The IAB Europe Transparency and Consent Framework version 2.2 (TCF 2.2) is the operative consent standard for EU programmatic advertising as of April 2023 (GVL v3).
Breaking change from TCF 2.0 / TCF 2.1. TCF 2.2 removes legitimate interest (LI) as a valid legal basis for advertising purposes 3–6 at the CMP registration level:
- Purpose 3: Create a personalised ads profile
- Purpose 4: Select personalised ads
- Purpose 5: Measure ad performance
- Purpose 6: Apply market research to generate audience insights
Under TCF 2.2, consent is the only permissible basis for these purposes at CMP registration level. Organizations that relied on LI for programmatic targeting without obtaining explicit consent must now collect consent for each of these purposes before activating EU audiences in programmatic channels.
GVL v3 requirements. Vendors registered in the Global Vendor List (GVL) must declare per-purpose data retention periods and categories of data collected. CDPs exporting audiences to programmatic destinations must verify that downstream DSPs and DMPs are GVL-registered and that the user's consent signal covers each vendor–purpose pair before segment delivery.
CMP obligations. The CMP first-layer display must show total vendor count. Users must be able to resurface the consent UI and withdraw consent at any time.
Architectural implication for CDP activation pipelines. CDP audience activation pipelines targeting EU programmatic channels must enforce purpose-limitation filtering with TCF vendor-purpose vectors at the audience-export stage — not as a post-export reconciliation step. The consent signal must encode: which purposes are consented, which GVL vendors are consented, and the consent timestamp. This is a stricter SLO requirement than pre-TCF-2.2 approaches that applied LI-grounded consent retroactively or batch-filtered after delivery.
Relation to concept.consent-management. The architectural concept node (concept.consent-management) describes how CDP consent design patterns work; this constraint node records the specific regulatory obligation that makes TCF 2.2 compliance non-negotiable for EU programmatic activation.
Source confidence note: source.iabeurope-eu.tcf-2-2-2023 is the IAB Europe official TCF 2.2 specification page — tier 1 primary source, confidence 0.90. source.gdpr-info-eu.art-7-gdpr-2016 provides the underlying GDPR consent validity conditions on which TCF 2.2 consent-as-sole-basis rests.