It’s been a year and a half since GDPR went into effect. The IAB Tech Lab’s first attempt at an ad tech industry standard to manage the regulation, the Transparency and Consent Framework, has achieved some adoption but still has notable limitations. Promisingly, the IAB addressed many of these limitations in their proposal for a major overhaul in version 2.0 (TCF 2.0), which should achieve even greater adoption and compliance. We shared our thoughts on the proposal earlier this year, and after incorporating feedback from the public comment period, IAB Europe and the Tech Lab have finalized TCF 2.0.
You may be asking yourself, what changed and what should I do now? We’ll answer both of those pressing questions here.
What changed between the public comment and the final version of TCF 2.0?
The most significant change is that there is now a major implementation deadline. In the announcement of the TCF, the IAB indicated that TCF 1.0 will no longer be supported starting in April 2020.
In line with the deprecation of TCF 1.0, Google committed to joining TCF 2.0 by the end of Q1 2020. This is great news for the industry as Google’s absence has proven to be a major headwind for adoption of TCF 1.0. Like with ads.txt, it took Google’s participation to push toward nearly full adoption.
Next, the final version of TCF 2.0 includes “Vendor Guidance” within each of the ten new purposes. This is very helpful for vendors as they register for the framework and determine how to action on the signals they receive in the consent string. It is also important for publishers to have a deeper understanding of how the data they collect from their end users will be used by vendors in the framework.
What actions should publishers take to prepare for TCF 2.0?
Choose your Consent Management Platform
Whether you have a CMP relationship or not, it is important to begin conversations soon to determine which vendor you will use and what effort it will take to integrate the updated Framework. TCF 2.0 is not backwards compatible with TCF 1.0 and will require your input.
Additionally, TCF 2.0 requires all CMPs to register with the IAB. This means that if you created your own CMP (and didn’t register it) or work with an unregistered CMP, it will no longer be valid in TCF 2.0, even if it technologically supports the new signal.
Work with your vendors to determine your implementation timeline
Determine if and when your vendors will support TCF 2.0. Since TCF 2.0 is not backwards compatible, it is important to coordinate when you plan to switch to TCF 2.0 so that you don’t inadvertently cutoff vendors you wish to work with. The policies from IAB Europe suggest vendors support both TCF 1.0 and TCF 2.0 at the same time, but that publishers will likely choose one or the other. SpotX plans to support TCF 2.0 some time in Q1 and will communicate a more defined timeline as we get closer to that date.
Determine whether you will collect consent for Purpose 1: store and/or access information on a device
Collecting consent for Purpose 1 is optional using jurisdiction-specific settings. This means that publishers based in countries that have not implemented the ePrivacy Directive in as strict a fashion as others, such as Germany, are not bound by the framework to collect consent for cookie setting and are able to utilize Legitimate Interest. However, it is important to assess whether your preferred vendors will still work with you if you do not collect consent for Purpose 1. Given Google’s consent-only strategy with GDPR thus far, we suspect they will require consent for Purpose 1 in all GDPR jurisdictions.
Determine if you will exert any site-specific legal basis overrides
TCF 2.0 gives you the flexibility to only collect certain legal bases for each purpose and vendor. For example, you may determine that you are comfortable allowing vendors to utilize legitimate interest for Purpose 2 (select basic ads) but that you will only collect consent for Purposes 3 and 4 (create a personalised ads profile and select personalised ads). Vendors have the opportunity to register their default legal basis for each purpose, but can be flexible based on publisher preference. You’ll need to determine whether you will assert these preferences or allow vendors to use their defaults within your CMP.
Determine if you will support any out-of-band (OOB) vendors or purposes
TCF 2.0 also has flexibility to allow you to customize and support vendors and purpose declarations outside of those defined in the spec. You may have vendors who will wish for you to do this on their behalf. You must decide whether these additional vendors are worth the additional exposure you will face by working outside an industry-accepted spec. We are not aware of any OOB vendors or purposes pushing for inclusion today, but it is important to weigh your options if these arise.
Attend or watch a recording of an IAB webinar
The IAB is hosting webinars for vendors, CMPs, and publishers over the next few weeks where they will go into detail on the new framework and create a forum for questions. SpotX will continue to produce educational material on privacy initiatives like TCF 2.0, but we also encourage participation in these webinars in the meantime.
These actions items should set you well on your way toward adopting the new and improved TCF 2.0. We expect this to become industry standard in 2020 and recommend making a plan as soon as possible.
Contact your Account team if you wish to set up time with our Privacy Task Force or email email@example.com.
Check out our first post in this series from May, 2019: Five reasons why publishers should look forward to TCF 2.0
This article was written by Eric Shiffman, senior product marketing manager at SpotX