Google and IAB TCF v2.2: CookieYes CMP for Publishers

The digital landscape is constantly evolving, and Google is at the forefront of these changes. As part of its commitment to providing high data privacy standards, Google has introduced new requirements for publishers who use its products like Ad Manager, AdMob, and AdSense in the European Economic Area (EEA) and the United Kingdom (UK). 

Publishers must now use a Google-certified Consent Management Platform (CMP) that has integrated with IAB’s Transparency and Consent Framework (TCF) when serving ads to users in the EEA or the UK.

This article will provide an overview of the IAB TCF, Google’s new requirements, and why you need a Google-certified CMP for your business.

The IAB TCF (Transparency and Consent Framework) is a framework developed by the Interactive Advertising Bureau (IAB) to enable compliance with data privacy regulations such as the General Data Protection Regulation (GDPR). It was first launched in 2018 and is designed to ensure that users have greater control and transparency over how their personal data is collected and used for advertising online. 

Let’s get familiar with who is involved:

• Publisher: a website like yours that displays ads
• CMP: a Consent Management Platform like CookieYes that helps publishers obtain and manage user consent to comply with data privacy laws.
• Vendor: a third-party service the publisher partners with to serve ads. 

Under IAB TCF, publishers are required to provide visitors with a consent banner that clearly outlines the types of personal data collected from them, why it’s processed and the third-party vendors involved. 

If the visitor provides their consent to data processing, the publisher passes the consent signal to the vendors. This signal informs the vendors whether or not they are allowed to process the user’s data for targeted advertising.

In 2020, IAB introduced TCF version 2.0 with updated features and guidelines to meet the evolving needs of the digital advertising ecosystem. TCF 2.0 brought several significant:

• Enhanced transparency: TCF 2.0 provides users with more detailed information about the processing of their personal data, including the purposes and legal bases for data processing.
• Greater user control: Users can now have more control and grant consent for specific purposes and vendors, as well as exercise their right to object to data processing on the basis of legitimate interests.
• Improved vendor management: TCF 2.0 introduces the concept of “stacks,” which allows publishers to group vendors and purposes together, making it easier for users to manage their consent preferences.
• Better integration with Google: Google has fully integrated its ad systems with TCF 2.0, ensuring seamless compliance for publishers using Google advertising products.

On May 16, 2023, IAB launched TCF version 2.2 in response to the Belgian Data Protection Authority’s decision. The key changes include:

• Removal of legitimate interest as a legal basis for advertising and content personalisation.
• User-friendly description regarding purposes and features instead of the existing legal text.
• Additional information on vendors including categories of data collected, retention periods, and whether legitimate interest applies.
• The total number of vendors to be listed on the first layer of the CMP.
• Users should be able to access the CMP UI to withdraw consent easily.

In the wake of the finalised TCF v2.2, Google announced new requirements for CMPs with the aim of promoting a unified and reliable approach for users and publishers.

Google has stated that anyone using its publisher products to serve ads to users in the EEA or the UK, should use Google-certified consent management platforms (CMP) that support the latest version of the IAB TCF framework. These requirements impact the use of Google’s publisher products such as:

• Google AdSense
• Google Ad Manager
• AdMob

For CMPs to be certified, they must integrate with the TCF and support Google’s additional consent specifications when working with publishers.

We are also an existing member of Google’s CMP Partner Program and are a Certified CMP Partner for Google Consent Mode. We support seamless integration with Consent Mode and Google Tag Manager to enable businesses to set them up effortlessly and address any technical challenges.

Why do you need a Google-certified CMP for IAB TCF v2.2?

Let’s get the obvious out of the way, Google is making TCF a mandatory requirement for its ad tech ecosystem. But, it’s important to not just use any CMP that is compliant with TCF but to ensure that it is a Google-certified CMP that is integrated with TCF v2.2.

Here’s why.

To show personalised ads: Any misconfigurations in your CMP that don’t adhere to Google’s requirements will stop you from showing personalized ads. This means, that unless your CMP is certified by Google​​, you will only be able to show non-personalized ads to visitors in Europe and the UK.

Read: Google’s requirements to serve personalised ads

For better ad revenue: As you will not be able to run personalised ads, you may see a big drop in your ad revenue. This is especially true if you are a publisher with considerable traffic from Europe. 

Compliance with regulations: TCF is crucial for publishers who rely on targeted advertising as part of their business model. It provides publishers with a standardized approach to working with third-party vendors and reduces the risk of non-compliance.

The deadline for TCF v2.2 implementation is November 30, 2023. So, ensure that you move to a certified CMP before this date to continue using personal data for targeted advertising.

If you are an existing CookieYes user, you can sit back and let us do the heavy lifting. CookieYes is always working to bring the highest standards of compliance for our users and we are an official Google-certified CMP for TCF v2.2.

The new TCF v2.2 complaint cookie banner from CookieYes CMP.

If you are a website publisher or owner and want to serve personalized ads on your website in the EEA and the UK, you need to ensure that your CMP supports IAB TCF v2.2.

With CookieYes CMP, you can give your users full control over their data privacy while collaborating with advertisers with greater transparency. 

We understand that TCF may sound challenging for website owners and publishers, but CookieYes will take care of the complex bits for you. All you have to do is, sign up and get started for free

What is TCF framework?

The IAB Transparency and Consent Framework (TCF) is a set of industry standards for obtaining and managing user consent for data processing in compliance with the General Data Protection Regulation (GDPR) and ePrivacy Directive. This standard was developed by the Interactive Advertising Bureau (IAB) Europe and provides publishers, advertisers, and technology vendors with a common standard and technical specifications to ensure transparency and user choice regarding data collection and processing. 

What is the purpose of IAB TCF 2.2?

The IAB TCF v2.2 is the new version of IAB Europe’s Transparency and Consent Framework (TCF) that addresses concerns raised by the Belgian Data Protection Authority regarding the previous versions of TCF. The updates in v2.2 include removing legitimate interest as a legal basis, offering user-friendly descriptions, disclosing vendor numbers in the CMP, providing more vendor information, and introducing UI requirements for easier consent withdrawal. Compliance with TCF v2.2 is mandatory for all CMPs and vendors by September 30, 2023.

What is the TCF for publishers?

TCF or Transparency Consent Framework is a standardized approach, developed by IAB Europe, for obtaining user consent for data processing in the digital advertising ecosystem.

It enables publishers, advertisers, and technology vendors to communicate user preferences regarding data collection and processing, thereby enhancing transparency and control for individuals.

What is legitimate interest in TCF v2.2?

Legitimate interest refers to the lawful basis for processing personal data under the General Data Protection Regulation (GDPR). Under legitimate interest, businesses are allowed to process data without explicit consent when there is a legitimate interest in doing so, provided that this interest is not superseded by the rights of the individual.

The Transparency and Consent Framework (TCF) v2.2 removes legitimate interest as a legal basis for advertising and content personalisation. Publishers, advertisers and vendors can only use consent as a legal basis for processing end users’ personal data.