Privacy & regulation · also called TCF, Transparency and Consent Framework
IAB TCF (Transparency & Consent Framework)
The IAB TCF (Transparency & Consent Framework) is IAB Europe's standard for collecting users' GDPR consent and objections through CMPs and passing those choices to ad tech vendors in a consent string.
Under GDPR and the ePrivacy rules, a single web page might involve dozens of ad tech vendors, each needing a lawful basis. The TCF, run by IAB Europe with technical specifications from IAB Tech Lab, gives the industry a common way to handle that.
It defines standard purposes (such as storing information on a device, selecting personalised ads, measuring ad performance) and special features, a Global Vendor List of registered ad tech companies, rules for how registered CMPs must present choices, and a compact encoded consent string (the TC String) that records the user's choices and travels with ad requests, including in OpenRTB.
The framework has evolved through versions; v2.2, launched in 2023, removed legitimate interest as a basis for ad and content personalisation purposes and tightened disclosure rules. It has also faced legal challenges: Belgium's data protection authority ruled against IAB Europe in 2022, and the EU Court of Justice held in 2024 that a TC String can be personal data and that IAB Europe could be a joint controller. The TCF remains the dominant consent standard in European programmatic.
Think of it like this
The TCF is like a standard permission slip that every school trip organiser in a region agrees to use, so parents tick the same boxes and every teacher can read them.
An example
A reader in Belgium accepts ad measurement but refuses personalised ads. The CMP encodes this in a TC String; DSPs receiving the bid request may bid for contextual ads but not use her profile.
Related terms
Consent string
A consent string is a compact encoded value recording a user's privacy choices, such as the TCF TC String or a GPP string, that travels with ad requests to vendors.
CMP (consent management platform)
A CMP (consent management platform) is software that shows users privacy choices, such as a cookie banner, records their consent or opt-outs, and passes them to the site's partners.
GDPR
The GDPR (General Data Protection Regulation) is the European Union's data protection law, applying since May 2018, which governs how organisations collect and use personal data about people in the EU.
Legitimate interest
Legitimate interest is one of the GDPR's six lawful bases for processing personal data, allowing processing without consent when it is necessary for a genuine interest not overridden by the individual's rights.
IAB Global Privacy Platform (GPP)
The IAB Global Privacy Platform (GPP) is an IAB Tech Lab standard that packages privacy and consent signals for many jurisdictions, like US states and the EU, into one string.
Sources: IAB Europe Transparency & Consent Framework, IAB Europe: TCF v2.2, IAB Tech Lab TCF technical specifications