By 28 February, all publishers, their vendors and consent management platforms (CMPs) need to have moved to IAB TCF version 2.3. If you haven’t already sorted this (and most CMPs have handled it automatically), your consent strings will be treated as invalid from 1 March, and your ad requests will start defaulting to Limited Ads or non-personalised inventory. That means lower CPMs and less programmatic revenue, so it’s not one to sit on.
The good news is that this isn’t a fundamental rethink of how consent works. It’s a structural tightening of the TC string, specifically around whether vendors were actually disclosed to the user. Compared to the 2.1-to-2.2 transition (which removed Legitimate Interest for marketing purposes entirely), this one is relatively contained.
WHAT IS ACTUALLY CHANGING
The core change is that the Disclosed Vendors segment in the TC string has moved from optional to mandatory.
Until now, there’s been a grey area around whether a specific vendor was actually shown to a user in the CMP interface. This mattered most for vendors relying on Legitimate Interest, because there was no reliable way to confirm disclosure had happened. TCF 2.3 closes that gap with a binary signal: a ‘1’ means the vendor was disclosed, a ‘0’ means they weren’t.
For your technical team, the TC string structure now strictly requires three components: the Core segment, the (now mandatory) Disclosed Vendors segment and the Publisher TC segment.
| Feature | TCF 2.1 | TCF 2.2 | TCF 2.3 (Current Update) |
|---|---|---|---|
| Core Objective | Standardising mobile SDKs and accessibility | Aligning with regulatory policy changes | Providing technical proof of disclosure |
| Legitimate Interest | Allowed for marketing and personalisation purposes | Removed for marketing purposes (Purposes 3 to 6) | Verifiable disclosure required for Special Purposes |
| Transparency Requirements | Basic list of vendors and purposes | Detailed vendor retention and data categories | Mandatory binary signal for every vendor shown |
| TC String Structure | Standard core segment | Core segment with optional publisher data | Mandatory Disclosed Vendors segment included |
| User Interface | Basic consent layers | Required Reject All compliance | None |
| Status | Legacy version | Currently active until 28 February | Mandatory for new strings from 1 March |
Google, among others, has confirmed that their systems will require TCF 2.3 signals for all new consent strings from 1 March onwards. Any string generated after the deadline without the mandatory Disclosed Vendors segment will be treated as invalid, which typically pushes ad requests down to non-personalised inventory. Because those ads can’t use cookies for frequency capping or basic personalisation, the CPMs tend to be noticeably lower.
PRACTICAL STEPS FOR COMPLIANCE
Most of this transition happens at the CMP level, and if you’re using a Google-certified CMP, there’s a good chance your provider has already handled it. Still worth confirming directly with them, particularly if you haven’t had a proactive communication about it.
A few things to check:
- Confirm your CMP provider has enabled TCF 2.3 support and that they’re on Google’s certified list for this version specifically.
- Review the vendors active in your CMP and make sure the list matches your actual ad stack. Vendors you’re no longer working with should be removed, and any new additions need to be present.
- Make sure your site still has a visible way for users to reopen privacy settings (a “Privacy Settings” link in the footer, typically). That’s been a requirement since 2.2, but it’s one that occasionally gets lost in redesigns.
One thing that catches people out: you don’t need to resurface your consent banner to every user on 28 February. Existing TCF 2.2 strings created before the deadline stay valid until the user naturally renews consent or clears their cache. Only new strings generated after the cutoff need to follow the 2.3 format.
IF YOU’RE UNSURE WHERE YOU STAND
If you’re running Tradecore, we’ll flag any consent string issues through the platform and can walk you through what (if anything) needs adjusting on your side. If you’re not a client but have questions about how your ad server or analytics setup interacts with the new requirements, get in touch and we’re happy to take a look.