Europe
Industry transparency and consent framework
IAB TCF v2.4: Requirements and Changes from v2.3
The IAB Europe Transparency & Consent Framework (TCF) matters to publishers and advertisers whose advertising partners rely on it, mainly in programmatic advertising. It gives everyone in the chain a shared way to disclose those partners and pass visitors’ choices to them in a standard signal. Passiro supports IAB TCF v2.4.
At a glance
- Who it can apply to
- Publishers and advertisers whose advertising partners use TCF signals, mainly for programmatic advertising in Europe. It is not a legal requirement for every website.
- What it is
- An industry framework managed by IAB Europe: the TCF Policies v5.0.b with technical specification v2.4. It is not a law.
- Choices to offer
- Opt-in consent per purpose and per vendor, a separate opt-in for each Special Feature, and the right to object where vendors rely on legitimate interests.
- Website actions
- Confirm which partners require TCF.
- Disclose only the vendors you actually use.
- Check the v2.4 Feature layer and the new Special Feature 2 name.
- Decode and test the TC String after each choice.
- Keep privacy settings easy to reopen and change.
- Primary sources
- IAB Europe’s TCF Policies, the TC String and GVL specification, IAB Europe’s v2.4 timeline and its v2.3 transition notes.
- Last reviewed
How the parts of TCF fit together
A consent management platform (CMP) shows visitors which vendors want to use their data and for what. It stores the result as a TC String that participating vendors read before they act. The table explains the terms used in this guide.
| Term | What it means |
|---|---|
| Global Vendor List (GVL) | What it meansIAB Europe’s published list of registered vendors and their declarations, plus the standard names and texts for Purposes and Features. |
| Vendor | What it meansA company in the advertising chain, registered on the GVL with a numeric vendor ID. |
| CMP | What it meansThe platform that shows the TCF interface, records the visitor’s choices and creates the signal. |
| TC String | What it meansThe encoded Transparency and Consent String: what was disclosed and chosen, per purpose and per vendor. |
| Purposes | What it meansStandard reasons for processing, such as measuring ad performance. Visitors consent per purpose, or object where a vendor relies on legitimate interests. |
| Special Purposes | What it meansSecurity, ad and content delivery, and saving privacy choices. They are disclosed, but visitors cannot object within the framework. |
| Features | What it meansMeans of processing, such as linking devices, used only for purposes the visitor makes choices about. There is no separate choice. |
| Special Features | What it meansPrecise geolocation and identifying devices from actively requested information. Each needs its own opt-in. |
Vendors read the signal through the CMP’s standard interface on the page, or receive it with ad requests. The framework only works when the interface, the stored signal and the vendors’ behaviour match.
What TCF v2.3 changed
IAB Europe released TCF v2.3 on 19 June 2025. Its main change made the Disclosed Vendors segment of the TC String mandatory. The segment marks each vendor that was shown to the visitor in the CMP interface.
This closed a gap for vendors relying on legitimate interests for Special Purposes: before v2.3, they could not tell whether they had been shown at all. Disclosure is now read from its own segment, separately from the consent and legitimate-interest signals.
The transition ended on 28 February 2026. Since 1 March 2026, every new TC String needs the segment, while strings created earlier without it stay valid until visitors renew or change their choices. IAB Europe’s transition notes also say CMPs did not have to show the interface again for this change.
What TCF v2.4 changes
TCF v2.4 is the technical specification that goes with IAB Europe’s TCF Policies v5.0.b, released on 29 May 2026. IAB Europe published v2.4 and the matching GVL update on 23 July 2026. Policies and specifications are numbered separately, so v5.0.b does not make this “TCF v5”.
- Standard Feature explanation: the GVL has a new standardTexts field with one text for Features: they are means of processing used only for purposes the visitor is given a choice about. CMPs show this text, plus an illustration for each Feature.
- No controls next to Features: IAB Europe’s interface rules say Features should not be associated with controls, such as a switch that is locked on, so visitors are not misled. Visitors make choices about purposes and Special Features, not Features.
- New name for Special Feature 2: “Actively scan device characteristics for identification” is now “Identify devices based on information actively requested”. Its vendor guidance also covers information actively requested through User-Agent Client Hints.
- One change in the TC String: the old workaround that set the legitimate-interest bit for vendors declaring only Special Purposes is removed. Their disclosure is read from the Disclosed Vendors segment introduced in v2.3.
- Multi-device clarifications: the v5.0.b Policies explain how publishers can keep choices across devices, for example for logged-in users, and how to handle choices that conflict. Multi-device scope is a framework option, not a requirement for every website.
IAB Europe notes that the updated GVL specification adds no new requirements for vendors, so most of the work falls on CMPs. The technical specification on GitHub lists the changes in its version history.
TCF v2.3 and v2.4 compared
| Topic | TCF v2.3 | TCF v2.4 |
|---|---|---|
| Main change | TCF v2.3Disclosed Vendors segment made mandatory | TCF v2.4Standard Feature explanation and illustrations from the GVL |
| Technical detail | TCF v2.3Disclosure read separately from consent and legitimate-interest signals | TCF v2.4standardTexts added to the GVL; workaround for Special Purpose-only vendors removed |
| Terminology and choices | TCF v2.3No new names or texts in the interface | TCF v2.4Special Feature 2 renamed; Features not shown as on/off choices |
| Dates | TCF v2.3Released 19 June 2025; required in new TC Strings from 1 March 2026 | TCF v2.4Published 23 July 2026; CMP deadlines in the box below |
| Multi-device | TCF v2.3Not part of this version | TCF v2.4Scope and conflicting choices clarified in Policies v5.0.b; optional |
IAB Europe deadlines (checked 22 October 2026): IAB Europe requires CMPs to implement the v2.4 disclosures by 23 October 2026 in web environments and by 23 February 2027 in mobile app and connected TV (CTV) environments. These are framework deadlines for CMPs, not new GDPR deadlines. Check IAB Europe’s current notices before you plan around them.
For a shorter overview aimed at publishers, read TCF v2.3 vs v2.4: what changed and what to do.
Disclosure, consent and lawfulness are different
A vendor in the Disclosed Vendors segment was shown to the visitor. That is not consent: consent and legitimate-interest signals are separate fields, and the visitor may have refused consent or objected.
Registration on the GVL does not make a vendor’s processing lawful either. IAB Europe’s TCF Policies say participation is not a substitute for each participant’s obligations under the law, and that the law prevails in a conflict.
Keep three kinds of requirement apart when you assess a setup:
- Legal requirements: GDPR and ePrivacy rules decide when consent is needed and which legal basis applies. The EDPB’s guidance on lawful processing explains that choice.
- Framework requirements: IAB Europe’s Policies and the specification decide what the interface shows, how the signal is encoded and when CMPs have to update.
- Partner requirements: an advertising platform can add its own conditions, such as Google’s rules for publishers described below.
Google’s requirements for publishers
Publishers that use Google AdSense, Ad Manager or AdMob to serve personalised ads to users in the EEA, the UK or Switzerland need a Google-certified CMP integrated with the TCF. That is Google’s condition, not an IAB Europe rule, and TCF support alone is not Google certification. Our guide to Google’s EU User Consent Policy covers the policy and where to check Google’s list of certified CMPs.
Google Consent Mode is a separate mechanism with its own requirements. Our Google Consent Mode guide explains it.
Check your TCF implementation
Use the live configuration, a fresh browser profile and a page where advertising runs. Pick one vendor that actually receives data and follow it through each step.
- Identify the vendor: note its name and vendor ID from the GVL, and check that the interface lists it.
- Compare disclosure and signal: after a choice, decode the TC String and confirm the vendor’s ID is in the Disclosed Vendors segment.
- Check purposes and permissions: compare the purposes and legal bases shown for the vendor with its consent and legitimate-interest signals.
- Test a new choice: accept all in a fresh session and confirm the string records consent for the vendor’s purposes.
- Test rejection: reject all in a fresh session; the vendor should stay in Disclosed Vendors with no consent signals.
- Test a later change: reopen privacy settings from the page, change the choice and confirm a new string replaces the old one.
- Check the Feature display: Features show the standard explanation and illustrations, with no switches or locked toggles next to them.
- Check Special Feature 2: the interface uses “Identify devices based on information actively requested”, including in translated versions.
The framework’s technical implementation guidelines describe how CMPs and vendors pass and read the string, including in ad requests.
FAQ
What is the difference between TCF v2.3 and v2.4?
TCF v2.3 changed the signal: the Disclosed Vendors segment became mandatory. TCF v2.4 mainly changes what visitors see about Features and renames Special Feature 2, with one small change to the TC String.
Do existing consent choices need to be collected again?
Not because of the version change alone. After the v2.4 update the GVL still lists TCF policy version 5 (checked 22 October 2026); a new number is how the framework signals that everyone’s choices must be collected again. Adding a vendor, or a vendor declaring a new purpose or legal basis, does require showing the interface again.
Is TCF the same as Google Consent Mode?
No. TCF passes a standard signal to registered vendors across the advertising chain. Consent Mode passes consent states to Google tags such as GA4 and Google Ads. A site can use both, and any connection between them needs to be configured and tested.
Does Passiro support TCF v2.4?
Yes. Passiro supports IAB TCF v2.4. It is included on Pro, Business and Enterprise.
Does every website need TCF?
No. It is an industry framework, not a law. It matters mainly when your advertising partners require it, so check their requirements before you add a long vendor list to your banner.
Can vendors rely on legitimate interests for every purpose?
No. Since TCF v2.2, the framework does not allow legitimate interests for Purposes 3 to 6, which cover personalised advertising and content profiles. The law sets its own conditions on top.
Can we rewrite the standard purpose and Feature texts?
No. Under the TCF Policies, publishers must not change the standard names, definitions or official translations of Purposes, Features and Special Features. Stack descriptions and some illustrations can be adapted only under strict conditions, and the TC String then flags the change to vendors.
Do we have to offer multi-device consent?
No. Multi-device scope is an option for publishers that keep choices across devices, for example when visitors log in. If you use it, the first layer has to state the scope of the choice. IAB Europe’s TCF FAQs describe how to handle choices that conflict after login.