Editor’s note: Updated July 2025
Since the introduction of the Transparency and Consent Framework (TCF) v2.0 in 2019, the digital advertising landscape has undergone significant changes. The latest iteration, TCF v2.2, was released on May 16, 2023 and brings important updates to enhance transparency and user control in compliance with GDPR and the ePrivacy Directive.
What is the Transparency and Consent Framework (TCF)?
The TCF is a set of guidelines to standardize and simplify the communication process of consent management between a publisher, its ad tech vendors, and advertisers throughout the programmatic advertising industry. It enables all participants to provide interest-based, targeted advertising to consumers in a compliant manner with the European ePrivacy Directive and the General Data Protection Regulation (GDPR).
The TCF makes it easier for all participants to comply with the first steps of gathering consent to collect data for interest-based, targeted advertising and signal that information to ad tech partners and advertisers approved by the consumer.
The IAB states that the key purpose of the framework is to enable consumers the right to grant or withhold consent, or to object to their data being processed for digital advertising.
Key changes in TCF v2.2
1. Removal of legitimate interest for certain purposes
Under TCF v2.2, vendors can no longer rely on “legitimate interest” as a legal basis for:
- Creating personalized ads profiles
- Selecting personalized ads
- Creating personalized content profiles
- Selecting personalized content
Consent is now the sole legal basis for these purposes, aligning with GDPR requirements.
2. Enhanced user interface requirements for CMPs
Consent Management Platforms (CMPs) must now:
- Provide clearer, user-friendly descriptions of data processing purposes
- Include illustrative examples to help users understand how their data is used
- Offer a more accessible interface for users to manage their consent preferences
3. Standardization of vendor information
Vendors are required to disclose:
- The categories of data they collect
- Data retention periods
- Their legitimate interests, where applicable
This information must be presented in the CMP’s user interface to ensure transparency.
4. Updated technical specifications
Technical updates include:
- Deprecation of the getTCData command in favor of event listeners for obtaining the Transparency and Consent string
- Modifications to the Global Vendor List (GVL) to include additional vendor information
What TCF v2.2 means for publishers
A year into its adoption, TCF 2.2 has become the new baseline for GDPR-compliant consent management. But for mobile app publishers, the impact of these changes goes well beyond ticking a legal checkbox.
One of the biggest shifts: no more fallback to “legitimate interest” for personalized advertising. That means passive opt-ins are off the table. If a user doesn’t actively consent, you can’t serve them personalized ads. For mobile publishers who once counted on a silent majority, this is a fundamental revenue shift.
To stay competitive, publishers must now rely on clear, compelling consent flows and high-performing CMPs (Consent Management Platforms). It’s not just about getting consent — it’s about designing consent flows that work well within the constraints of a small screen, limited attention span, and highly UX-sensitive environment.
There’s also growing pressure to strike the right balance between transparency and experience. Overly technical language or cluttered UI can tank opt-in rates. But simplifying too much may leave you exposed to compliance risk. Execution matters.
What comes after TCF v2.2?
TCF v2.2 marks a meaningful step forward in aligning digital advertising with evolving privacy expectations, but compliance is the floor, not the finish line. Publishers who treat consent as part of the user journey (not a legal speed bump) will be better positioned to protect their ad revenue and user trust in 2024 and beyond. And as the industry lays the groundwork for what’s next, publishers should be prepared to adapt again.
Anticipating TCF v2.3 and beyond
The IAB recently closed the public comment period for TCF v2.3, signaling ongoing efforts to refine the framework in response to regulatory feedback and industry needs. While specific details of v2.3 are forthcoming, publishers should stay informed about these developments to ensure continued compliance and to leverage new features that may enhance user transparency and control.
Navigating Apple’s privacy requirements
Beyond the IAB’s initiatives, platform-specific privacy measures are reshaping the landscape. Apple’s introduction of Privacy Manifests requires app developers to disclose data collection practices, including those of third-party SDKs. This adds another layer of complexity for publishers, necessitating a harmonized approach to consent management that aligns with both TCF standards and platform-specific requirements.
The interoperability challenge
As the ecosystem fragments across platforms and regulations, one of the biggest conversations gaining steam is about interoperability between consent frameworks, alternative identifiers, and contextual solutions. Publishers will increasingly need solutions that can harmonize consent across web, app, and CTV, while respecting platform-specific rules and regional regulations.
Bottom line
Compliance is no longer a checkbox; it’s a moving target. Publishers that stay informed, invest in flexible consent management tools, and choose partners who prioritize privacy-first innovation will be best positioned to thrive, no matter what comes next.
