TCF v2.2 amendments 2024

Context

On March 7, 2024, the Court of Justice of the European Union (CJEU) issued a judgement in a case involving IAB Europe and the Belgian Data Protection Authority (APD). The court clarified that Transparency and Consent (TC) Strings may be considered personal data under certain conditions, particularly if they can be linked with other identifiable data points, thereby enabling the identification of an individual with reasonable effort.

In response to the CJEU's reasoning, the Transparency & Consent Framework (TCF) Steering Group has approved a new iteration of the IAB TCF Framework, incorporating three new amendments. These changes aim to assist online ecosystem participants in adhering to the ePrivacy Directive and GDPR requirements as expected by regulators.

This updated version is based on measures proposed in the “action plan” submitted to and approved by the Belgian Data Protection Authority (APD). The plan ensures compliance with the finding that TC Strings may qualify as personal data under the GDPR, thus necessitating a legal basis for their processing.

 For more information on the CJEU decision regarding IAB Europe’s Transparency and Consent Framework (TCF), please refer to our dedicated blog article.

Amendments

✅ Inclusion of Special Purpose 3

A new special purpose, titled "Save and Communicate Privacy Choices" has been added to the TCF purposes taxonomy as Special Purpose 3, as outlined in IAB policies.

This purpose is specifically designed to address the processing of TC Strings to verify the consent and/or objection status of a Vendor and/or Purpose, ensuring users' privacy choices are respected. Vendors can declare this purpose at the registration level, provided they have conducted and documented a legitimate interest assessment (LIA) that demonstrates the users’ interests and fundamental rights do not outweigh the legitimate interests pursued.

Impact on UI notice Impact on consent Impact on console
New Special Purpose displayed when at least one IAB vendor included in the notice has declared it. None None

✅ New secondary layer UI requirement for CMPs

TCF policies describe in Section D. c. VII: "c. When providing transparency about Purposes, Special Purposes, Features, Special Features and Vendors in connection with a legitimate interest for the same, a single secondary layer must be provided that allows the user to (...) VII. review where applicable the storage and access information relating to the CMP’s recording of Signals, including the maximum device storage duration."

CMPs should, at a minimum, disclose on the secondary layer of their UIs how the TC String is stored and the duration for which it is stored on the user's device. According to IAB recommendation (FAQ n°8), Didomi will address this requirement by including a dedicated section at the bottom of the second layer of the notice. The new section called "About the storage of your choices" will list the cookies added by Didomi to collect consent and their maximum duration.

This new section will only be displayed when TCF is enabled.

The names of the cookies will be retrieved dynamically based on the actual configuration (whether default names or custom names).

Impact on UI notice Impact on consent Impact on console
New section displayed in layer 2 when TCF is enabled None None

✅ Policies versioning

The Policies version has been incremented from 4.0.a to 5.0, and this change must be reflected in the TC Strings.

Starting 4 October 2024, new TC Strings must be created under policies version 5.0. TC Strings created under policies version 4 before this date will remain valid.

Impact on UI notice Impact on consent Impact on console
None Policies version changed from 4.0 to 5.0 in TC string None

Impacts

The new Policies do not require CMPs to resurface the Framework UIs. There is no need to re-collect consent or re-publish the notice.

  Amendment Impact on UI notice Impact on consent Impact on console
#1 Inclusion of Special Purpose 3  New Special Purpose displayed when at least one IAB vendor added in the notice vendors declared it None None
#2 New secondary layer UI requirement for CMPs New sentence displayed in layer 2 when TCF is enabled None None
#3 Policies versioning None Policies version changed from 4.0 to 5.0 in TC string None

Timeline

Date Milestone
July 3rd, 2024 Deadline for Vendors to update their GVL registration
July 4th, 2024 Availability of Special Purpose 3 in the IAB TCF Global Vendor List (GVL) and corresponding translations as of Thursday 4 July 2024.
Mid July Didomi delivery to support the new amendments for both Web and Mobile SDKs 
October 4th, 2024 Deadline for CMPs to implement the new policies and for publishers to deploy it

What you have to do

For WEB SDK

The changes will be reflected automatically in your notice. You don't have to do anything.

For mobile SDK

New SDK versions were released to support the new amendments. The minimum required versions are the following:

  • Android and Android TV - 2.9.0
  • iOS and tvOS - 2.10.0
  • Unity - 2.5.0
  • Flutter - 2.6.0
  • React native - 2.6.0

You have to upgrade your app with the last version of the SDK before October 4th

⚠️ If you don't migrate your app to a version supporting the latest amendments by October 4th, we will disable the TCF integration for your app.