How to Comply Without Breaking Consent

Introduction

The IAB Tech Lab’s Transparency and Consent Framework (TCF) has been a cornerstone of digital advertising consent in Europe since its inception. Version 2.3, released in late 2023, introduces several key updates that affect how publishers and advertisers collect, store, and transmit user consent signals. If you rely on TCF for your consent management platform (CMP), understanding these changes is critical to maintaining compliance and avoiding enforcement actions.

This guide explains what IAB TCF 2.3 changes, why it matters for your website, and how to implement the updates correctly. We’ll cover specific technical actions you can take, common mistakes to avoid, and how to verify your setup. By the end, you’ll have a clear roadmap for updating your consent management process.

Why IAB TCF 2.3 Was Introduced

The TCF has evolved in response to regulatory pressure, particularly from European data protection authorities (DPAs) and the Belgian Data Protection Authority (DPA), which oversees the IAB Europe’s compliance. Version 2.3 addresses several gaps identified in earlier versions, especially around the transparency of legitimate interest claims and the handling of consent signals for programmatic advertising.

One major driver was the need to align with the ePrivacy Directive and GDPR requirements more closely. The previous version allowed some flexibility that regulators found insufficient—for example, how vendors could rely on legitimate interest without explicit user consent. TCF 2.3 tightens these rules, requiring clearer disclosures and more granular consent options.

Another factor was the rise of consent management platforms that didn’t fully implement the framework’s specifications. The update aims to standardize how consent is collected and transmitted, reducing inconsistencies that could lead to non-compliance.

Key Changes in IAB TCF 2.3

1. Stricter Legitimate Interest Handling

Under TCF 2.3, vendors can no longer rely on legitimate interest for purposes that require explicit consent under GDPR. This means that purposes like “Store and/or access information on a device” (Purpose 1) now require opt-in consent, not just a legitimate interest claim. This change directly impacts how your CMP presents options to users.

2. Revised Vendor Consent String Format

The consent string (the technical signal sent to ad servers) has been updated to include new fields for transparency. Specifically, the string now includes a “version” indicator and a “consent” flag for each purpose, making it easier for downstream systems to interpret the user’s choice. If your CMP doesn’t generate the new string format, your ad partners may reject the signal or treat it as invalid.

3. Enhanced Transparency for Data Retention

Publishers must now disclose how long each vendor retains user data. This information must be surfaced in the CMP interface, allowing users to see retention periods before consenting. This is a significant change because many vendors previously didn’t provide this detail.

4. Removal of “Flexible” Purposes

Some purposes that were previously optional or flexible are now mandatory to disclose. For example, “Create a personalised ads profile” (Purpose 3) and “Select personalised ads” (Purpose 4) must be presented as separate toggles, not bundled. This gives users more control but also increases the complexity of your CMP UI.

5. Updated Global Vendor List (GVL) Requirements

The GVL now requires vendors to declare their data retention periods and specify which purposes they use legitimate interest for. If your CMP pulls the GVL, it must handle these new fields correctly. Failing to update your GVL parsing could result in missing vendor declarations.

How to Update Your CMP for IAB TCF 2.3

Step 1: Verify Your CMP Provider’s Support

First, check if your CMP vendor has released an update for TCF 2.3. Most major providers (e.g., OneTrust, Cookiebot, Quantcast) have done so, but smaller or custom CMPs may lag. If your CMP doesn’t support the new version, you’ll need to migrate to a compliant provider.

Step 2: Update Your Consent String Generation

Your CMP must generate consent strings that conform to the TCF 2.3 specification. This includes the new fields for vendor data retention and purpose-specific consent flags. Test the output using the IAB Tech Lab’s Consent String Decoder tool to ensure it’s valid.

Step 3: Adjust Your CMP UI

Review your consent banner and preference center. Ensure that: - Purpose 1 (storage and access) is presented as opt-in, not legitimate interest. - Each purpose has its own toggle, especially Purposes 3 and 4. - Vendor retention periods are displayed (e.g., “Vendor X retains data for 365 days”). - Users can easily reject all non-essential purposes.

Step 4: Update Your Tag Manager and Ad Scripts

Your tag manager (e.g., Google Tag Manager) must trigger ad scripts only after consent is obtained. With TCF 2.3, the consent state is more granular, so your triggers should check for specific purpose consent, not just a generic “consent given” flag. For example, only fire a remarketing tag if Purpose 3 is consented.

Step 5: Test the Reject Flow

Simulate a user rejecting all non-essential purposes. Verify that: - No pre-consent network requests are made to ad servers. - The consent string reflects the rejection (e.g., all purpose bits set to 0). - Your analytics and essential scripts still function (e.g., basic session tracking).

Step 6: Conduct a Post-Change Scan

After deploying updates, run a scan using a tool like GDPRChecker’s scanner to detect any consent leaks or misconfigurations. Look for: - Unauthorized cookies or scripts firing before consent. - Consent strings that don’t match user choices. - Missing vendor retention disclosures.

Common Mistakes and Trade-offs

Mistake: Keeping Legitimate Interest for Purpose 1

Some publishers try to keep Purpose 1 as legitimate interest to avoid asking for explicit consent. This is non-compliant under TCF 2.3. The only way to use Purpose 1 is with opt-in consent. If you rely on it for essential functionality (e.g., session cookies), you must either obtain consent or use a different legal basis (e.g., necessity).

Mistake: Not Updating Vendor Retention Disclosures

Many CMPs display vendor retention periods only if the vendor provides them. If a vendor hasn’t updated their GVL entry, you may need to contact them directly or remove them from your vendor list. Leaving retention blank can lead to DPA scrutiny.

Trade-off: User Experience vs. Compliance

Adding more toggles and disclosures can overwhelm users, leading to banner fatigue or higher rejection rates. To mitigate this, consider a layered approach: a simple accept/reject button on the first layer, with detailed options in a second layer. This balances compliance with usability.

Trade-off: Vendor List Size

With stricter requirements, some vendors may not update their GVL entries in time. You may need to reduce your vendor list to only those who are TCF 2.3 compliant. This could impact ad revenue but reduces compliance risk.

Testing Your Implementation

Use the IAB Tech Lab’s Tools

The IAB provides a Consent String Decoder and a CMP validator. Run your consent string through the decoder to confirm it includes the new fields. The validator checks if your CMP’s UI meets the framework’s requirements.

Simulate User Journeys

Test different consent scenarios: - Accept all - Reject all - Custom selections (e.g., accept Purpose 1 but reject Purpose 3)

Check that the consent string changes accordingly and that ad scripts only fire when appropriate.

Monitor Network Requests

Use browser developer tools to watch for pre-consent requests. Any request to an ad server before the user interacts with the banner is a red flag. Tools like GDPRChecker’s scanner can automate this check.

Frequently Asked Questions

What is the difference between IAB TCF 2.2 and 2.3?

TCF 2.3 tightens legitimate interest rules, adds vendor retention disclosures, and updates the consent string format. Version 2.2 allowed legitimate interest for some purposes that now require explicit consent.

Do I need to update my CMP if I’m already using TCF 2.2?

Yes. TCF 2.2 is no longer supported by the IAB Tech Lab. Using an outdated version may result in invalid consent signals and non-compliance with GDPR.

How do I check if my CMP supports TCF 2.3?

Check your CMP provider’s documentation or release notes. You can also test your consent string with the IAB decoder—if it includes the new fields (e.g., vendor retention), it’s likely 2.3.

What happens if I don’t update to TCF 2.3?

Your consent signals may be rejected by ad partners, and you risk enforcement actions from DPAs. The IAB Europe has stated that only TCF 2.3 is compliant with its policies.

Can I use TCF 2.3 outside the EU?

Yes, but it’s designed for GDPR compliance. If your audience is primarily outside the EU, you may not need TCF, but using it can simplify global consent management.

Conclusion

IAB TCF 2.3 is a necessary evolution for consent management in digital advertising. By understanding its changes—stricter legitimate interest rules, enhanced transparency, and updated consent strings—you can update your CMP correctly and avoid common pitfalls. The key is to act now: verify your CMP’s support, update your UI, and test thoroughly.

For a quick compliance check, use GDPRChecker’s scanner to detect consent leaks and misconfigurations. It’s a practical step to ensure your TCF 2.3 implementation is solid. Remember, compliance is an ongoing process, not a one-time fix.

*This article provides general guidance and does not constitute legal advice. Consult a qualified attorney for your specific situation.*

Copyright and editorial notice