The Transparency and Consent Framework (TCF) is a standardized framework developed by the Interactive Advertising Bureau (IAB) Europe to help digital publishers, advertisers, and technology vendors comply with European data protection laws, including the General Data Protection Regulation (GDPR) and the eprivacy Directive.

The IAB TCF continues to evolve, responding to regulatory pressures, publisher feedback, and market demand.

The initial version, TCF v1.0, was launched in April 2018 in response to the GDPR, which came into effect in May 2018. It provided a method to manage user consent.

TCF v2.0was officially launched in 2019, introducing more granular options for user consent, expanding support for legitimate interest, and allowing publishers to restrict vendors' data processing purposes.

The current version, TCF v2.2, was released in May 2023. It introduces some important policy changes, including stricter requirements for legitimate interest, vendor disclosures, and improved user interface requirements.

TCF v2.3 is expected to enter into force on February 1, 2026, so website owners and CMP providers must prepare for the upcoming updates.

IAB TCF v2.3: Timeline for 2025 and 2026

TCF v2.3 was open for public comment until May 19, 2025. TCF v2.3 has now entered the testing period, allowing CMP providers and websites testing and implementing TCF v2.3 during this formal transition period.

The current version, IAB TCF v2.2, is expected to function all of 2025.

The exact enforcement date of TCF v2.3 has yet to be announced; however, it is expected to take effect on February 1, 2026. All CMPs and Vendors will be required to update their IAB TCF implementation to support v2.3 before this date.

What Is the TCF and Why Is It Evolving?

The TCF provides a technical and legal standard for managing user consent and transparency when processing personal data for advertising and analytics purposes.

It controls if:

• Users get all the information about how their data is collected and used.
• Users can grant or refuse user consent.
• Users can provide granular consent, accepting or rejecting specific types of data processing.
• User consent choices are sent to all parties involved in the processing of personal data.

The TCF is a voluntary standard intended for use by three categories of stakeholders:

1. Publishers
   Operators of online services where personal data is collected and used by third-party companies (vendors) for digital advertising, analytical purposes, or content personalization.
2. Vendors
   Third-party companies such as Ad servers, measurement providers, advertising agencies, DSPs, SSPs, and others that do not have direct access to publishers’ end-users.
3. Consent Management Platforms (CMPs)
   User consent management providers that create cookie notices through cookie banners to inform users about the collection and processing of their personal data. After users grant or reject consent, a CMP sends their choices to all involved parties.
   

While the latest version, TCF v2.2, introduced in 2023, brought major improvements for user consent and vendor transparency, regulators and data protection authorities, especially the CNIL, APD, and EDPB, continue to evolve the requirements.

The TCF v2.3 addresses these ongoing concerns to comply with all data privacy laws, present in the European Economic Area (EEA).

IAB Tech Lab, in partnership with IAB Europe, is implementing the latest changes for the IAB TCF v2.3. 

IAB TCF v2.3: A Technical Briefing for Website Owners and CMP Users on Upcoming Changes

Key changes in TCF v2.3 include:

Improved user choice transparency

TCF v2.3 introduces transparent and clear interfaces that provide the necessary information, such as consent duration, clearer consent strings, and more granular options for Cookie Consent, avoiding misleading information.

When collecting Cookie Consent, businesses should better categorize data processing purposes (for example, personalization vs. measurement).

Standardized UI elements

To improve user experience consistency, TCF v2.3 introduces standardized consent text templates with less ambiguity.

IAB v2.3 could also introduce requirements and guidelines for cookie notice design and behavior, including:

• Minimum font sizes
• Accessible color contrasts
• Standard opt-out mechanisms

Increased information disclosure

More user-friendly descriptions will replace legal text in the CMP UI. It is advised to use illustrations as examples in the descriptions.

Reduced reliance on legitimate interest

TCF v2.3 will remove legitimate interest as a legal basis for Purposes 3, 4, 5, and 6 (advertising and content personalization).

Vendors could only use consent as a legal basis for these purposes. They will be required to provide proof of consent where applicable.

Enhanced publisher controls over vendors

TCF v2.3 enhances publisher controls over vendors and their declared legal bases. Publishers can now override a vendor’s declared legal basis for specific purposes. Publishers will be able to configure data processing settings dynamically or could require consent where the vendor claims legitimate interest.

Enhanced enforcement readiness

Enforcement signals become mandatory: publishers and vendors must show when consent is not obtained. In this case, no data could be processed unless valid legal consent is obtained.

CMPs must maintain secure records of user consent collection, which can be inspected in case of regulatory investigations.

Global Privacy Platform support

TCF v2.3 is expected to offer greater interoperability with the Global Privacy Platform (GPP). TCF v2.3 is designed by the IAB Tech Lab to unify consent signals across global jurisdictions.

TCF v2.3 and Its Impact on Website Owners and CMP Users

The IAB TCF v2.3 aims to strengthen user privacy by providing more clarity and control over their data processing preferences. Website owners and CMP users need to prepare for these changes to ensure compliance with the updated framework.

When the new version comes into force, website owners and CMP users will have to adapt to the changes and increased requirements of TCF v2.3.

Website owners must implement the new TCF v2.3 specifications in their CMPs to ensure compliance and provide users with the necessary transparency and control.

CMP users need to update their CMPs to reflect the changes in TCF v2.3, including the removal of legitimate interest, improved information disclosure, more granular consent options, and enhanced user interface features.

How to Prepare for IAB TCF V2.3?

Use these steps to prepare and get ready for IAB TCF V2.3:

1. Choose the right CMP provider

Confirm that your current CMP provider is preparing for TCF v2.3 updates.

CookieScript CMP now supports the latest version of IAB TCF and is preparing for TCF v2.3 updates. With CookieScript, website owners can:

• Create a highly customizable Cookie Banner.
• Standardize UI elements by changing the design, background and colors of the Cookie Banner.
• Create a privacy laws-compliant Privacy Policy.
• Record user consent  
  
• Keep consent logs for proof of compliance.
• Scan your website for cookies, local storage, and session storage, and add them automatically to the cookie declaration.
• Block third-party cookies automatically. 
• Control vendors provided information. Website owners and publishers can now change all the texts in the Cookie Banner.
• Respect Global Privacy Platform support.

CookieScript is a user-friendly CMP. In 2024, users ranked CookieScript CMP on G2, a peer-reviewed website, as the best CMP for small and medium-sized companies. 

2. Audit your current consent setup

Review your current consent banner, purpose descriptions, and legal basis usage. Make sure that you don’t overuse legitimate interest and remove dependencies on other outdated practices.

3. Update your Privacy Policy and Privacy Notices

Align your Privacy Policy and privacy notices to reflect the current changes in transparency and data processing standards.

Test vendors

Test vendors’ overrides and restrictions to ensure you can override their information. Make sure your site only works with vendors who align with the latest transparency standards of the TCF.

Scan your website for cookies, local storage and session storage:

Frequently Asked Questions

What Is the TCF?

The Transparency and Consent Framework (TCF) is a voluntary standard developed by the IAB Europe to help digital publishers, advertisers, and technology vendors comply with the GDPR and the eprivacy Directive. The TCF provides a technical and legal standard for managing user consent and transparency when processing personal data for advertising and analytics purposes. Use CookieScript CMP that is integrated with the IAB TCF v2.2.

Why is TCF evolving?

European regulators and data protection authorities, especially CNIL, APD, and EDPB, continue to increase the requirements for advertisers, vendors, and CMPs. TCF v2.3 addresses these ongoing concerns to comply with all data privacy laws present in the EEA. Use CookieScript CMP, integrated with the IAB TCF v2.2 that is preparing for the IAB TCF v2.3.

When will the IAB TCF v2.3 come into force?

The exact enforcement date of TCF v2.3 has yet to be announced; however, it is expected to take effect on February 1, 2026. All CMPs and Vendors will be required to update their IAB TCF implementation to support v2.3 before this date. CookieScript CMP is preparing for IAB TCF v2.3 implementation and certification, so register to test its features.

Is CookieScript Google TCF 2.2 certified?

Yes, CookieScript is certified by both IAB TCF and Google for TCF 2.2 and is preparing for IAB TCF v2.3 certification. CookieScript is also a Google-certified CMP, listed among Google-certified CMPs.

What are the differences between IAB TCF v2.2 and v2.3?

Key changes in TCF v2.3 include improved user choice transparency, standardized UI elements, increased information disclosure, reduced reliance on legitimate interest, enhanced publisher controls over vendors, enhanced enforcement readiness, and Global Privacy Platform support.

How to Prepare for IAB TCF V2.3?

To prepare for IAB TCF V2.3, choose the right CMP provider that is planning to support TCF v2.3, such as CookieScript. Audit your current consent setup, update your privacy policy and privacy notices, and test vendors.