By 28 February, all publishers, their vendors and consent management platforms (CMPs) need to have moved to IAB TCF version 2.3. If you haven’t already sorted this (and most CMPs have handled it automatically), your consent strings will be treated as invalid from 1 March, and your ad requests will start defaulting to Limited Ads or non-personalised inventory. That means lower CPMs and less programmatic revenue, so it’s not one to sit on.<\/p>\n\n\n\n
The good news is that this isn’t a fundamental rethink of how consent works. It’s a structural tightening of the TC string, specifically around whether vendors were actually disclosed to the user. Compared to the 2.1-to-2.2 transition (which removed Legitimate Interest for marketing purposes entirely), this one is relatively contained.<\/p>\n\n\n\n
The core change is that the Disclosed Vendors<\/em> segment in the TC string has moved from optional to mandatory.<\/p>\n\n\n\n Until now, there’s been a grey area around whether a specific vendor was actually shown to a user in the CMP interface. This mattered most for vendors relying on Legitimate Interest, because there was no reliable way to confirm disclosure had happened. TCF 2.3 closes that gap with a binary signal: a ‘1’ means the vendor was disclosed, a ‘0’ means they weren’t.<\/p>\n\n\n\n For your technical team, the TC string structure now strictly requires three components: the Core segment, the (now mandatory) Disclosed Vendors segment and the Publisher TC segment.<\/p>\n\n\n\n Google, among others, has confirmed that their systems will require TCF 2.3 signals for all new consent strings from 1 March onwards. Any string generated after the deadline without the mandatory Disclosed Vendors segment will be treated as invalid, which typically pushes ad requests down to non-personalised inventory. Because those ads can’t use cookies for frequency capping or basic personalisation, the CPMs tend to be noticeably lower.<\/p>\n\n\n\n Most of this transition happens at the CMP level, and if you’re using a Google-certified CMP, there’s a good chance your provider has already handled it. Still worth confirming directly with them, particularly if you haven’t had a proactive communication about it.<\/p>\n\n\n\n A few things to check:<\/p>\n\n\n\nFeature<\/th> TCF 2.1<\/th> TCF 2.2<\/th> TCF 2.3 (Current Update)<\/th><\/tr><\/thead> Core Objective<\/td> Standardising mobile SDKs and accessibility<\/td> Aligning with regulatory policy changes<\/td> Providing technical proof of disclosure<\/td><\/tr> Legitimate Interest<\/td> Allowed for marketing and personalisation purposes<\/td> Removed for marketing purposes (Purposes 3 to 6)<\/td> Verifiable disclosure required for Special Purposes<\/td><\/tr> Transparency Requirements<\/td> Basic list of vendors and purposes<\/td> Detailed vendor retention and data categories<\/td> Mandatory binary signal for every vendor shown<\/td><\/tr> TC String Structure<\/td> Standard core segment<\/td> Core segment with optional publisher data<\/td> Mandatory Disclosed Vendors<\/em> segment included<\/td><\/tr> User Interface<\/td> Basic consent layers<\/td> Required Reject All<\/em> compliance<\/td> None<\/td><\/tr> Status<\/td> Legacy version<\/td> Currently active until 28 February<\/td> Mandatory for new strings from 1 March<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n PRACTICAL STEPS FOR COMPLIANCE<\/h2>\n\n\n\n