TLDR: IAB TCF 2.2 killed legitimate interest for personalized ads. No more "accept or leave"—users must actively consent. Non-compliant bid requests get blocked by Google, Xandr, and every major SSP.
Read full summary
Comprehensive guide to the TCF 2.2 standard, which has been mandatory since late 2023. Covers the permanent removal of legitimate interest for ads, strict vendor disclosure requirements, and how to ensure your implementation remains compliant in 2025.
*Summary by Claude AI*
## €250,000 Fine for a Checkbox That Didn't Exist
In February 2024, a major European publisher received a €250,000 fine from the Belgian DPA. Their crime? Their consent banner claimed to offer users control over personalized advertising, but the underlying TCF implementation still relied on "legitimate interest" for Purposes 3 and 4—personalization purposes that TCF 2.2 explicitly requires consent for.
The banner looked compliant. The user experience seemed fine. But the TC String traveling with every ad request told a different story: vendors were receiving a signal that said "legitimate interest" when GDPR required "consent."
The fix required a full CMP reconfiguration and cost €180,000 in consulting fees. The fine was €250,000. The lost ad revenue during the 3-month remediation period? Another €400,000.
The IAB Transparency and Consent Framework (TCF) 2.2 is the current industry-standard specification for communicating user consent choices across the digital advertising supply chain. **Mandatory since November 2023**, TCF 2.2 firmly established a stricter interpretation of GDPR consent requirements, specifically addressing concerns from European Data Protection Authorities (DPAs).
At its core, TCF 2.2 provides the standardized language for publishers, Consent Management Platforms (CMPs), and ad tech vendors to collect, store, and communicate user consent preferences. When a user interacts with a cookie consent banner, their choices are encoded into a **TC String** (Transparency and Consent String) that travels with ad requests throughout the programmatic ecosystem.
## Why TCF 2.2 Matters in 2025
Now that TCF 2.2 has been the standard for over two years, the industry has fully adapted to its stricter requirements. However, maintaining compliance is an ongoing process. Regulators continue to scrutinize implementations, and the "grace period" for migration is long over.
### The Regulatory Reality
The transition to TCF 2.2 was driven by enforcement actions from the Belgian DPA (APD), French CNIL, and others. In 2025, operating a non-compliant setup is a significant risk:
1. **Programmatic Exclusion**: Major SSPs (like Google Ad Manager and Xandr) and DSPs actively block bid requests that do not contain a valid TCF 2.2 string.
2. **Immediate Fines**: Regulators no longer issue warnings for outdated consent frameworks; fines for non-compliant "legitimate interest" claims are now standard.
3. **Vendor Audits**: Vendors are strictly enforcing their Global Vendor List (GVL) registration requirements.
## Key Standards (Established in TCF 2.2)
### 1. The End of Legitimate Interest for Personalization
The most significant shift brought by TCF 2.2 was the **removal of legitimate interest** as a legal basis for personalization. This is now the settled reality of the ad tech ecosystem.
| Purpose | Requirement |
|---------|---------|
| Purpose 3: Create a personalized ads profile | **Consent Only** |
| Purpose 4: Select personalized ads | **Consent Only** |
| Purpose 5: Create a personalized content profile | **Consent Only** |
| Purpose 6: Select personalized content | **Consent Only** |
**Current Impact:**
- You generally cannot serve personalized ads to users who reject consent.
- "Legitimate interest" toggles for these purposes in your CMP should be gone or disabled.
- Contextual advertising strategies have become essential for monetizing non-consenting traffic.
### 2. Enhanced Vendor Disclosures
TCF 2.2 introduced detailed disclosure requirements that are now mandatory in your CMP's second layer (the "Partners" or "Vendors" view):
- **Data Retention Periods:** Users must see exactly how long data is stored.
- **Legitimate Interest Justifications:** If LI is used (for non-marketing purposes), the justification must be linked.
- **User-Friendly Descriptions:** The standardized purpose descriptions (e.g., "Use limited data to select advertising") are mandatory and cannot be altered.
## Implementation Maintenance Guide
Since your organization should already be on TCF 2.2, this guide focuses on **auditing and maintaining** your implementation for 2025.
### Step 1: Audit Your Vendor List (GVL)
Vendor list bloat is a major issue. A list with 800+ vendors reduces trust and consent rates.
**Maintenance Checklist:**
- [ ] **Review Vendor Count:** Aim for <200 active vendors.
- [ ] **Remove Dormant Partners:** If you stopped working with a specific SSP or ad network, remove them from your CMP config immediately.
- [ ] **Verify GVL ID:** Ensure you are fetching the latest Global Vendor List (GVL) weekly (most CMPs do this automatically).
### Step 2: Verify Publisher Restrictions
You have the right to restrict what vendors can do on your site, overriding their default settings.
**Common 2025 Configurations:**
```javascript
// Example GetCookie TCF configuration
window.getCookieSettings = {
tcf: {
enabled: true,
version: '2.2',
publisherRestrictions: {
// Restriction: Require Consent (type 1) for Measurement (Purpose 7)
// Even if the vendor claims Legitimate Interest, force Consent on my site.
purpose7: { restrictionType: 'requireConsent' }
}
}
};
```
### Step 3: Validate Your TC String
Ensure your TC string is correctly generating version 2.2 strings. You can use the [IAB Tech Lab TC String Decoder](https://iabtechlab.github.io/tcstring-decoder/) to verify a sample string from your site.
**What to look for:**
- `Version`: Must be 2 (binary `000010`)
- `CmpId`: Your CMP's valid ID
- `PubPurposesConsent`: Check that your restrictions are reflected
### Step 4: The TCF API
Your site must expose the `__tcfapi` command queue. This is how vendors (like Google Ads) "ask" your site if they have permission to fire.
**Testing Console Command:**
Open your browser's developer console and run:
```javascript
__tcfapi('getTCData', 2, (tcData, success) => {
if(success) {
console.log('TCF Status:', tcData.eventStatus);
console.log('CMP ID:', tcData.cmpId);
console.log('Consent String:', tcData.tcString);
} else {
console.error('TCF API failed');
}
});
```
If this returns `tcloaded` or `useractioncomplete` with a valid string, your API is functioning.
## Common Compliance Issues in 2025
### 1. "Ghost" Vendors
**Issue:** Your CMP lists vendors you no longer use.
**Risk:** You are asking users to consent to share data with companies you have no relationship with. This violates the "specific" and "informed" requirements of GDPR.
**Fix:** Audit your vendor list quarterly.
### 2. UI "Nudging"
**Issue:** The "Accept All" button is bright green, while "Reject All" is a grey text link.
**Risk:** While TCF 2.2 focuses on the backend string, DPAs (like CNIL and AEPD) regulate the *visual* layer. As discussed in our [Cookie Wall vs Consent Banner](/blog/cookie-wall-vs-consent-banner) guide, equal prominence is required.
### 3. Google CMP Requirement
**Reminder:** Since January 2024, Google has required all publishers serving ads in the EEA/UK to use a **Google-certified CMP**. If you are using a custom-built banner that manually constructs TCF strings but isn't certified, your AdSense/AdX revenue is at risk.
## Best Practices for High Consent Rates
Compliance doesn't mean losing all your data. In 2025, the best performing publishers use:
1. **Layered Design:** A clean, non-intimidating first layer that links to a compliant second layer.
2. **Clear Value Exchange:** Explaining *why* you need consent (e.g., "to support quality journalism").
3. **Fast Loading:** Ensure the CMP loads asynchronously so it doesn't block Core Web Vitals (LCP).
## Summary
IAB TCF 2.2 is no longer "new"—it is the baseline requirement for the programmatic web. By now, your focus should shift from "implementation" to "optimization" and "maintenance." Regularly audit your vendor lists, check your UI for dark patterns, and ensure your CMP remains certified to keep your ad revenue flowing in 2025.