TCF v2.3 vs v2.4: What Changed and What Publishers Need to Do

The IAB Europe Transparency & Consent Framework (TCF) is an industry standard for programmatic advertising. A consent management platform (CMP) shows visitors which advertising vendors want to use their data, then passes their choices to those vendors in a coded signal called the TC String.

TCF matters mainly when your advertising partners ask for it. It is an industry framework, not a law, and using it does not by itself make any processing lawful.

What changed in TCF v2.3?

IAB Europe released TCF v2.3 on 19 June 2025. Its main change made the Disclosed Vendors segment mandatory: a part of the TC String that marks each vendor shown to the visitor in the consent interface.

This mattered most for vendors relying on legitimate interests for Special Purposes, such as security or ad delivery, which visitors cannot object to within the framework. Before v2.3, those vendors could not tell whether they had been shown at all.

Disclosure is now read separately from consent. A vendor can appear in the segment even if the visitor refused consent for its purposes.

What changes in TCF v2.4?

TCF v2.4 is the technical specification that goes with the TCF Policies v5.0.b, IAB Europe’s rulebook for the framework. Most changes concern what visitors see about Features: ways of processing data, such as linking devices, that vendors use only for purposes the visitor makes choices about.

• Standard Feature explanation: the Global Vendor List (GVL), IAB Europe’s official list of vendors and standard texts, now has a standardTexts field. CMPs show this explanation with the Features, plus an illustration for each one.
• No switches on Features: ordinary Features should not appear next to on/off controls, including locked ones, because visitors do not choose them separately.
• New Special Feature 2 name: “Identify devices based on information actively requested” replaces “Actively scan device characteristics for identification”. Special Features need their own opt-in.
• One technical change: CMPs no longer set the legitimate-interest signal for vendors that declare only Special Purposes. Their disclosure comes from the Disclosed Vendors segment instead.
• Multi-device clarifications: the accompanying policies explain how to tell visitors the scope of their choice and handle conflicting choices when a publisher keeps preferences across devices, for example after login. This is an option, not a requirement.

TCF v2.3 vs v2.4: side-by-side

Which deadlines apply?

These are IAB Europe deadlines for CMPs and TC Strings, not new legal deadlines under the GDPR.

• 1 March 2026 (v2.3): every new TC String must include the Disclosed Vendors segment. Strings created earlier without it stay valid until visitors renew or change their choices.
• 23 October 2026 (v2.4, web): the deadline for CMPs to implement the new disclosures on websites.
• 23 February 2027 (v2.4, apps and CTV): the same deadline for CMPs in mobile apps and on connected TV.

Check IAB Europe’s current notices before you plan around these dates.

What should publishers check?

Run these checks on the live site, in a fresh browser session, after each change to your CMP or advertising partners.

• Active configuration: the live site runs the CMP setup you expect, with TCF enabled for the regions where your partners need it.
• Vendors in use: the vendor list matches the partners that actually receive data. Remove vendors you do not work with.
• Feature text and illustrations: the Features layer shows the standard explanation and illustrations, with no switches next to Features.
• Special Feature 2: the name reads “Identify devices based on information actively requested”, also in translated banners.
• Change and withdraw: visitors can reopen privacy settings from every page, change or withdraw a choice, and a new TC String replaces the old one.
• Signals at your partners: your ad partners receive and accept the TC String. Ask them to confirm, and look for the string in their ad requests in your browser’s developer tools.
• Multi-device, if used: when choices follow logged-in visitors across devices, the first layer states that scope and the choice applied after login is the one you intend.
• Google ad serving: if you serve personalised ads through AdSense, Ad Manager or AdMob in the EEA, the UK or Switzerland, Google also requires a Google-certified CMP. See our guide to Google’s EU User Consent Policy.

For a vendor-by-vendor test of the TC String, use the implementation check in our IAB TCF v2.4 guide.

Using TCF v2.4 with Passiro

Passiro supports IAB TCF v2.4. It is part of Pro and above, next to IAB GPP, while Google Consent Mode v2 is included on every plan, including Passiro Free.

Your own setup still decides the result: the partners you work with, the purposes they use and whether they accept the signal. Repeat the checks above after changes to your advertising setup.