Sign in
Start free

Frameworks

IAB TCF v2.3

Transparency & Consent Framework, version 2.3

The TCF is IAB Europe’s standard for passing a visitor’s choices from a website to advertising technology vendors. Version 2.3 makes every new consent string record which vendors the visitor was shown.

Start free
Run a free scan

At a glance

Framework

Region
European Union and United Kingdom
Status
Version 2.3 required from March 2026
If you do not use it
Not a law. IAB Europe can suspend or expel CMPs, vendors and publishers that break its policies, and regulators judge the consent itself under the GDPR and ePrivacy rules. Belgium’s data protection authority fined IAB Europe €250,000 over the TCF in 2022, and a Belgian court upheld the fine in 2025.
Who it affects
Publishers that work with advertising technology vendors for visitors in the EEA or UK. Vendors on the TCF Global Vendor List read the visitor’s choices from a TC string, which only a CMP registered with IAB Europe may create.

What IAB TCF v2.3 requires

  • Use a CMP registered with IAB Europe to create the TC string and share it with vendors through the TCF API.
  • Show the purposes and the number of vendors on the first screen, with a link to the full list of named vendors.
  • Honour legitimate-interest objections separately from consent.
  • Ask visitors again when you add new vendors, or when IAB Europe says a policy change requires it.
  • Avoid dark patterns: give the text of the two main buttons the same font, size and style, with contrast of at least 5 to 1, and never make either look disabled.

What the banner does here

On Growth and Scale, the banner supports the IAB Transparency and Consent Framework v2.3, in the same opt-in mode as in the EU and UK.

How GrantCookie covers it

  • Scheduled scans. The scanner finds the cookies and trackers your site sets, sorts them into categories and re-checks on every scheduled scan, so the banner asks about what is really there.
  • Provable records. Every choice is timestamped and stored with the banner version the visitor saw. Paid plans include consent log export.
  • Withdrawing consent. A re-open control stays on every page, so visitors can withdraw or change their choice at any time.

See every feature

The consent log: each row has a timestamp in UTC, a consent ID and the visitor’s choice

This page is general guidance. It is not legal advice. Check your specific obligations with a qualified adviser.

Related regulations

All regulations

  • GDPR

    Opt-in

    General Data Protection Regulation

    European Union and United Kingdom Applies since May 2018

  • Google Consent Mode v2

    Framework

    EEA, UK and Switzerland Required for Google Ads in the EEA from March 2024

  • ePrivacy Directive

    Opt-in

    Privacy and Electronic Communications Directive 2002/58/EC

    European Union Adopted 2002, amended 2009; a 2025 proposal to change it is not yet law

Start free. No card, no sales call.

Scan your site, publish the banner, and move up a tier when you outgrow the free plan. Every plan is on the pricing page.

14-day trial on paid plans · Cancel any time · No card required to start

Start free
See every price