IAB TCF: who needs it?

What is IAB TCF?

The Transparency & Consent Framework (TCF) is a standard from IAB Europe, the trade association of the European digital advertising industry. It was built for websites and apps that earn money by showing ads from others.

When you sell ad space, dozens or even hundreds of ad tech vendors may bid on every ad view behind the scenes. Each of them needs to know whether the visitor consented, and to what. TCF standardizes that: your consent banner records the choice in an encoded string, the TC string, and every vendor reads it the same way.

To make that work, TCF uses a fixed list of purposes, such as "use profiles to select personalized advertising" and "measure advertising performance", and the Global Vendor List: the vendors registered with IAB Europe. The framework is revised regularly; the current version, TCF v2.3, has been mandatory since March 2026.

Who needs it?

You need TCF if you sell ad space, in other words if you show ads from others on your website or in your app. For example through:

• Google AdSense, Google Ad Manager or AdMob;
• other ad networks or programmatic advertising platforms;
• header bidding, where several parties bid on your ad slots.

For Google's products this is a firm requirement. Since 16 January 2024, publishers who serve personalized ads to users in the EEA or the UK must use a Google-certified consent management platform (CMP) integrated with the TCF; for Switzerland this applies since 31 July 2024. Without one, your traffic is no longer eligible for personalized ads from Google, and at most gets non-personalized or limited ads.

This mainly concerns news sites, blogs and comparison sites that live on ad revenue.

Who doesn't need it?

Most websites don't need TCF:

• Webshops, even if you advertise with Google Ads or Meta.
• Business websites, even with Google Analytics, the LinkedIn Insight Tag or other marketing tags.
• Blogs and sites without third-party ads.
• SaaS companies and other sites that win customers but don't sell ad space.

The difference is the direction. If you advertise, you buy ads and measure the results on your own site. You need consent from your visitors and, if you use Google, Google Consent Mode v2. If you show ads, you sell space to others, and only then does TCF come in.

Why not switch it on just in case?

Enabling TCF when you don't need it only has downsides:

• A more complicated banner. Visitors see a long list of purposes and sometimes hundreds of vendors, often with "legitimate interest" toggles too. That is hard to understand and usually lowers the share of visitors who consent.
• More to maintain. You have to decide which vendors you allow, and the vendor list and the TCF rules change with each new version.
• No benefit. Google doesn't require TCF from advertisers: for Google Ads and Analytics the standard route is your banner plus Consent Mode v2. Google's ad tags can read a TC string, but only if you deliberately switch that on.

TCF has also been under legal scrutiny itself. In 2022 the Belgian data protection authority found that the framework breached the GDPR. In March 2024 the EU Court of Justice ruled that a TC string can be personal data and that IAB Europe can be a joint controller for it. In May 2025 the Belgian Market Court annulled that decision on procedural grounds, but confirmed the €250,000 fine and held that IAB Europe is a joint controller only for processing TC strings. IAB Europe has adapted the framework since.

What you need instead

For a site without third-party ads, this is enough:

1. A cookie banner that asks for consent first, with "Accept" and "Reject" side by side.
2. Blocking until consent: marketing and statistics cookies only load after the visitor agrees.
3. Google Consent Mode v2, if you use Google Ads or Google Analytics. See Google Consent Mode v2 explained.
4. A cookie policy and proof of consent.

Cookie Confirm covers those four with a short, clear banner without a list of hundreds of vendors. If you show ads through Google AdSense or Ad Manager, check that your consent banner is certified by Google for TCF.

Sources

• IAB Europe: Transparency & Consent Framework
• IAB Europe: Transition to TCF v2.3
• Google Ad Manager Help: Consent management requirements for serving ads in the EEA, the UK and Switzerland
• Google AdSense Help: New consent requirements for traffic in Switzerland
• Google Ads Help: Google Ads integration with the IAB TCF
• Belgian Data Protection Authority: The CJEU answers the questions referred in the IAB Europe case
• Belgian Data Protection Authority: The Market Court rules in the IAB Europe case
• CJEU: Case C-604/22, IAB Europe