The IAB Transparency and Consent Framework is, at its core, an industry-designed system for collecting and communicating advertising consent signals across the programmatic advertising supply chain. It was created to solve a specific problem: when a user visits a website and consent to display advertising, dozens of ad tech companies — demand-side platforms, data management platforms, SSPs, DSPs — each need to know whether that user consented to their specific data processing activities. The TCF provides a standardised way to encode and pass that consent information at scale.
For the programmatic advertising industry, this is a genuine technical necessity. For most other websites, it is entirely irrelevant.
How the IAB TCF Works
The TCF operates through a layered system of participants:
IAB Europe registers and audits the framework. They maintain a Global Vendor List (GVL) — a published list of hundreds of advertising technology companies, each assigned a numeric ID and a list of purposes they claim to process data for.
Publishers (website owners) implement a TCF-registered CMP that presents a consent interface referencing the GVL. The interface asks users to consent to specific "purposes" (Purpose 1: Store and/or access information on a device; Purpose 3: Create a personalised ads profile; etc.) across vendors on the list.
CMPs generate a TC string encoding the user's choices — which purposes they accepted, which vendors they accepted, and which legitimate interest claims they objected to — and store it in the euconsent-v2 cookie.
Advertising platforms read the TC string from the cookie to determine what data processing is permissible for that specific user. Google AdSense, for example, reads the TC string to decide whether to serve personalised or non-personalised ads.
The result is a system where consent flows from the user through the publisher through the CMP to potentially hundreds of advertising vendors — all in milliseconds, every page load.
Why the Belgian APD Found It Non-Compliant
The February 2022 ruling by the Belgian APD identified several structural problems with TCF 2.0:
IAB Europe is a data controller it did not acknowledge. The TC string itself contains personal data (because it encodes user choices linked to identifiers that can be traced to individuals). The APD found that IAB Europe, by specifying the TC string format and how it would be processed, was acting as a data controller — a role IAB Europe denied. Being an unacknowledged data controller without a valid legal basis for processing is a GDPR violation.
Legitimate interest was improperly used. TCF 2.0 allowed vendors to claim legitimate interest as a legal basis for advertising purposes. The APD found — consistent with EDPB guidance — that legitimate interest cannot lawfully justify tracking-based advertising. Users' right to object to legitimate interest processing was also found to be inadequately implemented.
Consent was not genuinely free and informed. The volume of vendors (hundreds) and purposes (ten standard IAB purposes plus special purposes, features, and special features) made it practically impossible for a user to give specific, informed consent to each one — violating the GDPR's specificity requirement for consent.
IAB Europe was fined €250,000 — modest given the scale of the violation — and ordered to bring TCF into compliance within two months.
The Current Status: TCF 2.2 and Ongoing Appeal
IAB Europe introduced TCF 2.2 in November 2023 with the following changes:
- Removed legitimate interest as a basis for Purposes 3, 4, 5, and 6 (the ad targeting and measurement purposes most central to the APD's concerns)
- Required CMPs to present purposes more clearly, with individual vendor consent options more accessible
- Introduced stricter CMP audit requirements
IAB Europe simultaneously appealed the Belgian APD ruling to the Belgian Market Court. As of early 2026, the appeal has not been fully resolved, and TCF 2.2 operates under interim compliance measures.
Practical implication: TCF 2.2 is meaningfully better than TCF 2.0. Businesses running programmatic advertising with TCF 2.2 and a registered CMP are in a significantly more defensible position than under the old framework. However, the system's legal foundations remain contested, and using it does not guarantee immunity from regulatory scrutiny.
Who Needs TCF — and Who Doesn't
This is the question most articles fail to answer directly.
| Business Type | TCF Needed? | Reason |
|---|---|---|
| Publisher using Google AdSense / Ad Manager | Yes | Google requires TCF signal for personalised ads |
| Publisher using programmatic SSPs (Prebid, etc.) | Yes | SSP ecosystem relies on TC strings |
| E-commerce site using Meta Pixel + retargeting | No | Meta Pixel does not use TCF; CMP blocking rules sufficient |
| SaaS site using GA4 + HubSpot | No | Neither tool requires TCF; standard consent categories sufficient |
| Blog using affiliate links only | No | No programmatic ad tech involved |
| News site with own direct-sold advertising | No | Direct-sold ads do not use TCF signals |
| App using in-app advertising (Google Admob) | Yes | Google Admob requires TCF (or Apple ATT on iOS) |
The key question is: are you using programmatic display advertising through a platform (like Google Ad Manager or a third-party SSP) that reads TCF signals to decide what ads to serve? If yes, you need TCF. If no, a simpler GDPR consent management platform — one that blocks non-essential scripts until consent is given — is entirely sufficient.
What to Tell Your CMP Vendor
Many CMP vendors push all customers toward TCF-enabled plans, because TCF plans cost more and tie customers into a more complex integration. Before upgrading, ask:
- Do any of the advertising or analytics tools on my site read TCF signals?
- Am I using Google AdSense, Google Ad Manager, or any programmatic SSP?
- If I implement a simple non-TCF consent banner that blocks non-essential scripts, will any of my tools fail to function correctly?
If the answers are no, no, and no — you do not need TCF. A standard CMP that blocks scripts by category (strictly necessary / functional / analytics / marketing) and stores a basic consent record is fully compliant for non-advertising websites.
Alternatives for Non-Advertising Sites
For the vast majority of SMEs, SaaS companies, and content sites without programmatic advertising, a simpler consent approach is:
- A compliant consent banner with "Accept" / "Reject" / "Manage preferences" options
- Script blocking that prevents non-essential scripts from firing until consent is given
- A consent record stored locally (or server-side if you need an audit trail)
- A cookie policy listing all cookies individually by name and purpose
No TCF. No Global Vendor List. No TC string. Just a clear consent signal that controls whether your specific third-party scripts load.
Generate exactly that with our Cookie Consent Generator — a GDPR-compliant consent banner without TCF complexity, designed for websites that do not run programmatic display advertising.