GDPR Compliance in the U.S.: What to Know
In 1992, Singapore banned the sale of all chewing gum. But if you...Read Now
The simple, all-in-one data privacy platform
Manage consent for data privacy laws in 50+ countries
Streamline the DSAR workflow
Ensure your customers’ data is in good hands
Gain insights with privacy assessment templates and workflow management
Discover how Osano supports CPRA compliance
Learn about the CCPA and how Osano can help
Achieve compliance with one of the world’s most comprehensive data privacy laws
Don’t let data privacy compliance get in the way of growth
Preserve your competitive edge
Manage data privacy at scale
Expert insights on all things privacy
Subscribe and become a Privacy Insider
Research the most essential privacy topics
We'll scan your website for privacy risk at no cost
The Osano story
Become an Osanian and help us build the future of privacy!
We’re eager to hear from you
No fines, no penalties
Add Osano data privacy ratings and recommendations to your application
Fresh duds for data privacy fans
June 17, 2020
Meeting the transparency and user choice requirements of the General Data Protection Regulation (GDPR) is challenging for most businesses. How do you give users granular control over their data while still publishing content or supplying ads and other services at scale?
In 2018, IAB Europe collaborated with players across the publishing, advertising, and online services industries to create the Transparency and Consent Framework (TCF): a framework for complying with GDPR and providing a way to transmit consent from users to third party vendors. The framework informs users how your vendors/partners use their data and gives them the option to consent or deny sharing their data individually.
TCF was a big step toward transparency, user consent, and GDPR compliance, but it wasn’t perfect. Some publishers argued that the framework was biased toward ad tech vendors. (The bias wasn’t surprising, since IAB Europe’s members are mostly ad sellers.) In response, IAB released TCF 2.0, a new version that caters to publishers a bit more and closes some of TCF 1.0’s loopholes.
TCF 2.0 is an upgrade that’s designed to address some of the challenges of the framework’s first version. The improvements are based on feedback gathered from data protection authorities, such as the UK’s Information Commissioner’s Office (ICO), which published a report (Update Report Into Adtech and Real-Time Bidding) that exposed some flaws in TCF 1.0.
The goal of TCF 2.0 is to increase consumer transparency and choice, and support industry collaboration by standardizing how publishers and ad tech vendors work together on the open exchange. That’s to say, TCF 2.0 helps businesses transfer data at scale, while still complying with GDPR.
User consent is paramount under GDPR. Publishers can’t send a user’s data to a vendor without that user’s consent. TCF makes it easier for publishers to get consent from users and relay their data down the advertising supply chain.
TCF lets users interface with vendors through the publisher’s consent management platform (CMP). Publishers select the vendors they work with and the CMP communicates that list to users, along with the purposes the vendors use their data (e.g., “ad selection” or “content personalization”).
When users arrive on the publisher’s website for the first time, they are asked to select the companies with whom the publisher can share their data. Once the user makes a selection, the CMP shares the user data with only the selected vendors.
Whether you’re a publisher, advertiser, vendor, or user, TCF offers some clear benefits:
TCF 2.0 applies to anyone who passes user data to other parties in the European Union. It’s also applicable to organizations outside of the European Union who prefer to comply with GDPR for the sake of simplicity.
TCF 2.0 is about giving more control to publishers and site owners, adding flexibility for vendors, and creating more transparency for users. After countless consultations with users and stakeholders, IAB came up with these changes:
Technically, no. TCF is a tool to help you comply with GDPR’s requirements. It’s an industry attempt at standardization, but it’s not law. It’s just a set of guidelines, so there’s no enforcement or oversight.
That said, you still have to comply with GDPR’s transparency and consent requirements. Compliance without the framework is complex, time consuming, expensive, and risky. So it’s smart to use TCF 2.0.
Thanks to the upgrade, Google has committed to integrating with TCF 2.0. Their participation has incentivized many other organizations to make the switch. In the past, you had to struggle with using different sets of rules to transmit consent signals - one set of rules for IAB Europe and another for Google. This standardization makes life simpler for vendors and publishers who can use the same framework.
If you’re already using TCF 1.0, work with your consent management platform (CMP) to upgrade. TCF 2.0 is not backwards compatible, so the upgrade process will require your input. If you aren’t using TCF 1.0, you’ll need to open a relationship with a CMP that’s registered with the IAB. You could build and maintain your own CMP, but we don’t expect it to be cheap or easy.
Next, work with your vendors to set up implementation. Be careful with the timeline here. Your vendors have to support TCF 2.0, so choose a time that doesn’t inadvertently cut them off from working with you. (The IAB recommends that ad tech companies support both versions for the time being, but publishers should choose one or the other.)
If you want to implement TCF 2.0 to better serve your users and comply with GDPR - and you should - get started with Osano now.
Writer at Osano
Writer at Osano
Matt Davis is a writer at Osano, where he researches and writes about the latest in technology, legislation, and business to spread awareness about the most pressing issues in privacy today. When he’s not writing about data privacy, Matt spends his time exploring Vermont with his dog, Harper; playing piano; and writing short fiction.
Osano is used by the world's most innovative and forward-thinking companies to easily manage and monitor their privacy compliance.
Osano makes it easy. Ready to get serious about data privacy? Choose your plan and get started. All plans come with a 30-day FREE trial!