TCF v2.2 is no longer the current version of the IAB Transparency and Consent Framework. If you're setting up consent compliance today, the framework has moved twice since 2.2: TCF v2.3 became mandatory for all new consent strings on February 28, 2026, and TCF v2.4 specifications published on July 23, 2026, with a web implementation deadline of October 23, 2026, just weeks away. This guide covers the v2.2 foundations, since most of that structure still underpins the current framework, walks through what changed in v2.3 and v2.4, and tells you what to actually do before the v2.4 deadline hits.
What is the IAB Transparency and Consent Framework?
The Transparency and Consent Framework (TCF) is a framework built by IAB Europe for the programmatic advertising industry. It gives websites a standardized way to collect and manage user consent for personal data processing, including cookies. Publishers and vendors use it to document consent choices under the GDPR and the ePrivacy Directive, and to pass those choices along the ad-tech chain in a machine-readable format called a TC string.
TCF v2.2 was released in May 2023 as an update to v2.1. It tightened several rules around consent quality and vendor accountability, discussed below. It's a useful starting point for understanding the framework's current shape, but it is not the version publishers need to be compliant with today.
What changed in TCF v2.2
TCF v2.2 introduced four changes that still matter for understanding how the framework works:
- Deprecation of legitimate interest for targeted advertising. Publishers could no longer rely on legitimate interest as a legal basis for using cookies in targeted ads or content personalization. Explicit, opt-in consent became mandatory for those purposes.
- New purpose codes and categories. These gave users more granular control over exactly how their data could be used, rather than one blanket consent choice.
- Clearer rules for obtaining and storing consent. Consent records needed to be collected transparently and stored in a tamper-proof way.
- New requirements for vendors. Vendors had to register and disclose more detail about their own data processing, which also fed into the enhanced consent signals and transparency features publishers had to display.
Publishers and vendors had to implement v2.2 by November 20, 2023. That deadline was originally set for September 30, 2023, and extended once because of the complexity of the changes, a pattern that has repeated with every subsequent TCF version.
What has changed since v2.2
This is the part a "TCF 2.2 guide" published today can't skip. The framework kept moving:
| Version | Status as of October 2026 | Key change |
|---|---|---|
| TCF v2.2 | Superseded | Deprecated legitimate interest for targeted ads; added granular purposes and vendor registration |
| TCF v2.3 | Mandatory since February 28, 2026 | Required for all newly generated TC strings; refines publisher restrictions and vendor disclosures |
| TCF v2.4 | Specs published July 23, 2026 | Adds cross-device consent, new feature disclosures, and a simplified legitimate-interest signal for special purposes; web deadline October 23, 2026, mobile app and CTV deadline February 23, 2027 |
If your consent management platform is still generating v2.2-era strings, you're behind two mandatory upgrades, not one. Read the full TCF 2.3 breakdown for the implementation detail this article doesn't repeat.
The legal backdrop: TCF's compliance status is still being litigated
Separately from the version updates, IAB Europe's legal exposure over the TCF itself is an open, moving story that any publisher relying on the framework should track. The Belgian Data Protection Authority fined IAB Europe €250,000 over GDPR issues tied to the TCF, a fine the Belgian Market Court upheld in May 2025. Then, in January 2026, the same court annulled the regulator's prior validation of IAB Europe's remediation "action plan," sending it back for reassessment with a narrower scope of IAB Europe's joint-controller role. This doesn't mean the TCF is unlawful to use, but it does mean the compliance requirements attached to it could shift again before the action plan is finalized. See what the Belgian Market Court ruling changes for 2026 for the detail.
How TCF affects publishers
TCF changes how publishers handle consent for data collection. Publishers must be specific about what data they collect and why, whether that's personalized ads, analytics, or content recommendations. They're also responsible for the ad-tech vendors they work with: confirming those vendors are TCF-compliant and that they handle user data properly. User rights matter too. Letting users withdraw consent, or access and delete their data, needs to be straightforward. Getting any of this wrong risks fines or losing access to ad services that require TCF compliance.
What role do consent management platforms play?
A consent management platform (CMP) is the software that implements TCF on a publisher's site: the tool behind the consent banner, the preference center, and the TC string itself. For the basics of what a CMP does and why most sites need one, see what a consent management platform is and why you need one.
Inside TCF specifically, a CMP has four jobs:
- Disclosure. Clearly state who is collecting data, what it's used for, and which vendors are involved.
- Granular consent. Let users approve or decline each purpose and vendor separately, not just accept-all or reject-all.
- Record-keeping. Store consent choices in a way that can be produced as evidence of compliance.
- Rights handling. Give users an interface to withdraw consent or request data deletion.
How to achieve TCF compliance
Achieving and maintaining TCF compliance comes down to four ongoing steps, not a one-time project:
- Update your CMP. Confirm it supports the current mandatory version (v2.3 today, with v2.4 disclosures due by October 23, 2026) rather than an older spec.
- Revise consent banners. Make sure banner language and options reflect the transparency and granularity the current version requires.
- Train your team. Everyone handling consent, from engineering to marketing, should understand what the current framework requires and why.
- Monitor and review. TCF versions change roughly once a year. Build a recurring review into your compliance calendar instead of treating this as done after the initial setup.
If you want the product-level walkthrough, including the actual window.__cmp implementation, see how to become TCF-compliant with Secure Privacy.
Benefits of TCF compliance
Staying current with TCF, not just "compliant with some past version of it," has three concrete payoffs:
- Reduced regulatory risk. Data protection authorities are actively enforcing against non-compliant consent practices, and the IAB Europe litigation above shows that enforcement reaches the framework providers too, not just individual publishers.
- Higher user trust. Transparent, specific consent requests signal to users that their choices are respected rather than rubber-stamped.
- Smoother vendor relationships. A current, well-documented CMP setup makes it easier to prove every vendor you work with is handling data the way your consent banner says it will.
How Secure Privacy supports current TCF compliance
Secure Privacy is a Google-certified CMP built to keep pace with TCF's version changes, so publishers aren't stuck manually tracking each new spec. The platform handles vendor list updates, consent-string generation against the currently mandatory TCF version, and consent record storage, and it integrates with Google Consent Mode for sites that also need to manage consent signals outside the IAB ecosystem.
FAQ
Is TCF v2.2 still the current version of the IAB framework?
No. TCF v2.3 has been mandatory for all newly generated consent strings since February 28, 2026, and TCF v2.4 specifications published on July 23, 2026, with a web implementation deadline of October 23, 2026.
What was the deadline for TCF v2.2?
November 20, 2023. The deadline was originally set for September 30, 2023, and extended due to the complexity of the new requirements.
What did TCF v2.2 change?
It deprecated legitimate interest as a legal basis for targeted advertising and content personalization, added new purpose codes for more granular consent, tightened how consent is obtained and stored, and introduced new vendor registration requirements.
Do I need a new CMP to move from v2.2 to the current TCF version?
Not necessarily. Most CMPs, including Secure Privacy, push version updates to existing implementations. Confirm with your CMP provider that it supports the currently mandatory version rather than assuming an older integration still qualifies.
Is the TCF itself legally secure to rely on?
It remains in active use, but IAB Europe's compliance obligations around it are still being litigated in Belgium, most recently with the Market Court annulling the regulator's validation of IAB Europe's remediation plan in January 2026. Publishers should treat this as a developing legal backdrop rather than a settled question.
