TCF (Transparency and Consent Framework)

The Transparency and Consent Framework is IAB Europe's standard for recording a user's GDPR and ePrivacy choices on a website or app and transmitting them, as a consent string, to every vendor in the advertising chain, together with a Global Vendor List that says which vendors participate and for which purposes.

The current version is TCF v2.3, launched in April 2025; participants had until 28 February 2026 to adopt it. Version 2.2 was launched on 16 May 2023. The framework's components are the policies, the technical specifications, the Transparency and Consent (TC) string with the Global Vendor List format, and lists of registered vendors and consent management platforms (IAB Europe, TCF). Version 2.3 makes the "Disclosed Vendors" section a mandatory part of the TC string, which IAB Europe describes as resolving the ambiguity around legitimate interest (IAB Europe, TCF).

TCF matters to an RTB stack because the bid request must carry the string and the bidder must honor it. OpenRTB 2.6 carries regs.gdpr ("flag that indicates whether or not the request is subject to GDPR regulations") and the TC string in user.consent, and the GPP string in regs.gpp, which can wrap a TCF section (OpenRTB 2.6, sections 3.2.3 and 3.2.20). A DSP that bids without consent for purpose 1 (storage) or purpose 2 (basic ads) in the EU is the subject of the enforcement history covered in GDPR, ePrivacy and the bidstream.

Example: a consent management platform records that a user consented to purposes 1, 2 and 7 for vendor IDs 76 and 755, encodes it as a TC string beginning CP…, and the publisher's wrapper places it in user.consent; a bidder decodes it, checks its own vendor ID and purposes, and bids or passes.

Related: consent string, UID2, bid request, data residency.

Source: IAB Europe, Transparency and Consent Framework (v2.3, April 2025); IAB Tech Lab, OpenRTB 2.6.

1. IAB Europe, TCF
2. OpenRTB 2.6, sections 3.2.3 and 3.2.20