IAB TCF v2.0: Top 10 Things to Know

In August 2019, IAB Europe, the leading European-level industry association for the digital marketing and advertising ecosystem, in partnership with IAB Tech Lab, announced the launch of the second iteration of the Transparency and Consent Framework (TCF).

In this post, we’ll provide an overview of the framework to help publishers and advertisers gear up for IAB TCF v2.0.

---

Summary

• The TCF is an industry tool that supports companies within the digital advertising ecosystem as they manage their compliance obligations under the GDPR and ePrivacy Directive. Comprised of technical specifications and policy documents, the TCF is used for publishers, technology vendors, agencies and advertisers to clearly and consistently communicate with end-users about how their data is being used.
• The first version of the TCF, known as TCF v1.1, was launched on April 25, 2018 after being developed by IAB Europe in collaboration with organizations and professionals in the digital advertising and publishing industries. It provides a means of transmitting signals of consent from a user to vendors working with publishers using a Consent Management Platform (CMP).
• IAB TCF 2.0 – the latest release, is completely revamped and greatly expands publishers’ bidstream options for collecting and assigning consent. Companies must disclose specific kinds of data they use or collect and their role in ad campaigns in order to register for the TCF. That means publishers need finer controls over consent data, not just ‘on or off’ options. The new version introduces the “right to object” to a processor’s “legitimate processing” legal basis for data processing.
• Publishers leveraging the IAB TCF need to prepare to switch to support for TCF v2.0 before August 15, 2020 when support for TCF v1.1 will end.
• Next week, CookiePro is launching the first IAB TCF v2.0 Banner Builder that uses an easy 3-step process to set up a TCF 2.0-compliant cookie banner and preference center. Get notified when it’s launched!
• Join IAB Europe and OneTrust PreferenceChoice in a free webinar next week to learn how publishers can navigate this change and successfully work with TCF v2.0.

Ready to learn the nitty-gritty facts about this framework?

Here’s a list of the top 10 things you need to understand about IAB TCF 2.0.

---

10 Things You Need to Know About IAB TCF 2.0

1. What is the IAB Europe Transparency and Consent Framework?

The Interactive Advertising Bureau (IAB), comprised of more than 650 media and technology companies, runs the Transparency & Consent Framework (TCF) – a collaborative solution for businesses conducting targeted advertising in compliance with GDPR. The purpose of TCF is to standardize how publishers, ad tech vendors, and agencies can run and deliver ads in a way that complies with the GDPR and ePrivacy Directive when processing data or accessing/storing information on a device.

The first version of the TCF was launched on April 25, 2018 after being developed by IAB Europe in collaboration with organizations and professionals in the digital advertising and publishing industries. It provides requirements for transmitting consent signals from a user to vendors working with publishers using a Consent Management Platform (CMP).

The role of a CMP is to centralize and manage consent and objections of the end-user.

2. What is IAB TCF v2.0?

IAB TCF v2 is a revamped version of the original framework (IAB TCF v1.1).  The purpose is to standardize how publishers, ad-tech vendors, agencies, and advertisers can continue to run programmatic advertising in a way that’s compliant with GDPR. This includes how they request, store, and share user consent along the supply chain.

For Consumers: More transparency & control for consumers to grant or withhold consent and exercise their ‘right to object’ to their personal data being processed based on legitimate interest.

For Publishers: Greater control and flexibility for publishers in how they integrate & collaborate with their technology partners with the ability to restrict the purposes for which personal data is processed on a per-vendor basis.

3. What are the goals of IAB TCF 2.0?

The goal of the Framework is to help players in the online ecosystem meet certain requirements of the ePrivacy Directive and GDPR by providing a way of informing users about:

• The storing and/or accessing of information on their devices
• The fact that their personal data is processed
• The purposes for which their personal data is processed
• The companies that are seeking to process their personal data for these purposes
• Providing users with a choice about the same, and signaling to third parties which information has been disclosed to users and what users’ choices are

4. Why was the IAB TCF v1.1 revamped?

The first version was considered too biased towards ad-tech vendors and not understanding what would be beneficial for publishers. The new version is more geared towards publishers’ needs and seeks to provide choice and transparency to consumers and continues to take feedback to drive innovation and provide greater control to publishers. 

The key changes are:

1. More transparency & control for consumers
2. Greater control for publishers
3. Enhanced support of the GDPR’s “legitimate interests” legal basis for processing personal data

To develop TCF v2.0, the TCF Steering Group (SG) was tasked with working with the IAB Tech Lab and drafting the new policy documents. Representatives from 10 National IABs, 55 organizations, and EU-level associations, publishers, technology providers, and agencies, participated in the development to help deliver the new version of IAB TCF.

5. What is new in IAB TCF 2.0?

TCF 2.0 – the latest release, is completely revamped and greatly expands publishers’ bidstream options for collecting and assigning consent. Companies must disclose specific kinds of data they use or collect and their role in ad campaigns in order to register for the TCF. That means publishers need finer controls over consent data for consumer transparency and choice. 

IAB TCF 2.0 is the result of continuous consultation with its users and a broad base of stakeholders. The new version introduces the “right to object” to a processor’s “legitimate processing” legal basis for data processing. IAB TCF 2.0 has been designed to give enhanced transparency and choice to consumers while providing enhanced control to publishers.

This is accomplished by incorporating the following changes: 

• TCF 2.0 gives publishers greater control and flexibility for how they integrate and collaborate with their technology partners with the ability to restrict the purposes for which personal data is processed on a per-vendor basis.
• TCF 2.0 expands the original five purposes for processing personal data to ten – with a new, innovative way to present the increased number of purposes for ease of comprehension
• TCF v2.0 enables consumers to grant or withhold consent and exercise their ‘right to object’ to their personal data being processed on the basis of legitimate interest.
• TCF 2.0 gives consumers greater control over (1) whether and (2) how vendors may use certain features of data processing (ex: precise geolocation data)

Enhanced Purpose Granularity 

The purposes of data processing have been extensively revised to provide additional granularity. Individual purposes have been further subdivided increasing the total number of purposes from five to ten. Two Special Purposes have also been added. Features have also been increased to five with two of the Features being designated Special Features requiring opt-in. 

Right to Object 

Users will be able to communicate their Right to Object to processing on the basis of the Legitimate Interest for processing directly to CMPs. The objections will be communicated by the CMP to Vendors by Purpose. 

More Complete Accommodation of Legitimate Interests 

Vendors will be more accountable for whether their “legitimate interest” legal basis has been acknowledged. The vendor will receive an explicit signal that it has been acknowledged. 

Granular Controls 

New, more granular controls give publishers more control over the data processing purposes allowed on a per vendor basis. Publishers can create different rules for each Vendor or group of Vendors. 

Application of Policies 

Greater support for the users of the framework in the application of the policies, terms and conditions, and technical specifications. 

Flexible Vendor Legal Bases 

Vendors are able to register a flexible and default legal basis to accommodate regional legal differences. 

6. How does TCF work?

The IAB Tech Lab manages technical specifications for the framework, while IAB Europe manages the policies. To follow GDPR requirements, it has been designed to standardize the provision of notice about personal data processing, and the transmission of signals about user choices related to data processing. 

7. What is a legitimate interest, and what’s new for vendor registration?

According to the GDPR, a legal basis is required for processing a user’s data. While consent is the most common legal basis for processing a user’s data, legitimate interest is another legal basis that a vendor may use.  For more information, visit this source.

8. If I comply with v1.1, do I comply with v2?

Unfortunately, no. The changes in v2 are large enough to require a whole new implementation. With the list of features, purposes, stacks, and a number of other changes, the updates don’t map to anything in previous versions.

9. What are purposes and features in the TCF 2.0? 

A purpose in the TCF is defined as one of the outlined reasons for processing of data, including the personal data of users, by vendors who are participating in the framework. The user is given a choice to consent or object to the purpose depending on the legal basis for the processing.   

A special purpose is one of the defined purposes for processing the data by vendors participating in the framework for which the user is not given a choice to consent by the Consent Management Platform (CMP). 

A Feature is how vendors participating in the Framework carry out a purpose. Examples of Features include combining data obtained offline with data collected online, linking devices that belong in the same household, and receiving automatically-sent device characteristics, e.g. IP address, user-agent string.  

10. What are stacks in TCF 2.0? 

Purposes and Features can be combined into stacks that serve to simplify consent without sacrificing granular information or choice. They can substitute initial information about two or more purposes and/or features. By utilizing Stacks, you will be able to group two or more Purposes and/or Special Features which may help with user experience and understanding. There are 37 Stacks created by the IAB, with different combinations of Purposes or Special Features. 

---

CookiePro IAB TCF 2.0 Support

CookiePro will soon be launching a free tool for publishers, ad-tech vendors, agencies, and advertisers to build an IAB TCF 2.0 compliant cookie banner and preference center.

Sign up to be the first to know when it’s available!