# Is a TCF consent string enough for GDPR? What the signal records and what it does not

## Where readings differ

| Reading | What it holds | What it relies on | What it means for a design |
|---|---|---|---|
| A framework-led reading | A correctly implemented flow, with consent recorded for the purposes that need it, gives participants a workable record. Legitimate interest stays available for the purposes where the policies allow it, such as measurement. | The framework's policies; Article 6(1)(f) | Vendors process on the registered basis the string satisfies |
| A regulator-led reading | The string is evidence that a signal was sent, not that consent was valid. Validity depends on the interface, the information given and the number of vendors. Legitimate interest is not available for personalised advertising or profiling. | Articles 4(11) and 7; the Court's 2023 and 2024 rulings; regulator decisions  | Advertising purposes run on consent only, with evidence kept beyond the string |

**Where the readings collide.** The framework can indicate that a vendor has registered a particular basis for measurement or basic ad selection. The parties may disagree about whether the use satisfies that basis, what a downstream vendor can show about the interface, or how to handle an older string. The question can vary by purpose and country.

## Questions to take to your counsel

1. For each purpose we use, which legal basis do we rely on, and do the framework policies allow it?
2. Does our consent interface meet the consent standard in each country we serve?
3. What evidence beyond the string can we produce for a given impression?
4. How do we treat strings created before a transition date?
5. Which purposes, if any, do we run on legitimate interests, and where is the assessment?
6. How does a withdrawal reach every vendor?

[Read the full checkpoint](https://adsovereign.com/blog/tcf-consent-string-lawful-basis) · [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/)