Open workspace

Guide · Industry standard

IAB TCF explained for people who live off ads

The TCF is the common language that consent banners and ad companies use in Europe. In this guide you will understand the TC string, the versions in force, the site's obligations and what happens to revenue when the signal is missing or arrives broken.

Audit my site's TCFRead the guide
  • ✓Based on the rules of IAB Europe and Google
  • ✓Explains Ad Manager error codes
  • ✓Read-only scan, no changes to the site
11data-use purposes that the visitor can accept or refuse
3regions where Google requires a TCF-certified CMP: EEA, United Kingdom and Switzerland
755Google's number in the TCF global vendor list
2.4version of the technical specifications published in July 2026

What it is

A common language between the banner and the ad partners

The Transparency and Consent Framework, or TCF, is a standard created by IAB Europe, the European digital advertising association. It defines how the consent banner asks the visitor, how it stores the answer and how it tells each ad company about that choice.

A banner that follows the standard is called a CMP, short for consent management platform. When the visitor clicks accept, reject or save preferences, the CMP records the choice in a short code called a TC string. This code travels along with every ad request.

This way, Google, Amazon, Microsoft and hundreds of other companies read the same answer, in the same format. Without the TCF, each partner would need its own integration with your site's banner, and no one could be sure the choice arrived in full.

The TCF is voluntary and is not a law. It is a tool to help participants comply with the GDPR and European cookie rules. Even so, in practice, it has become the path that almost the whole ad market uses in Europe.

Checklist

What you need to meet

These are the points that IAB Europe policies and Google require from a publisher that uses the TCF.

  1. Use a registered, certified CMP

    The TCF policies only allow working with registered CMPs that follow the rules. For personalized Google ads in the EEA, the United Kingdom and Switzerland, the CMP must also be on Google's list of certified CMPs.

    Example

    Before signing up, look for the CMP on both lists: IAB Europe's and Google's.

  2. Publish the privacy policy with a visible link

    The publisher must keep the legal information in a public privacy policy, with a prominent link from the content.

    Example

    Privacy Policy link in the footer of every page.

  3. State that you follow the TCF

    The policies ask for a public statement that the site complies with the TCF rules, with the ID number of the CMP used.

    Example

    This site participates in the IAB Europe Transparency and Consent Framework and follows its policies and specifications. The CMP used has the ID given by your CMP provider.

  4. Choose and control the vendors

    The publisher decides which vendors it works with. Include in the banner Google and all the ad partners that actually run on the site.

    Example

    Review the CMP's vendor list every time you add a new header bidding partner.

  5. Pass the choice on to the partners

    The visitor's choice must reach the partners present on the site. Without consent for purpose 1, Google advises not to call its ad tag.

  6. Let the visitor reopen the choices

    The visitor must be able to reopen the CMP screen through a link or button that is easy to find. The policies also ask to remind people of the right to object or to withdraw consent.

    Example

    A fixed link in the footer, Privacy preferences, reopens the CMP.

  7. Show the banner again when you add a vendor

    When the publisher adds a new vendor, the CMP must show the choices screen again to collect the answer.

  8. Do not change the standard

    The publisher must follow the specifications without unplanned modifications. The names of purposes and features cannot be changed.

In practice

Right and wrong

Official tools

Certified CMPs and official links

For Google ads, the CMP must be on both lists: IAB Europe's and Google's certified list.

Who it applies to

Who takes part in the TCF and where it ends

The standard involves four types of participants. Each has its own rules in the IAB Europe policies.

Publishers

Owners of sites and apps that show ads. They choose the CMP, decide which partners appear in the banner and pass the signal on to the partners.

CMPs

The companies that build the banner. They must apply to IAB Europe, be approved and follow the technical specifications to the letter.

Vendors

Ad and measurement companies registered in the global list. They read the TC string and only use data according to the recorded choice.

Where it does not apply

The European TCF was made for the rules of the EEA and the United Kingdom. For visitors from the United States or Brazil, other signals and laws come into play.

Definitions

The words that appear in the CMP dashboard

These terms appear in the CMP settings, in Ad Manager reports and in the partners' documentation.

TC string

A code that stores the visitor's choice: which purposes they accepted, which companies they gave permission to and which CMP created the record.

Purposes

There are 11 data uses, such as storing information on the device, building profiles for personalized ads and measuring ad performance.

Special purposes

Uses that do not depend on a choice, such as security and fraud prevention, delivering the ad and storing the person's own privacy choice.

Special features

More sensitive techniques, such as precise location data and device identification, which need separate permission.

Vendor list (GVL)

The Global Vendor List gathers the registered companies, each with a number. Google is vendor 755.

Disclosed vendors

Part of the TC string, called disclosedVendors, which says which companies were actually shown in the banner. Required since v2.3.

Consent and rights

How the visitor chooses and what they can do afterward

For each purpose, the vendor declares the legal basis it uses: consent or legitimate interest. With consent, nothing happens until the visitor says yes. With legitimate interest, the use can start, but the visitor has the right to object.

The CMP must show both clearly. The visitor can accept everything, reject everything or choose purpose by purpose and company by company. They must also be able to see the list of partners and what each one does.

The choice is not final. The visitor can go back to the banner at any time, withdraw consent or change their mind. That is why well-configured sites leave a permanent link, such as Privacy preferences, in the footer.

For the publisher, the practical rule is simple: the banner must tell the truth about who receives the data and must make rejecting as easy as accepting.

Site obligations

What the publisher must do to use the TCF

  1. Use a registered, certified CMPIt must be approved by IAB Europe. For Google ads in the EEA, United Kingdom and Switzerland, it must also be on Google's list of certified CMPs.
  2. Choose your partners carefullyInclude in the banner Google and every ad partner that actually runs on the site. A partner that does not appear in the banner cannot use the data.
  3. Publish the privacy policyThe TCF policies ask for a public policy, linked from the content, and a public statement that the site follows the TCF.
  4. Pass the signal to all partnersThe ad code must read the TC string and send it with every request. Header bidding, Ad Manager and extra networks must receive the same signal.
  5. Wait for the CMP before adsRequests made before the CMP responds go out without consent. Use the CMP event to release ads only when the TC string is ready.
Example with the standard API of TCF CMPs
// Espera a CMP antes de liberar os anúncios
__tcfapi('addEventListener', 2, function (tcData, ok) {
  if (!ok) return;
  if (tcData.eventStatus === 'tcloaded' ||
      tcData.eventStatus === 'useractioncomplete') {
    // tcData.tcString está pronta
    // agora carregue ou libere os pedidos de anúncio
  }
});

AdSense and Ad Manager

What changes for people who monetize with Google

Since January 16, 2024, Google requires a certified CMP integrated with the TCF to show personalized ads in the EEA and the United Kingdom. Since July 31, 2024, the rule also applies to Switzerland.

Without a certified CMP, traffic from these regions can receive only non-personalized or limited ads. Both pay much less and not all buyers take part. The Privacy & messaging tool in AdSense and Ad Manager itself is one of the certified options.

Ad Manager reads the TCF directly on the page. European TC strings sent inside the GPP are not accepted for visitors in the EEA, United Kingdom and Switzerland. In other words, even if you use GPP for the United States, Europe still needs its own TCF.

If the site also uses Google Analytics or Google Ads, the certified CMP usually sends Consent Mode along with it. These are two different signals: the TCF talks to the ad ecosystem and Consent Mode talks to Google's tags.

Timeline

The dates that changed the TCF and Google's rules

The standard evolves in versions and has gone through important decisions in the European courts.

  1. 2020

    Google integrates the TCF

    Google's ad systems start reading consent sent in the TCF format.

  2. February 2, 2022

    Belgian authority decision

    Belgium's data protection authority fines IAB Europe 250,000 euros over the TCF.

  3. January 16, 2024

    Certified CMP in the EEA and United Kingdom

    For personalized Google ads in these regions, the site must now have a certified CMP integrated with the TCF.

  4. March 7, 2024

    EU Court of Justice rules

    In case C-604/22, the court says the TC string can be personal data and that IAB Europe can be a joint controller.

  5. July 31, 2024

    Switzerland comes under Google's rule

    The certified CMP requirement now applies to visitors from Switzerland.

  6. May 14, 2025

    Belgian court upholds the fine

    Belgium's Market Court upholds the 250,000 euro fine and confirms that the TC string is personal data.

  7. February 28, 2026

    End of the transition to v2.3

    From March 1, 2026, every new TC string must include the disclosed vendors segment.

  8. October 23, 2026

    v2.4 deadline for websites

    Website CMPs start showing the new texts and illustrations from specification 2.4, published on July 23, 2026.

  9. February 23, 2027

    v2.4 deadline for apps and TV

    The same update becomes required for CMPs in apps and connected TV.

Enforcement

Who enforces it and what has already happened

The TCF has two kinds of oversight. The first is IAB Europe's own, which approves CMPs, maintains the vendor list and can suspend anyone who does not follow the rules. The second is that of the data protection authorities, which enforce the GDPR and cookie laws.

The best-known case started in Belgium. In 2022, the local authority fined IAB Europe 250,000 euros. In 2024, the Court of Justice of the European Union ruled that the TC string can be personal data. In 2025, the Belgian court upheld the fine.

For the publisher, the lesson is that using the TCF does not transfer responsibility. If the banner misleads the visitor or if ads load before the choice, the site is still responsible for the mistake.

There is also commercial oversight. Google shows a TCF error report in Ad Manager and AdSense and reduces ads when the signal fails. Often, that is where the problem first shows up, as a drop in revenue.

Common errors

When the TC string is missing or arrives wrong

Ad Manager and AdSense show TCF error codes in their reports. These are the ones that hurt revenue the most.

CMP still loading

The ad is requested before the CMP responds. Without a TC string, Google serves only limited ads, and some requests may go without an ad.

Google without permission

Vendor 755 was not included in the CMP or the visitor did not accept it. The result is also a limited ad.

v2.3 segment missing

The string does not include the list of disclosed vendors, or Google is not in it. In that case, Google cannot process the request.

Uncertified CMP

The CMP follows the TCF but is not on Google's list. Traffic from the EEA, United Kingdom and Switzerland is restricted to non-personalized or limited ads.

European visitor without a signal

The request comes from Europe but with no TCF data at all. Google treats it as outside the rules and serves limited ads.

Corrupted or old string

A malformed code, TCF version 1 or an outdated vendor list. The fix is usually to ask for consent again.

In practice

What is and is not allowed with the TCF

Everyday examples for people with visitors from Europe and from elsewhere.

Allowed

  • Show the TCF message only to visitors in the EEA, United Kingdom and Switzerland
  • Use the AdSense or Ad Manager Privacy & messaging tool, which is already certified
  • Include Google and your other ad partners in the CMP list
  • Wait for the CMP to be ready before requesting ads
  • Leave a permanent link in the footer so visitors can change their choice
  • Make rejecting as easy as accepting

Not allowed

  • Mark every visitor in the world as subject to the GDPR
  • Replace the certified CMP with an ordinary cookie plugin
  • Load the ad code before the CMP responds
  • Use an outdated CMP that does not generate the v2.3 segment
  • List partners in the banner that do not run on the site, or hide the ones that do
  • Hide the reject button on another screen

In ConsentMode

What the audit checks about the TCF

  • Opens the site as a visitor from Europe and from elsewhere and sees where the message appears.
  • Identifies the CMP from the page code and says whether it is on Google's list of certified CMPs.
  • Checks whether the TC string exists before the ad requests and whether it includes the disclosed vendors segment.
  • Checks whether Google appears among the vendors and what changes before and after the click on the banner.
  • Delivers screenshots and the path to fix it in the CMP, in WordPress or in the ad code.
Run an auditSee everything that is checked

Frequently asked questions

Are the TCF and Google Consent Mode the same thing?

No. The TCF is the IAB Europe standard that all ad partners read. Consent Mode is how Google receives the choice in its own tags, such as Analytics and Google Ads. A certified CMP usually takes care of both.

My site is Brazilian. Do I need the TCF?

Only for visitors in the EEA, United Kingdom and Switzerland, if you want personalized Google ads for them. For your audience in Brazil, Google does not require the TCF. Set up the CMP by region.

Can I show the TCF banner to everyone?

You can, but it usually costs you. Visitors from outside Europe see a message they do not need, many reject and revenue drops. Google advises marking as subject to the GDPR only the people who are in the scope of the law.

Do I need to do anything because of v2.4?

If you use a commercial CMP, the technical work is theirs. Confirm with the vendor that the installed version already follows specification 2.4 and keep the plugin or script up to date.

Did visitors' old choices stop being valid with v2.3?

No. TC strings created before March 1, 2026 remain valid and are replaced as visitors renew or change their choice. Only new strings without the segment are invalid.

Where do I see the TCF errors in my account?

In Ad Manager and AdSense there is a TCF error report with the codes and the number of requests affected. Google's Help Center explains each code.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

Find out whether your TC string is arriving correctly

The audit opens the site as a European visitor and shows what to fix, without changing anything.

Start the audit