A Major Milestone for Osano...and the Industry
When we founded Osano, our goals were ambitious. We wanted to...Read Now
June 17, 2020
Meeting the transparency and user choice requirements of the General Data Protection Regulation (GDPR) is challenging for most businesses. How do you give users granular control over their data while still publishing content or supplying ads and other services at scale?
In 2018, IAB Europe collaborated with players across the publishing, advertising, and online services industries to create the Transparency and Consent Framework (TCF): a framework for complying with GDPR and providing a way to transmit consent from users to third party vendors. The framework informs users how your vendors/partners use their data and gives them the option to consent or deny sharing their data individually.
TCF was a big step toward transparency, user consent, and GDPR compliance, but it wasn’t perfect. Some publishers argued that the framework was biased toward ad tech vendors. (The bias wasn’t surprising, since IAB Europe’s members are mostly ad sellers.) In response, IAB released TCF 2.0, a new version that caters to publishers a bit more and closes some of TCF 1.0’s loopholes.
TCF 2.0 is an upgrade that’s designed to address some of the challenges of the framework’s first version. The improvements are based on feedback gathered from data protection authorities, such as the UK’s Information Commissioner’s Office (ICO), which published a report (Update Report Into Adtech and Real-Time Bidding) that exposed some flaws in TCF 1.0.
The goal of TCF 2.0 is to increase consumer transparency and choice, and support industry collaboration by standardizing how publishers and ad tech vendors work together on the open exchange. That’s to say, TCF 2.0 helps businesses transfer data at scale, while still complying with GDPR.
User consent is paramount under GDPR. Publishers can’t send a user’s data to a vendor without that user’s consent. TCF makes it easier for publishers to get consent from users and relay their data down the advertising supply chain.
TCF lets users interface with vendors through the publisher’s consent management platform (CMP). Publishers select the vendors they work with and the CMP communicates that list to users, along with the purposes the vendors use their data (e.g., “ad selection” or “content personalization”).
When users arrive on the publisher’s website for the first time, they are asked to select the companies with whom the publisher can share their data. Once the user makes a selection, the CMP shares the user data with only the selected vendors.
Whether you’re a publisher, advertiser, vendor, or user, TCF offers some clear benefits:
TCF 2.0 applies to anyone who passes user data to other parties in the European Union. It’s also applicable to organizations outside of the European Union who prefer to comply with GDPR for the sake of simplicity.
TCF 2.0 is about giving more control to publishers and site owners, adding flexibility for vendors, and creating more transparency for users. After countless consultations with users and stakeholders, IAB came up with these changes:
Technically, no. TCF is a tool to help you comply with GDPR’s requirements. It’s an industry attempt at standardization, but it’s not law. It’s just a set of guidelines, so there’s no enforcement or oversight.
That said, you still have to comply with GDPR’s transparency and consent requirements. Compliance without the framework is complex, time consuming, expensive, and risky. So it’s smart to use TCF 2.0.
Thanks to the upgrade, Google has committed to integrating with TCF 2.0. Their participation has incentivized many other organizations to make the switch. In the past, you had to struggle with using different sets of rules to transmit consent signals - one set of rules for IAB Europe and another for Google. This standardization makes life simpler for vendors and publishers who can use the same framework.
If you’re already using TCF 1.0, work with your consent management platform (CMP) to upgrade. TCF 2.0 is not backwards compatible, so the upgrade process will require your input. If you aren’t using TCF 1.0, you’ll need to open a relationship with a CMP that’s registered with the IAB. You could build and maintain your own CMP, but we don’t expect it to be cheap or easy.
Next, work with your vendors to set up implementation. Be careful with the timeline here. Your vendors have to support TCF 2.0, so choose a time that doesn’t inadvertently cut them off from working with you. (The IAB recommends that ad tech companies support both versions for the time being, but publishers should choose one or the other.)
If you want to implement TCF 2.0 to better serve your users and comply with GDPR - and you should - get started with Osano now.
Matt Davis is a writer at Osano, where he researches and writes about the latest in technology, legislation, and business to spread awareness about the most pressing issues in privacy today. When he’s not writing about data privacy, Matt spends his time exploring Vermont with his dog, Harper; playing piano; and writing short fiction.