Everything you need to know about TCF v2.2

TCF v2.2 introduces changes which the industry can make to address many of the concerns raised in the Belgian DPA ruling that are not dependent on pending answers from the CJEU. 

Let’s go over how TCF v2.2 differs from v2.1, and what participants can expect from the changes. 

The Belgian DPA ruling on the TCF

In February 2022, the Belgian DPA (the APD) issued a decision finding that IAB Europe’s Transparency and Consent Framework (TCF)  failed to comply with certain GDPR principles.

IAB Europe appealed the decision to the Belgium Market Court, which referred three core questions to the CJEU. In parallel, IAB Europe submitted an action plan to the APD, which was approved by the APD in January 2023. This triggered a 6-month deadline to implement the action plan by July 2023.

After a second appeal from IAB Europe, the Belgian DPA suspended IAB Europe’s action plan implementation deadline while outstanding questions in the first appeal still await answers from the CJEU. 

For the full context and ongoing updates, please reference our FAQ on the Belgian DPA ruling. 

WHAT’S NEW UNDER TCF V2.2 

Removing legitimate interest as a legal basis for certain purposes

Vendors declare the legal basis by which they’re using information per purpose. 

With TCF v2.2, “legitimate interest” will be removed as a acceptable legal basis for certain purposes:

• Purpose 3: Create a personalized ads profile
• Purpose 4: Select personalized ads
• Purpose 5: Create a personalized content profile
• Purpose 6: Select personalized content 

Vendors still declaring legitimate interest for the above purposes will need to establish consent as their legal basis if they are to continue using the TCF. 

Easier-to-understand disclosures and standardized vendor information

TCF purposes and their descriptions will move away from the currently mandatory legal text and replaced with improved user-friendly descriptions. Additionally, illustrations should be made available on the CMP’s second layer so that users can easily visualize what the different purposes mean. 

Vendors will also be required to provide additional information as part of their registrations, which will then be disclosed by the CMP, including:

• The categories of data collected and processed;
• How long data is kept for each declared purpose, i.e. the retention periods;
• A link to a webpage which explains the vendor’s legitimate interests at stake

There will also be some new purposes available for vendors to declare. 

Disclosing the size of the vendor list 

Publishers will be required to disclose the total number of vendors on their vendor list on the first layer of their CMP. That number includes any vendors not participating in the TCF as well. 

In their overview of the changes coming with TCF v2.2, IAB Europe specifies that “the TCF policies will include a warning that an unjustifiably large number of Vendors may impact users’ ability to make informed choices and increase Publisher and Vendor legal risk.” As such, they’re encouraging publishers to limit their vendor lists to only include those they work with and which are most relevant to them. 

Making withdrawing consent as easy as giving consent

While specific requirements around withdrawal of consent are still to come, we know that TCF v2.2 will require publishers to ensure that users can easily resurface the CMP UI, e.g. via a floating icon or a footer link. In cases where users are presented with a “Consent to All” call to action, the withdrawal call must be at an equivalent level, such as “Withdraw consent to all”. 

PREPARING FOR TCF V2.2

Deadlines for supporting TCF v2.2

The latest iteration of IAB Europe’s Transparency and Consent Framework, TCF v2.2 will be released in mid May 2023. Vendors must update their registrations by June 30, 2023 and all TCF participants must be supporting v2.2 by September 30, 2023. 

Updates to vendor registrations 

Vendors will be updating their registrations with the new types of disclosures required, and evaluating whether they are declaring the right legal bases or if they need to claim any of the new purposes introduced. 

Changes to CMP UIs

CMP providers must ensure they can reflect updated vendor registrations by ingesting the new version of the Global Vendor List. They will also be changing their UIs to reflect the new purpose names and descriptions, as well as making the illustrations that explain the purposes available. 

Call to review vendor lists and user experience

Publishers will need to ensure that their CMP UI can be easily resurfaced by users to change their preferences or withdraw consent. IAB Europe also suggests that publishers should work to review and reduce their vendor list to a point where they feel comfortable establishing transparency and meaningful consent.

For more insight into what it means to curate a vendor list, watch our webinar, “How many vendors is enough?”