IAB TCF, the IAB Europe Transparency & Consent Framework, is an industry standard that defines how websites and apps disclose data processing to users, collect their choices and pass those choices in a machine-readable signal to the advertising technology vendors that act on them. Within cookies & consent practice in privacy, it is the dominant shared vocabulary for consent and legitimate interest decisions in programmatic advertising across the European Economic Area and the United Kingdom.
The framework does not make processing lawful by itself. It is a technical and policy layer that standardizes notices, purposes and signaling, while legal compliance still depends on the GDPR and the ePrivacy Directive as interpreted by supervisory authorities and courts.
How the IAB TCF signal travels
The TCF works by turning a user decision in a consent banner into an encoded TC String that every participating party can read. A registered consent management platform, usually called a CMP, shows the notice, records the choices and then exposes them to scripts on the page through a standard JavaScript function named __tcfapi.
Ad tech scripts call __tcfapi to learn whether they may run, and the CMP returns the current string together with decoded values. The string then travels downstream in bid requests, typically in the OpenRTB user consent field, so that demand-side platforms and other vendors further along the chain receive the same decision without asking the user again.
The following table lists the main building blocks of the framework and the role each one plays.
| Component | What it is | Role in the flow |
|---|---|---|
| Global Vendor List | Public registry of approved vendors | Declares each vendor’s purposes and legal bases |
| TC String | Compact encoded record of choices | Carries consent and objections downstream |
| CMP | Registered banner and storage software | Collects choices and serves the API |
__tcfapi | Standard JavaScript interface | Lets page scripts read the current signal |
| Policies | Binding rules for CMPs, vendors and publishers | Define notice wording and permitted behavior |
The Global Vendor List is versioned and updated regularly. A TC String records which list version it was created against, so a vendor that joins later does not automatically inherit consent that the user never saw.
Purposes, features and legal bases
The framework splits data processing into standardized purposes with fixed names and descriptions, so that every compliant banner describes the same activities in the same words. Version 2.2 of the framework defines 11 purposes, plus special purposes, features and special features that work under different rules.
| Category | Examples | How the user controls it |
|---|---|---|
| Purposes | Store or access information on a device, create profiles for personalized advertising, measure content performance | Consent or right to object, per purpose |
| Special purposes | Ensure security and prevent fraud, deliver ads technically, save privacy choices | Disclosed only, no opt-out in the framework |
| Features | Link different devices, match and combine data from other sources | Disclosed only, tied to other purposes |
| Special features | Use precise geolocation data, actively scan device characteristics | Explicit opt-in required |
Each vendor declares on the Global Vendor List which purposes it pursues and whether it relies on consent or legitimate interest for each one. Version 2.2 removed legitimate interest as a basis for the purposes that build or use profiles for personalized advertising and content, so those now require consent. Purpose 1, storing or accessing information on a device, always requires consent where the ePrivacy rules apply.
Inside the TC String
The TC String is a bit-packed, base64url-encoded value that stores the decision in a few hundred characters. It is commonly kept in a first-party cookie named euconsent-v2 or in local storage, and it is also sent in ad requests as a URL or body parameter.
The table below shows the most important fields a vendor reads when deciding whether it may process data.
| Field | Content | Why it matters |
|---|---|---|
| Created and last updated | Timestamps of the decision | Supports renewal and audit of stale consent |
| CMP ID and version | Identifier of the registered CMP | Shows which software captured the choice |
| Vendor list version | GVL version used in the notice | Limits consent to vendors actually shown |
| Purpose consents | One bit per purpose | Grants or withholds consent per purpose |
| Vendor consents and interests | Bit fields or ranges per vendor ID | Records decisions vendor by vendor |
| Publisher restrictions | Overrides set by the site owner | Narrows what a vendor may do on that site |
A vendor may process data for a purpose only when both the purpose and the vendor carry a positive signal for the declared legal basis. Reading only the purpose bits and ignoring the vendor bits is a frequent implementation error.
How the IAB TCF compares with related signals
The TCF is one of several consent and preference signals, and it is often confused with browser signals and platform-specific modes. The comparison below clarifies their scope.
| Mechanism | Scope | Who sets it | Granularity |
|---|---|---|---|
| IAB TCF | EEA and UK advertising ecosystem | CMP after a user decision | Per purpose and per vendor |
| Global Privacy Platform | Multiple jurisdictions, including US states | CMP using section-based strings | Varies by jurisdiction section |
| Global Privacy Control | Browser-wide opt-out preference | Browser or extension | Single on or off signal |
| Google consent mode | Google tags on a site | Site tag configuration | A few storage categories |
The Global Privacy Platform from IAB Tech Lab can carry a TCF section alongside sections for other jurisdictions, so multinational publishers increasingly use it as a container. A CMP is the software that implements the framework, while the framework itself is the rulebook and data format.
Legal status, limits and common mistakes
The legal position of the framework has been contested. In 2022 the Belgian Data Protection Authority found that the TC String could constitute personal data and that IAB Europe acted as a joint controller, and in 2024 the Court of Justice of the European Union confirmed that a TC String can be personal data when it can be linked to an identifier such as an IP address. The framework was revised afterward, but using the TCF does not guarantee compliance.
- Listing hundreds of vendors by default produces notices that few users can meaningfully read.
- Firing tags before the CMP responds sets cookies before any choice exists.
- Ignoring publisher restrictions or vendor-level bits processes data the user refused.
- Relying on stale strings after major vendor list changes misrepresents what the user saw.
- Unequal accept and reject options conflict with regulatory guidance on consent banners.
For publishers that sell advertising through major exchanges, a certified CMP integrated with the TCF is often a commercial requirement in the EEA and UK. The practical choice is therefore less whether to adopt the framework and more how narrowly to configure vendors, purposes and banner design.
Put simply
When a news site asks whether advertisers may use your data, many different companies are waiting for the answer. The IAB TCF is a shared form and shared language for that answer, so that every company reads your choice the same way.
Your clicks in the banner become a short coded note. That note travels with every ad request, like a permission slip attached to a parcel, telling each company which uses you accepted and which you refused. The slip helps, but it does not by itself prove that the site asked fairly.
In practice
A regional news publisher in Germany earns most of its revenue from programmatic ads. It deploys a registered CMP, reduces its vendor list from about 600 entries to roughly 90 vendors it actually works with, and places accept and reject buttons with equal prominence on the first layer of the banner.
A reader accepts measurement but refuses personalized advertising. The CMP stores a TC String with purposes 1, 7 and 8 granted and the profiling purposes refused. Header bidding partners read the string through __tcfapi, and bid requests carry it to buyers, which then serve contextual ads only. The publisher keeps monetizing that page view while honoring the refusal, and its records show which vendor list version the reader saw.