What Is the IAB TCF (and Why the Version Matters)
The ad industry's shared consent standard for Europe, why TCF 2.3 is now mandatory, and the court rulings that reshaped it.
7 min read
The IAB Europe Transparency and Consent Framework (TCF) is the advertising industry's shared standard for capturing a visitor's cookie consent and passing it to the many vendors in the programmatic advertising chain. If you sell ad inventory or run Google's ad stack against European traffic, your consent tool almost certainly speaks it. The current version, TCF 2.3, has been mandatory since March 1, 2026, and an out-of-date signal can quietly cost you ad revenue.
What the TCF Actually Does
Programmatic advertising involves dozens of vendors bidding on an ad slot in milliseconds. Each one needs to know what the user consented to. The TCF standardizes that into a TC String, a compact encoded record of the visitor's choices and the legal bases claimed, plus a shared Global Vendor List. Your consent tool generates the string; the ad vendors read it. Without a common format, consent could not travel through the auction at all.
TCF 2.3 Is the Current Version
This is the single most common place older guidance goes wrong: TCF 2.2 is no longer current. Version 2.3 shipped in June 2025 and became mandatory on March 1, 2026, after a transition deadline of February 28, 2026. Among other changes, it requires a disclosedVendors segment proving which vendors were actually shown to the user. A TC String that omits it is treated as non-compliant, and inventory tied to it can be downgraded to "limited ads," which pay less. If your setup has not been updated since 2024, this is worth checking today.
The Legal Backdrop
The framework has been through the courts, and the outcome matters for how much you should lean on it. In March 2024, the Court of Justice of the EU ruled that the TC String is personal data and that IAB Europe is a joint controller for creating the consent signal (though not for what individual vendors later do with it). In May 2025, the Brussels Market Court upheld those substantive findings while annulling the specific fine the Belgian regulator had issued, on procedural grounds. The headline "IAB Europe was cleared" is wrong: the personal-data and joint-controller findings stand; only that one penalty did not survive.
Do You Even Need the TCF?
Many sites do not. The TCF exists for the programmatic advertising ecosystem. If you run analytics and a few first-party tools but do not sell inventory into the real-time bidding market, you may need a compliant consent banner without ever emitting a TC String. The TCF becomes relevant when you work with programmatic ad vendors or parts of Google's European ad stack that require it. Adopting it when you do not need it adds complexity for no benefit.
How Concord Fits
Concord supports the current TCF where you need it and a straightforward, non-TCF consent banner where you do not, so you are not forced into the programmatic framework just to comply. It keeps the signal current as the standard changes, and because consent sits on the same platform as your policies and data mapping, the version churn in ad-tech does not become one more thing your privacy team has to track by hand.