IAB TCF 2.3 consultant: TCF and Consent Mode v2 coordination

IAB Transparency and Consent Framework (TCF) v2.3 is the consent standard required by programmatic advertising platforms (Criteo, RTB House, AppNexus, OpenX, and the entire AdTech ecosystem). For sites with significant programmatic revenue, TCF v2.3 compliance is mandatory — without it, your impressions can be filtered by demand-side platforms or programmatic exchanges. TCF coexists with Google Consent Mode v2 but doesn’t replace it: they’re two separate signals that the same CMP can manage in parallel. My IAB TCF 2.3 consultant role is to align both signals on the same CMP, configure the Vendor List correctly, and validate the TC string is properly transmitted to AdTech partners.

TCF vs Consent Mode v2 — distinct standards

Google Consent Mode v2: signals understood by Google products (GA4, Google Ads, Floodlight). Categories ad_storage, analytics_storage, ad_user_data, ad_personalization.

IAB TCF v2.3: signals understood by AdTech and programmatic platforms. Transmits a “TC string” encoding the user’s consent for ~12 purposes and a Vendor List of accepted partners.

A site running both programmatic AND Google paid media must signal both standards correctly. A CMP supporting only Consent Mode v2 misses programmatic compliance, and vice versa.

CMP support for TCF v2.3

CMP	TCF v2.3 native	Consent Mode v2 native
Didomi	✓ Excellent	✓
Cookiebot	✓	✓
OneTrust	✓ Excellent (enterprise)	✓
Axeptio	✓	✓
tarteaucitron	Partial	Manual config required

For programmatic-heavy sites (media with banner inventory, news, gambling), Didomi or OneTrust are the typical choices. For sites with marginal programmatic but strong Google Ads, Axeptio or Cookiebot suffice.

TCF v2.3 — the 12 purposes

TCF v2.3 declares 12 purposes the user accepts or refuses individually:

1. Store and access information on a device
2. Use limited data to select advertising
3. Create profiles for personalized advertising
4. Use profiles to select personalized advertising
5. Create profiles to personalize content
6. Use profiles to select personalized content
7. Measure advertising performance
8. Measure content performance
9. Understand audiences through statistics or combinations of data from different sources
10. Develop and improve services
11. Use limited data to select content
12. (Special purposes) Ensure security, prevent fraud

The CMP must collect granular consent per purpose, and the resulting TC string is transmitted to partners.

Vendor List management

The IAB Global Vendor List (GVL) lists thousands of AdTech vendors. Each vendor declares the purposes for which it processes data. Your CMP must:

1. Allow the user to refuse vendors individually if they wish
2. Update the Vendor List regularly (TCF v2.3 mandates monthly refresh)
3. Transmit the user’s accepted/refused vendor list in the TC string

In practice, displaying 800+ vendors individually destroys UX. The CMP allows the user to refuse all, accept all, or open a detailed panel. Modern CMPs (Didomi, OneTrust) handle this elegantly.

Coordinated deployment

Standard mission flow for TCF v2.3 + Consent Mode v2:

1. Audit: programmatic stack inventory (DSP, SSP, DMP, ad servers), AdTech vendors active, existing CMP support
2. CMP selection or upgrade: confirm or change CMP based on TCF v2.3 needs
3. Purpose configuration: map your business purposes (analytics, ads, content personalization, fraud) to IAB purposes
4. Vendor List configuration: which vendors enabled, which excluded
5. GTM integration: TCF events listened in GTM, Consent Mode v2 signals derived from TCF state, ad tags fire conditionally
6. Acceptance testing: TC string validates with IAB CMP Validator, GA4/Ads sees correct Consent Mode signals
7. Documentation: LIA, processing register, privacy policy mention TCF compliance

Typical fee for the combined mission: €5,500 for ~9 days.

Frequently asked questions

Is TCF v2.3 mandatory?

For sites in IAB Europe’s TCF Framework jurisdiction (most EU media with programmatic), yes — to be eligible for IAB-compliant programmatic revenue. For sites without programmatic, no.

TCF and Consent Mode v2 conflict?

No. They’re two parallel signals. A well-configured CMP transmits both correctly. The same user consent action updates both signals simultaneously.

How often does the Vendor List update?

TCF v2.3 mandates monthly refresh. Major CMPs handle this automatically.

tarteaucitron compatible with TCF v2.3?

Partially. Possible to wire manually, but rare in practice. For programmatic-heavy sites, recommend migrating to a CMP with native TCF v2.3.