TCF v2.3 update aims to solve vendor disclosure ambiguity

The IAB Tech Lab, in partnership with IAB Europe, announced on April 19, 2025, that the Transparency and Consent Framework (TCF) version 2.3 technical specifications are now open for public comment. The comment period will remain open until May 19, 2025, which is a full month from today's date. This represents a significant technical enhancement to the digital advertising industry's primary mechanism for GDPR compliance.

The TCF v2.3 update directly addresses a persistent technical challenge in the framework: vendor disclosure ambiguity. According to IAB Tech Lab's announcement, certain vendors have faced uncertainty in specific scenarios where it remains unclear whether they were properly disclosed to users.

This distinction becomes particularly critical when a vendor intends to process data for Special Purposes under Legitimate Interest. The previous TCF specification had partially solved this issue for vendors that only declare Special Purposes, but significant ambiguity remained in more complex scenarios.

The specific technical scenario being addressed occurs when:

1. A vendor declares Legitimate Interest as the legal basis for one or both Special Purposes and only Legitimate Interest for regular Purposes.
2. The user exercises their "Right to Object" to the vendor's processing based on Legitimate Interest.
3. The Consent Management Platform (CMP) sets the value to "0" – meaning Legitimate Interest is not established or the user objected.
4. The vendor cannot determine if they were disclosed to the user, creating uncertainty about whether they can still process data for Special Purposes.

Technical solution: Mandatory Disclosed Vendors segment

The solution lies in a technical enhancement to the TC String structure. TCF v2.3 will now require the inclusion of a previously optional segment known as "Disclosed Vendors" in all TC Strings.

"The Disclosed Vendors segment will be required in all TC Strings, where it must appear after the Core segment," states the IAB Tech Lab documentation. The updated string format will follow this structure: "[Core segment].[disclosedVendors segment].[Publisher TC]"

This segment provides a binary signal (1 = disclosed, 0 = not disclosed) indicating whether a vendor was shown to the end user. By making this segment mandatory and ensuring it's included in TC Strings shared with vendors, the framework eliminates the ambiguity that previously existed.

Rowena Lam, Sr Director of Privacy & Data at IAB Tech Lab, is leading this technical enhancement effort. The implementation timeline specifies the end of May for finalizing technical specifications, with full industry adoption required by February 1, 2026.

Technical context and industry implications

The TCF has evolved significantly since its initial launch in 2018. The framework was created as a direct response to the GDPR, which fundamentally changed data privacy requirements across Europe. Through standardized technical specifications, the TCF enables websites and apps to inform users about how their data may be used and to capture their consent or objection preferences.

Each TCF iteration has addressed specific technical challenges. Version 2.0, launched in August 2019, brought major changes to accommodate publisher needs. Version 2.1 aligned the framework with the Planet49 ruling from the Court of Justice of the European Union. Version 2.2, launched in May 2023, implemented changes to meet requirements from the Belgian Data Protection Authority (APD).

This latest v2.3 update focuses on solving a technical ambiguity that affects a specific subset of vendors – those processing data under Legitimate Interest for Special Purposes.

Implementation requirements

The technical implementation requirements for TCF v2.3 will vary depending on current implementation status:

1. CMPs that already use the Disclosed Vendors segment must update their implementations to ensure the segment is included in TC Strings provided to vendors.
2. CMPs not yet using this segment will need to fully implement it.
3. Vendors affected by the current ambiguity must update their code to recognize and decode the new segment.

The IAB Tech Lab has established a specific timeline for implementation:

• End of May 2025: Finalization of the technical specifications
• February 1, 2026: Deadline for all CMPs and Vendors to update their implementation to support v2.3

Technical framework components

For context, the TCF consists of several interconnected technical components:

• TCF Policies
• TCF Terms & Conditions
• TCF Implementation Guidelines
• Transparency and Consent (TC) String with Global Vendor List Format
• The Consent Management Platform API
• Vendor Device Storage & Operational Disclosures
• Additional Vendor Information List Specification
• Global Vendor List (GVL)
• CMP list

These components work together to create a standardized system for gathering, storing, and communicating user privacy preferences across the digital advertising ecosystem.

Industry impact analysis

The TCF v2.3 update, while technically focused, has broader implications for the digital marketing ecosystem. By addressing vendor disclosure ambiguity, the framework provides greater certainty and technical clarity for how vendors can process data under the GDPR.

For marketers, these technical changes translate to more reliable data processing capabilities from their technology partners. When vendors have clear signals about disclosure status, they can make more confident determinations about data processing permissions, potentially reducing the risk of non-compliant data usage.

Publishers benefit from more transparent vendor operations, as all parties in the ecosystem will have access to the same disclosure information. This creates a more consistent user experience and potentially reduces compliance risks.

Technology vendors gain the most direct benefit from this update, as it resolves a specific technical ambiguity that has created operational challenges. Vendors processing data under Legitimate Interest for Special Purposes will now have definitive information about their disclosure status.

The impact extends beyond immediate technical implementation. By continuously refining the framework to address specific technical challenges, the IAB Tech Lab demonstrates the industry's commitment to maintaining robust privacy standards while enabling effective digital advertising operations.

Historical context of the TCF

The TCF has undergone several significant iterations since its inception:

• February 2017: IAB Europe launched the collaborative effort to create the TCF, involving more than 70 member companies and sectoral trade associations.
• April 25, 2018: TCF v1.1 was launched following extensive industry consultation.
• August 21, 2019: TCF v2.0 was launched, incorporating feedback particularly from publishers.
• August 19, 2020: TCF v2.1 was launched to align with the Planet49 ruling.
• May 16, 2023: TCF v2.2 was launched to implement changes required by the Belgian Data Protection Authority.
• April 19, 2025: TCF v2.3 technical specifications opened for public comment.

According to IAB Europe documentation, the TCF serves as "an accountability tool that relies on standardisation to facilitate compliance with certain provisions of the ePrivacy Directive and the GDPR." It applies principles from these legislative instruments to the specific context of the online industry.

Technical implementation steps

Companies involved in the digital advertising ecosystem should prepare for implementation by:

1. Reviewing the technical specifications available through the IAB Tech Lab.
2. Identifying which components of their systems will require updates.
3. Determining whether they will need to update their implementation to recognize the Disclosed Vendors segment.
4. Planning development resources to meet the February 1, 2026 implementation deadline.

Feedback on the technical specifications can be submitted to support@iabtechlab.com until May 19, 2025.

Timeline

• April 19, 2025: TCF v2.3 technical specifications released for public comment
• May 19, 2025: Public comment period closes
• End of May 2025: Finalization of technical specifications
• February 1, 2026: Implementation deadline for all CMPs and Vendors