IAB Europe Transparency and Consent Framework 2.2
Source: iabeurope.eu/tcf-2-2/ (official IAB Europe standards body page) Fetched: Tier 1 (direct fetch, 2026-06-11) Effective date: May 16, 2023; implementation deadline extended to November 20, 2023
What Changed from TCF 2.0
The most consequential architectural change in TCF 2.2:
Legitimate interest removed for advertising purposes 3–6. In TCF 2.0, vendors could claim legitimate interest (LI) as a legal basis for advertising targeting purposes 3 (create personalized ads), 4 (select personalized ads), 5 (measure ad performance), and 6 (apply market research to generate audience insights). TCF 2.2 removes this option at the vendor registration level — consent is now the only permissible legal basis vendors can register for those purposes. This directly affects CDP activation pipelines delivering EU-audience segments to ad platforms: those segments must now be backed by consent signals, not LI assertions.
Global Vendor List v3
GVL updated to version 3 with new mandatory declaration fields:
- Categories of data: Vendors must declare specific categories of data they process per purpose (e.g., IP addresses, browsing history, device identifiers).
- Retention periods: Per-purpose data retention durations must be declared in the GVL.
- Multilingual declarations: GVL v3 supports multilingual vendor and purpose declarations for CMP display.
- eventListeners required: Vendors must migrate from the deprecated
getTCData()API call toaddEventListener()/removeEventListener()pattern.
CMP UI Requirements
- CMPs must display the total number of vendors seeking consent or legitimate interest on the first layer of the consent UI (before any user interaction).
- User-facing purpose descriptions replaced with plain-language text and real-use-case examples (not legal boilerplate).
- Users must be able to resurface the CMP UI at any time and withdraw consent as easily as it was given.
Relationship to KG
- question.org.media-publishing-gdpr-scope: TCF 2.2 is the operative upstream consent enforcement mechanism for EU-audience media publishers. The LI removal for advertising purposes 3-6 means publishers using CDPs for consent-aware ad audience delivery must pass consent (not LI) signals through a TCF 2.2-compliant CMP to downstream ad platforms. This is the architectural differentiator cited in that question's GDPR routing logic.
- concept.consent-management: Updates the consent-signal propagation mechanism for EU contexts. TCF 2.2 supersedes 2.0 as the current operative standard since November 2023.
- modality.paid-media (EU scope): Any CDP-to-DSP/SSP audience activation in EU contexts must be backed by TCF 2.2 consent signals (not LI) for ad purposes 3–6.
- Companion source: source.iabeurope-eu.tcf-2-0-2019 covers the TCF 2.0 architecture; this node covers the 2.2 breaking changes only.