What IAB TCF v2.3 actually requires
The TCF is the standard the European ad industry uses to pass consent signals between websites, publishers, advertising tech vendors and demand-side platforms. Version 2.3 added new guidance around legitimate interest, vendor disclosures, and dark-pattern enforcement.
Key requirements
- Use a registered CMP that can encode and broadcast the TCF consent string
- Display the full list of vendors and purposes the user is consenting to
- Honour legitimate-interest objections separately from consent
- Re-prompt for consent when the vendor list or purpose set changes materially
- Avoid dark patterns — equal prominence for Accept and Reject
At a glance
Full name
Transparency & Consent Framework, version 2.3
Region
European Union & United Kingdom
Status
Current version since 2023
Who it affects
Publishers and sites that work with EU/UK advertising vendors. If you use programmatic ads or work with any of the 1,000+ TCF-registered vendors, you need a TCF-compliant CMP.
Penalties
TCF non-compliance is enforced indirectly: IAB Europe can suspend non-compliant CMPs, and DPAs across the EU have fined sites with broken TCF setups under the GDPR.
How GrantCookie covers it
Compliant defaults
Opt-in by default, granular categories, and a reject button as prominent as accept — the configuration regulators expect.
Provable records
Every consent is timestamped and stored with the banner version, so you can show exactly what was agreed to.
Easy withdrawal
A persistent re-open control lets visitors change their mind at any time, exactly as the law requires.
This page is general guidance, not legal advice. Check your specific obligations with a qualified adviser.