TCF v2.2 amendments 2024

Context

On March 7, 2024, the Court of Justice of the European Union (CJEU) issued a judgement in a case involving IAB Europe and the Belgian Data Protection Authority (APD). The court clarified that Transparency and Consent (TC) Strings may be considered personal data under certain conditions, particularly if they can be linked with other identifiable data points, thereby enabling the identification of an individual with reasonable effort.

In response to the CJEU's reasoning, the Transparency & Consent Framework (TCF) Steering Group has approved a new iteration of the IAB TCF Framework, incorporating three new amendments. These changes aim to assist online ecosystem participants in adhering to the ePrivacy Directive and GDPR requirements as expected by regulators.

This updated version is based on measures proposed in the “action plan” submitted to and approved by the Belgian Data Protection Authority (APD). The plan ensures compliance with the finding that TC Strings may qualify as personal data under the GDPR, thus necessitating a legal basis for their processing.

Amendments

✅ Inclusion of Special Purpose 3

A new special purpose, titled "Save and Communicate Privacy Choices" has been added to the TCF purposes taxonomy as Special Purpose 3, as outlined in IAB policies.

This purpose is specifically designed to address the processing of TC Strings to verify the consent and/or objection status of a Vendor and/or Purpose, ensuring users' privacy choices are respected. Vendors can declare this purpose at the registration level, provided they have conducted and documented a legitimate interest assessment (LIA) that demonstrates the users’ interests and fundamental rights do not outweigh the legitimate interests pursued.

✅ New secondary layer UI requirement for CMPs

TCF policies describe in Section D. c. VII: "c. When providing transparency about Purposes, Special Purposes, Features, Special Features and Vendors in connection with a legitimate interest for the same, a single secondary layer must be provided that allows the user to (...) VII. review where applicable the storage and access information relating to the CMP’s recording of Signals, including the maximum device storage duration."

CMPs should, at a minimum, disclose on the secondary layer of their UIs how the TC String is stored and the duration for which it is stored on the user's device. According to IAB recommendation (FAQ n°8), Didomi will address this requirement by including a dedicated section at the bottom of the second layer of the notice. The new section called "About the storage of your choices" will list the cookies added by Didomi to collect consent and their maximum duration.

This new section will only be displayed when TCF is enabled.

The names of the cookies will be retrieved dynamically based on the actual configuration (whether default names or custom names).

✅ Policies versioning

The Policies version has been incremented from 4.0.a to 5.0, and this change must be reflected in the TC Strings.

Starting 4 October 2024, new TC Strings must be created under policies version 5.0. TC Strings created under policies version 4 before this date will remain valid.

Impacts

Timeline

What you have to do

For WEB SDK

The changes will be reflected automatically in your notice. You don't have to do anything.

For mobile SDK

New SDK versions were released to support the new amendments. The minimum required versions are the following:

• Android and Android TV - 2.9.0
• iOS and tvOS - 2.10.0
• Unity - 2.5.0
• Flutter - 2.6.0
• React native - 2.6.0