The next iteration of the TCF is launched

IAB Europe has today launched the next iteration of its Transparency and Consent Framework (TCF), version 2.2.

By way of a reminder, the TCF is the technical protocol and policy framework through which much of the adtech ecosystem collects and shares users' consent preferences. It enables website publishers to: (i) collect consent in relation to certain specified data processing purposes and vendors; and (ii) share the user consent signals in a standardised way with the third parties who receive personal data from them.

TCF has recently been under intensive scrutiny from EU privacy regulators. This culminated last year in the decision from the Belgian data protection authority (supported by all EU data protection authorities) that the TCF breached the requirements of the GDPR. You can read my summary of that decision here. That decision has since been appealed to the Belgian Market Court, which has in turn referred certain questions to the CJEU. We probably won't have a final decision for a few months yet. 

However, in the meantime IAB Europe has tried to address some of the concerns raised by the regulators. For example, the new version:

1. Removes the legitimate interests legal basis for personalised advertising and content personalisation purposes, meaning vendors will only be able to rely on consent for those purposes.
2. Makes improvements to the information provided to end users, in particular by seeking to make the language less legal and more user friendly.
3. Requires vendors to provide more information about the categories of data they process, their proposed retention periods and the total number of vendors with whom the data is shared. 
4. Sets further technical requirements for publishers to better enable users to withdraw consent as easily as it was given.

All of the above policy changes appear to be a direct response to the Belgian DPA's findings. As such they should give participants in the TCF a level of confidence that reliance on version 2.2 represents a compliant approach to handling user transparency and consent, at least for the time being. 

However, implementation of the new version (which participants must complete by 30 September) is probably not the end of the story. Privacy activists have had adtech, and real-time bidding in particular, in the cross hairs for some time and have had a good deal of success in getting regulators engaged on the issue. Therefore the new version of TCF is likely to be the subject of further scrutiny over the coming months.