IAB Europe launches TCF 2.2

IAB Europe has today announced the launch of the Transparency & Consent Framework 2.2 to continue helping players in the online ecosystem comply with certain requirements of the ePrivacy Directive and the UK GDPR. Approved by the TCF Working Group, the iterations bring further standardisation of the information and choices that should be provided to users over the processing of their personal data, and how these choices should be captured, communicated and respected.

Constant evolutions in case law as well as in guidelines of Data Protection Authorities place even higher demands on market participants in terms of data protection, and TCF 2.2 brings meaningful changes in an attempt to better meet the expectations of regulators and needs of end-users.

CMPs and Vendors are required to implement the new policies and specifications by 30 September 2023, although CMP Framework UIs will not need to apply for re-validation. To support CMPs in their developments, IAB Europe has released a new CMP Validator Chrome Extension available here that includes all requirements of TCF v2.2. 

The main policy amendments featured as part of TCF 2.2 are:

1. Removal of the legitimate interest legal basis for advertising & content personalisation: within the scope of the TCF, Vendors will only be able to select consent as an acceptable legal basis for purposes 3, 4, 5 and 6 at registration level

2. Improvements to the information provided to end-users: the purposes and features’ names and descriptions have changed. The legal text has been removed and replaced by user-friendly descriptions – supplemented by examples of real-use cases (illustrations)​​​​​

3. Standardisation of additional information about Vendors: Vendors will be required to provide additional information about their data processing operations – so that this information can in turn be disclosed to end-users

• Categories of data collected
• Retention periods on a per-purpose basis
• Legitimate interest(s) at stake – where applicable

4. Transparency over the number of Vendors: CMPs will be required to disclose the total number of Vendors seeking to establish a legal basis on the first layer of their UIs

5. Specific requirements to facilitate users’ withdrawal of consent: Publishers and CMPs will need to ensure that users can resurface the CMP UIs and withdraw consent easily

Full details of the updated Policies can be found on IAB Europe’s website, along with a blog post explaining the changes.

The key updates to the technical specifications for the Transparency & Consent Framework include:

1. Deprecation of the getTCData and requirement for Vendors to use eventListeners, where applicable

2. Updates to the GVL: the version will be incremented to 3 and the GVL will include additional data:

• new fields for taxonomy of categories of data
• inclusion of data retention periods per purpose
• support for multiple languages URL declaration

Full details of the Technical Specifications can be found here.

More information can be found on the TCF section of IAB Europe’s website along with the FAQs document here. Dedicated webinars will be organised at the beginning of June for each category of participants – Publishers, CMPs and Vendors.