# IAB TCF 2.2 explained for publishers and advertisers

> What the IAB TCF 2.2 is, how the TC String and Global Vendor List work, what changed from version 2.1 and what publishers and advertisers need to do about it.

Source: https://www.cookiesh.eu/blog/iab-tcf-2-2-explained  
Published: 2026-07-21

## Key takeaways

- The IAB Transparency and Consent Framework (TCF) is an industry standard for passing GDPR consent choices from websites to ad tech vendors.
- TCF 2.2, released in 2023, removed legitimate interest as a legal basis for ad and content personalization purposes 3 to 6.
- Under TCF 2.2, the first layer of a consent banner must show how many vendors are asking to process the visitor's data.
- Registered CMPs encode choices in a TC String, which scripts read through the __tcfapi JavaScript API and pass along in ad requests.
- Using the TCF does not by itself make a website GDPR-compliant; the banner and the processing still have to meet the law.

The IAB Transparency and Consent Framework (TCF) is an industry standard that lets a website collect GDPR consent once and pass it, as an encoded TC String, to the ad tech vendors that serve and measure ads. Version 2.2, released in 2023, tightened the rules: no legitimate interest for personalization purposes, vendor counts on the first layer, and plainer purpose descriptions.

## What is the IAB TCF?

The TCF is a framework run by IAB Europe, the European trade association for digital advertising. It standardizes how a consent management platform (CMP) asks for consent, how it records the answer and how ad tech vendors read it.

It has four building blocks:

- **Policies:** the rules that participating publishers, vendors and CMPs agree to follow.
- **Purposes and features:** a fixed, numbered list of things vendors may do with data, described the same way on every TCF banner.
- **Global Vendor List (GVL):** the public register of participating vendors, with the purposes each one uses and the legal basis it claims.
- **Technical specifications:** maintained with IAB Tech Lab, they define the TC String format and the `__tcfapi` JavaScript API.

## Who does what in the TCF?

Publishers run the websites and choose which vendors to work with. Vendors are ad tech companies registered on the GVL. CMPs are registered providers that show the banner and generate the TC String.

A typical flow looks like this:

1. A visitor lands on the publisher's site and the CMP displays the banner.
2. The visitor accepts, rejects or customizes purposes and vendors.
3. The CMP encodes the choices in a TC String and stores it.
4. Scripts on the page read the choices through the `__tcfapi` API.
5. The TC String travels with ad requests, so downstream platforms, such as supply-side and demand-side platforms (SSPs and DSPs) that sell and buy ad space, can check consent before acting.

Advertisers mostly meet the TCF indirectly. Their ad platforms and measurement partners participate as vendors and must respect the TC String on every impression they buy or measure.

## What changed in TCF 2.2?

TCF 2.2 removed legitimate interest as a legal basis for purposes 3 to 6, which cover ad and content personalization, and requires the first layer of the banner to show the number of vendors. Legitimate interest is a GDPR legal basis that doesn't require consent but lets people object.

Here is how the main purposes line up after the change:

| Purpose | What it covers | Legal basis allowed in TCF 2.2 |
|---|---|---|
| 1 | Storing or accessing information on a device | Consent only |
| 2 | Using limited data to select advertising | Consent or legitimate interest |
| 3 | Creating profiles for personalized advertising | Consent only (legitimate interest removed) |
| 4 | Using profiles to select personalized advertising | Consent only (legitimate interest removed) |
| 5 | Creating profiles to personalize content | Consent only (legitimate interest removed) |
| 6 | Using profiles to select personalized content | Consent only (legitimate interest removed) |
| 7 | Measuring advertising performance | Consent or legitimate interest |
| 8 | Measuring content performance | Consent or legitimate interest |

The framework defines further purposes, such as audience research and product development. Check IAB Europe's current policy for the full list and wording.

Version 2.2 also rewrote purpose names and descriptions in plainer language, asked vendors to disclose more about their processing, such as how long they keep data, and put more weight on letting visitors reopen the banner and change their choices. IAB Europe's documentation lists the complete set of changes.

In practice, banners that relied on legitimate interest for profiling lost most of their "on by default" toggles, and vendors that personalized ads on that basis now need consent.

## How do I read TCF consent in JavaScript?

Call the CMP's `__tcfapi` function with the `addEventListener` command. Your callback runs when the TC String is loaded and again whenever the visitor changes their choice.

```js
const VENDOR_ID = 123; // your vendor ID on the Global Vendor List

window.__tcfapi('addEventListener', 2, (tcData, success) => {
  if (!success) return;

  const ready = tcData.eventStatus === 'tcloaded' ||
                tcData.eventStatus === 'useractioncomplete';
  if (!ready) return;

  const deviceAccess = tcData.purpose.consents[1] === true;
  const vendorConsent = tcData.vendor.consents[VENDOR_ID] === true;

  if (!tcData.gdprApplies || (deviceAccess && vendorConsent)) {
    loadAdScript(); // your own loader
  }
});
```

A real integration checks every purpose the vendor needs, not just purpose 1. Where legitimate interest is still allowed, it also reads `tcData.purpose.legitimateInterests` and `tcData.vendor.legitimateInterests`, and it respects any publisher restrictions encoded in the string.

## What do publishers need to do?

Use a registered CMP that supports TCF 2.2, keep your vendor list honest and make refusing as easy as accepting. A practical checklist:

1. **Pick a registered CMP** that supports TCF 2.2 and is kept up to date with the current GVL.
2. **Select only the vendors you work with**, not the whole GVL, so the vendor count on your first layer is accurate and defensible.
3. **Offer "Reject all" on the first layer** with the same prominence as "Accept all". The TCF doesn't override regulator guidance on [cookie banner dark patterns](/blog/cookie-banner-dark-patterns).
4. **Add a persistent link** to reopen the banner so visitors can change or withdraw consent at any time.
5. **Gate non-TCF scripts too**, such as analytics or social pixels, through your CMP's category controls.
6. **Keep Google in sync.** If you run Google tags, set [Google Consent Mode v2](/blog/google-consent-mode-v2-guide) from the same choice, and check Google's current CMP requirements for its publisher products in Europe.

## Does using the TCF make you GDPR-compliant?

No. The TCF is a technical and policy standard, not a certification. The GDPR still requires consent that is freely given, specific, informed and unambiguous (Article 4(11)), and you must be able to demonstrate it (Article 7(1)).

The framework itself has drawn regulatory and legal scrutiny in Europe, including over whether a TC String counts as personal data. The EU's top court has found that it can be when it can be linked to an identifier such as an IP address.

Treat TC Strings as personal data, keep [proof of consent](/blog/proof-of-consent-records) for your records, and review your banner against the [conditions for valid consent](/blog/valid-consent-checklist) rather than assuming TCF participation covers them.

## Bottom line

TCF 2.2 matters if you sell or buy programmatic advertising that touches European visitors. Publishers need a registered CMP, a vendor list they can justify and a banner that treats refusal fairly. Advertisers need partners that read and respect the TC String. Neither group should mistake the framework for compliance on its own.

*This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.*

## FAQ

### Do I need the TCF if I don't run programmatic ads?

Usually not. The TCF exists to carry consent through the programmatic advertising supply chain. If you only use analytics and a few marketing pixels, a standard banner with category-based choices is typically enough.

### Can any consent banner generate a TC String?

No. Only consent management platforms registered with IAB Europe can generate TC Strings for the framework. Each registered CMP has an ID that is encoded in the string, so vendors can see which CMP produced it.

### Is the TCF required by law?

No. It is a voluntary industry framework run by IAB Europe. Some ad platforms require publishers to use a TCF-registered CMP for European traffic, but that is a commercial condition rather than a legal one.

### How does the TCF relate to Google Consent Mode?

They are separate systems. The TCF signals consent to many ad tech vendors through a shared string, while Consent Mode signals consent to Google tags. Publishers that use both should set them from the same visitor choice so they never disagree.

## Sources

- [IAB Europe Transparency & Consent Framework](https://iabeurope.eu/transparency-consent-framework/)
- [Regulation (EU) 2016/679 (GDPR), EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [EDPB Guidelines 05/2020 on consent](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en)