Is a TCF consent string enough for GDPR? What the signal records and what it does not

The Transparency and Consent Framework (TCF) coordinates the information consent tools send to participants. The General Data Protection Regulation (GDPR) addresses how consent is obtained and demonstrated. The format can tell a vendor which signals a tool emitted, while the interface and collection records can show what the person saw and did. GDPR Articles 4(11) and 7; IAB Tech Lab, consent string format, core string and segments.

Appendix A assigns consent for storing or accessing information on a device and for the profile and personalization purposes listed as Purposes 3 through 6. A vendor’s checks distinguish restrictions set by the publisher, its own registration and the relevant purpose. The Global Privacy Platform (GPP) can carry the TC String in its European section. Its transport role does not decide the processing basis. TCF Policies, Appendix A; TCF Implementation Guidelines; GPP Section Information, section 2.

The Court of Justice considered the capacity to link the string with another identifier. It held that the string is personal data where it can be associated by reasonable means with an identifier. The Court described possible joint control for recording preferences and distinguished subsequent operations for which the organization did not determine purposes and means. C-604/22, paras. 42–51, 58–77.

In a separate case involving a social network, the Court considered whether the network’s data use for personalized advertising could rest on legitimate interests. It addressed necessity and reasonable expectations on that record. The availability of a field in the industry format is a different question from the Court’s assessment. {V07b:C-252/21, paras. 105–126}.

Where the readings collide. The framework can indicate that a vendor has registered a particular basis for measurement or basic ad selection. The parties may disagree about whether the use satisfies that basis, what a downstream vendor can show about the interface, or how to handle an older string. The question can vary by purpose and country.

• Which purposes and legal bases has each participant registered?
• Which screen and disclosures did the person see?
• Which publisher restrictions apply to each vendor?
• What version and creation date appear in the stored string?
• Which purposes does the business actually use?
• How does a withdrawal change records for downstream vendors?
• Which countries and rules cover the people who saw the interface?

A decode can show a purpose bit without showing the text on the screen. A dated screenshot or interface version can show which options appeared, while a log may show the person’s action and the time it occurred. Counsel can compare those records for the same delivery event.

The vendor list changes over time. A buyer with today’s version can get a different set of entries from the one in effect when a string was created. Recording versions and publisher restrictions can help distinguish a vendor that was disclosed from one that was only present in the current list.

A withdrawal test can also be run through several recipients. The consent tool may update the string on the publisher’s site while a cached value remains in another service. Logs can show which value reached a bidder, which operation it supported and whether a later request used the revised signal. The record of a choice can be associated with several versions of a web page. A vendor may get a string after the publisher changes the list of services shown on the interface. An export that keeps both the list version and the time of choice gives counsel a way to compare the records.

A measure of campaign delivery can also use different inputs from a personalized profile. The participants may register one basis for measuring an impression and another for creating the profile used to select it. A flow map can show where those operations share a key and which vendor sees each input.

A technical validity check and a review of consent answer different questions. One can show that a field decodes under the applicable format. The other can look at the text, timing and action that generated the signal. A decision record can preserve those pieces of evidence alongside each other.

1. For each purpose we use, which legal basis do we rely on, and do the framework policies allow it?
2. Does our consent interface meet the consent standard in each country we serve?
3. What evidence beyond the string can we produce for a given impression?
4. How do we treat strings created before a transition date?
5. Which purposes, if any, do we run on legitimate interests, and where is the assessment?
6. How does a withdrawal reach every vendor?

Bring the fact sheet from the counsel briefing kit so that counsel answers your flow, not a generic one.

Download these questions

A publisher may value consistent choices across vendors or may want to distinguish the data it uses for delivery from the data used to measure an ad. Each choice changes what the consent tool displays, what the vendor has to assess and which records the business can produce for an impression.

A program that depends on many downstream systems may need more work to change settings or relay a withdrawal. The business can compare the value of a use with the effort of operating and reversing it. Counsel can examine the actual purpose and jurisdiction alongside that comparison.

Which option fits is a business decision taken with counsel. It depends on how much the program is worth to you, how much uncertainty you accept and who signs for it.

IAB Europe’s version 2.3 transition notice says strings created after 28 February 2026 without the Disclosed Vendors segment are invalid under the framework. It separately addresses strings created before that date. Its version 2.4 notice sets 23 October 2026 for web disclosures and 23 February 2027 for mobile apps and connected television. TCF version 2.3 transition; TCF version 2.4 timeline, checked 10 November 2026.

The Belgian Data Protection Authority reports that the Market Court annulled its 2022 decision on procedural grounds and upheld the fine on 14 May 2025. The authority’s summary distinguishes preference processing from later bidding operations. The Board’s Guidelines 1/2024 appear in its public consultation record as version 1.0. Belgian Data Protection Authority, 14 May 2025 Market Court summary; {V10a:EDPB Guidelines 1/2024 public consultation, checked 10 November 2026}.

The Commission’s Digital Omnibus proposal covers device information rules and automated signals. As of 10 November 2026 the European Parliament lists the proposal as awaiting a committee decision. Procedure 2025/0360(COD), stage reached. {V09b:COM(2025) 837, proposed Articles 88a and 88b, checked 10 November 2026}.

Related references

• identity and privacy guide
• ad tech legal checkpoints index
• counsel briefing kit
• advertising consent signals reference
• identity after privacy sandbox
• tcf
• consent string
• gpp tcf implementation
• tcf consent string decoder
• legitimate interest
• joint controller
• bank media network reference

1. GDPR Article 4(11). Checked 10 November 2026.
2. GDPR Article 7(1). Checked 10 November 2026.
3. GDPR Article 7(3). Checked 10 November 2026.
4. ePrivacy Directive Article 5(3). Checked 10 November 2026.
5. IAB Europe, C-604/22, paras. 42–51, 58–77. Checked 10 November 2026.
6. IAB Europe TCF Policies, v2026-05-29.5.0.b, Chapters II–III and Appendix A. Checked 10 November 2026.
7. IAB Europe, TCF v2.3 transition notice, Disclosed Vendors segment. Checked 10 November 2026.
8. IAB Europe, TCF v2.4 timeline, 16 July 2026. Checked 10 November 2026.
9. IAB Tech Lab, TCF consent string and vendor list formats, core and segments. Checked 10 November 2026.
10. IAB Tech Lab, TCF implementation guidelines, vendor and publisher checks. Checked 10 November 2026.