What Is the Transparency and Consent Framework (TCF)

If you run ads on a web game or website, a privacy banner sits between you and your European revenue. Most publishers treat it as a legal chore. It is really a piece of ad plumbing.

That plumbing has a name: the Transparency and Consent Framework, or TCF. This guide explains what it is and how it works. It also covers what the latest version, TCF 2.4, changes for web publishers.

What is the Transparency and Consent Framework?

The TCF is an industry standard created by IAB Europe, the trade body for digital advertising in Europe. It helps publishers and ad tech firms meet two EU laws. These are the General Data Protection Regulation (GDPR) and the ePrivacy Directive.

Both laws say the same basic thing. You need a legal basis, often consent, before you store cookies or process personal data for ads. You also have to tell people clearly what will happen to their data.

That sounds simple for one website. It is not simple for an ad auction. A single ad request can touch dozens of companies in under a second. Each one needs to know what the user agreed to.

The TCF solves that coordination problem. It gives everyone a shared vocabulary for data uses. It also gives them one shared format for recording choices. The TCF is voluntary, but in practice most of the European programmatic market runs on it.

The four building blocks of TCF

You only need to understand four parts to understand the whole framework.

1. The consent management platform (CMP)

The CMP is the banner and settings panel users see. It shows who wants to use their data and why. It then records the user’s answers. Only CMPs registered with IAB Europe can produce valid TCF signals.

2. The Global Vendor List (GVL)

The GVL is a public, central list of registered ad tech vendors. Each vendor declares which data uses it needs and on what legal basis. Your CMP pulls this list to build the vendor section of your banner.

3. Purposes and features

The TCF defines standard data uses so everyone means the same thing. There are four kinds:

• Purposes are things a user can say yes or no to, such as showing personalized ads or measuring ad performance.
• Special purposes cover essential uses like security and fraud prevention. Users are told about them but cannot switch them off.
• Features are methods that support purposes, such as linking devices. They are disclosed, not toggled.
• Special features need explicit opt-in, such as using precise location data.

4. The TC string

The TC string is a compact, coded record of the user’s choices. It notes which purposes they allowed and which vendors they approved. It also records which vendors were actually shown to them.

Ad tech reads the string through a standard JavaScript call named __tcfapi. The string is also attached to ad requests so bidders downstream can read it.

The Consent Signal Chain: how TCF works on a page

We call the path from banner to bid the Consent Signal Chain. It has five links. A break at any link has the same effect: the ad request goes out without valid consent.

Diagnose problems in that order. Start at the banner and walk down. Most revenue leaks we see in EEA traffic sit at link 3 or link 4, not at the banner.

Why TCF is a revenue issue, not just a legal one

Many publishers think of consent as risk management. Since 2024, it has also been a gate on demand.

Since January 16, 2024, Google has required publishers using AdSense, Ad Manager or AdMob to use a Google-certified CMP that supports the TCF. This applies when serving personalized ads to users in the EEA and the UK. Switzerland was added on July 31, 2024.

Without a valid signal, Google can fall back to limited ads. Those ads use no personal data, so they draw thinner auctions. Other demand partners behave in a similar way. Some simply skip unconsented requests.

The TCF 2.3 transition showed how sharp this edge is. After February 28, 2026, newly created strings without the required vendor disclosure section counted as invalid. Publishers on lagging CMPs saw EEA inventory treated as unconsented.

For rewarded video on the web, the gap is large. Consented EEA impressions might clear around [AppLixir data: consented EEA rewarded eCPM, directional 2026 estimate $10–15]. Limited-ad impressions might clear around [AppLixir data: limited-ads EEA eCPM]. Replace both with your own reporting before you plan around them.

A short history of TCF versions

The framework has been revised several times. Each version tightened how choices are shown or recorded.

What changes in TCF 2.4

IAB Europe published TCF 2.4 on July 23, 2026. It pairs updated policies with technical specifications 2.4 and an updated vendor list. It is a smaller update than 2.3. Version 2.3 was about which vendors were disclosed. Version 2.4 is about what users actually read in the notice.

Standard explanations for features

Features describe methods that users cannot switch off. Users often confused them with purposes. TCF 2.4 adds a fixed explanation for three features:

• matching and combining offline data sources
• linking multiple devices
• using automatically sent device characteristics for identification

CMPs pull this text from a new standardTexts field in the vendor list. Publishers cannot edit it. Each feature also gets an official illustration.

No fake toggles

Features must not appear next to a control that does nothing. If a user cannot turn something off, the layout cannot suggest they can. Custom banner designs are the most likely place for this to go wrong.

Special Feature 2 gets a clearer name

“Actively scan device characteristics for identification” is now “Identify devices based on information actively requested”. The meaning is unchanged. The new wording is easier to understand.

Cross-device consent disclosure

Some publishers sync a user’s choices across devices, for example after login. Under TCF 2.4, the notice must tell users how far their choice reaches. Publishers also get more flexibility when signals from two devices conflict. If you do not sync choices across devices, nothing changes for you here.

Cleanup for special-purpose-only vendors

Vendors that only declare special purposes no longer need a workaround in the legitimate-interest section of the string. The disclosed-vendors section from 2.3 already covers them. CMPs may adopt this change, but it is optional. Vendors should read the disclosed-vendors section instead of assuming the old bit is set.

Deadlines

• Web (desktop and mobile web): October 23, 2026.
• Native (mobile apps and connected TV): February 23, 2027.

For web publishers, the deadline has passed. If your CMP has not moved to 2.4, ask it why today.

What TCF means for HTML5 game publishers

Web games add a few twists to the Consent Signal Chain that content sites rarely face.

Iframes are the big one. Many games run inside an iframe on a portal or on your own page. Ad code inside the frame must reach the CMP in the parent page. The TCF supports this through a cross-frame messaging pattern, but only if the frame setup allows it. If not, the game asks for consent and gets nothing back.

Portals vs. your own domain. On a third-party portal, the portal’s CMP usually owns consent. On your own site, you own it. Know which case you are in before you troubleshoot.

Rewarded ads still need consent. A player who chooses to watch an ad for a reward has agreed to watch the ad. They have not agreed to tracking. The consent signal still decides whether the ad can be personalized.

Load order matters. Games often start fast and request an ad early. If the banner has not loaded yet, that first request may go out with no string. Gate ad calls until the CMP reports that it is ready.

Rewarded video platforms such as AppLixir read the TCF signal and pass it into the ad request, so a correct CMP setup flows straight through to your rewarded inventory. Your job is to make sure the signal exists and reaches the player.

The TCF Readiness Check

Use these seven checks after any CMP change or TCF update. Each one maps to a link in the Consent Signal Chain.

1. Version: Is your CMP writing TCF 2.4 strings on web? Decode a fresh string to confirm.
2. Certification: Is your CMP on Google’s certified list for the current version?
3. Standard texts: Do the fixed feature explanations and illustrations appear unedited, in every language you serve?
4. Layout: Is there any toggle sitting next to a feature? Remove it.
5. Load order: Do ad calls wait for the CMP to report it is ready?
6. Frames: Can ad code inside your game iframe read the string through __tcfapi?
7. Revenue: Compare EEA eCPM and fill before and after the change. Watch for [AppLixir data: EEA fill-rate baseline]

Frequently asked questions

Is the TCF legally required?

No. The TCF is voluntary. The GDPR and ePrivacy rules are what is required. In practice, Google’s certified-CMP rule makes the TCF the default for publishers who want personalized demand in Europe.

Is TCF the same as Google Consent Mode?

No. Consent Mode tells Google tags how to behave based on consent. The TCF is an industry-wide signal read by many vendors. Ad publishers usually need TCF. Consent Mode works alongside it, mainly for Google analytics and advertiser tags.

Does TCF apply to US traffic?

The TCF is built for Europe. For US state privacy laws, IAB Tech Lab offers the Global Privacy Platform (GPP), a separate standard. Many CMPs handle both and pick the right one by region.

Is the TC string personal data?

It can be. In March 2024, the EU Court of Justice held that a TC string can count as personal data when it can be linked to a user. It also found that IAB Europe could be a joint controller in some situations. Treat TC strings with the same care as other identifiers.

Do I need to re-ask users for consent after TCF 2.4?

Not just because of 2.4, in most cases. Your CMP decides whether a policy change requires asking users again. Check its documentation.

What happens if my CMP falls behind a TCF version?

Newly generated strings may be treated as invalid after the deadline. Your EEA requests then fall back to limited or non-personalized ads, and revenue drops.

Editor note: confirm all dates and eCPM placeholders against current IAB Europe guidance and AppLixir reporting before publishing. This post is general information, not legal advice.