The digital advertising ecosystem is moving toward its next technical milestone. By 28 February, all publishers, their vendors and and consent management platforms (CMPs) must transition to the IAB Transparency and Consent Framework (TCF) version 2.3.

This is not a total overhaul of how consent is gathered. Instead, it is a technical refinement designed to improve the reliability of the signals sent to your demand partners. For publishers, understanding this update is essential to maintaining stable monetisation and ensuring that ad requests are not downgraded by major partners like Google or The Trade Desk.

What is changing in TCF 2.3?

The primary update in version 2.3 is the transition of the Disclosed Vendors segment from an optional field to a mandatory one within the Transparency and Consent (TC) string.

Historically, there has been an element of ambiguity regarding whether a specific vendor was actually shown to a user in a CMP interface. This was particularly relevant for vendors relying on Legitimate Interest. TCF 2.3 removes this uncertainty by requiring a clear binary signal: a ‘1’ indicates a vendor was disclosed to the user, and a ‘0’ indicates they were not.

For the technical team, this means the TC string structure will now strictly follow a pattern that includes the Core segment, the mandatory Disclosed Vendors segment, and the Publisher TC segment.

For publishers and network owners, the deadline is one that, if missed, is likely to have an impact on yield. So action is required. Industry leaders, including Google, have confirmed that their systems will require TCF 2.3 signals for all new consent strings generated on or after 1 March.

If a consent string is generated after the deadline without the mandatory Disclosed Vendors segment, it will be considered invalid. In many cases, this will cause ad requests to default to Limited Ads or non-personalised ads. Because these ads do not utilise cookies for frequency capping or basic personalisation, they typically command significantly lower CPMs and can lead to a noticeable reduction in programmatic revenue.

Practical steps for ensuring compliance

The transition is intended to be handled primarily at the CMP level. For most publishers, using a Google-certified CMP means this has likely already been handled by your provider. However, it’s worth checking in with them to avoid any last-minute service interruptions.

Contact your CMP provider to confirm they have enabled TCF 2.3 support. Ensure they are on the list of Google-certified platforms for this specific version.

Review the vendors currently active in your CMP. Ensure that the list matches your actual ad stack.

It is important to note that you do not need to resurface your consent banner to every user on 28 February. Existing TCF 2.2 strings created before the deadline remain valid until the user naturally needs to renew their consent or clears their cache. Only new strings generated after the cutoff must follow the 2.3 format.

As was the case before the update, ensure your site provides an easy way for users to reopen the privacy settings, such as a “Privacy Settings” link in the footer. This remains a core requirement for compliance and transparency.

At Trade House Media, we focus on providing the core infrastructure that keeps your operations running smoothly. If you have concerns about how your current ad server or analytics stack will interact with these new requirements, we are available to help you navigate the transition.