What Is IAB TCF v2.3?
The IAB Transparency and Consent Framework (TCF) is the standardised technical protocol through which publishers collect user consent and communicate it to every vendor in the programmatic advertising supply chain. A publisher's Consent Management Platform (CMP) captures user choices, encodes them into a TC string, and passes that string with every ad request. Demand-side platforms, SSPs, ad servers, and measurement vendors read the string to determine which purposes they are permitted to process and on what legal basis.
TCF v2.3 was released by IAB Europe on June 19, 2025. It is a technically focused update that addresses a specific signalling gap regulators and courts had identified in earlier versions. It does not change the legal bases available to vendors, the purposes defined in the framework, or the user interface requirements from TCF v2.2. The change is confined to the TC string structure: a segment previously optional is now mandatory.
Why TCF v2.3 Was Introduced
The problem TCF v2.3 solves is known as the "ghost vendor" problem or "signalling ambiguity." Under TCF v2.2, a vendor reading a TC string could encounter a 0 bit in the Vendor Legitimate Interest section and be unable to determine whether it meant the user had objected, or the vendor was never disclosed in the CMP interface. This distinction matters specifically for vendors that process personal data under Legitimate Interest for Special Purposes such as fraud prevention and security. Without a reliable way to distinguish these cases, vendors faced a choice between over-processing and under-processing. The Brussels Court of Appeal's May 2025 judgment and the CJEU's earlier ruling both emphasised the need for mathematical proof that vendors receiving consent signals were actually disclosed to users — which TCF v2.3 provides.
Key Changes in TCF v2.3
The Mandatory disclosedVendors Segment
The single structural change in TCF v2.3 is that the disclosedVendors segment is now required in every TC string. Previously it was optional. This segment is a bitfield in which each position corresponds to a vendor ID in the GVL: a 1 indicates the vendor was shown in the CMP interface; a 0 indicates it was not. The TC string structure is now: [Core String].[disclosedVendors].[PublisherTC]. Any TC string generated on or after March 1, 2026 that lacks the disclosedVendors segment is deemed invalid. Strings created before that date remain valid until progressively replaced as users renew their consent.
No Re-Surfacing Requirement
IAB Europe is explicit that CMPs should not re-surface the consent UI purely because of the v2.3 migration. The disclosedVendors segment is a structural addition to the TC string, not a change to consent categories or vendor lists requiring a new user decision. CMPs that kept records of which vendors were disclosed when the original string was created can update existing strings to include the segment. CMPs that did not must wait for natural renewal events to generate compliant v2.3 strings.
Google Enforcement and Error Code 1.4
Google formally mandated TCF v2.3 migration for all publishers and CMPs in November 2025. From March 2026, Google's systems introduced error report code 1.4 for TC strings missing or carrying a non-compliant disclosedVendors segment. Publishers whose CMP is not Google-certified for v2.3 face Limited Ads serving. This is not a minor degradation: Limited Ads disable personalisation, frequency capping, and audience targeting, and Google explicitly warns that revenue impact can exceed 50%. Choosing the right IAB TCF compliance tool with automated validation is the most reliable way to catch error 1.4 triggers before they affect revenue.
TCF v2.3 Migration Checklist
Step 1: Confirm CMP Support for TCF v2.3
Log into your CMP dashboard and confirm the platform has deployed TCF v2.3 string generation — meaning it populates the mandatory disclosedVendors segment in all new TC strings. Most major commercial CMPs deployed this update automatically or provide a configuration toggle. If your CMP is a private or bespoke implementation, update the string generation logic to include the disclosedVendors segment per the IAB Tech Lab specification and the iabtcf-es TypeScript library.
Step 2: Verify Google CMP Certification Status
Publishing with Google Ad Manager, AdSense, or AdMob requires a Google-certified CMP. Confirm your CMP appears on Google's current approved list and that the certification explicitly covers TCF v2.3. A CMP that is IAB-registered but not Google-certified will result in non-personalised ad serving. The distinction between IAB registration and Google certification — and the validation workflows that confirm your implementation meets both requirements — is a common source of confusion worth reviewing before assuming compliance.
Step 3: Synchronise the Global Vendor List
Your CMP downloads the GVL from IAB Europe and uses it to populate the disclosure bitfield. Confirm your CMP is configured to download the current GVL at least weekly — IAB Europe updates the list as vendors join, update their declarations, or are removed. Stale GVL data causes the disclosedVendors bitfield to misrepresent which vendors are currently registered. Set GVL updates to daily or trigger them on CMP script reload.
Step 4: Verify UI-to-String Alignment
The disclosedVendors segment must accurately reflect which vendors are shown in your consent banner. If a vendor is configured in your CMP but hidden from the UI, its bit should be 0. If a vendor appears in the banner, its bit must be 1. Misalignment between UI and string is the most common compliance gap IAB Europe's automated validators identify. Run your live implementation through the IAB Europe CMP validator before assuming migration is complete.
Step 5: Check Downstream Vendor Parser Versions
Vendors receiving your TC string need to support v2.3 string parsing. Any vendor still running a TCF v2.1 or v2.2 decoder will fail on a valid v2.3 string because the additional segment changes the parsed structure. Contact your SSP and DSP partners to confirm their parsers support v2.3.
Step 6: Test the Full Consent Signal Flow
Decode a live TC string from your production site using the IAB's TC string decoder or the IAB Europe CMP validator browser extension. Confirm: the version field reads 2.3, the disclosedVendors segment is present and populated, vendor IDs in the segment match the vendors shown in your banner, and the string propagates correctly through your ad request headers. Check Google Ad Manager's ad request reports for error code 1.4 within 24 hours of deployment. Cookie consent implementation testing methodology — including automated script blocking verification, consent log validation, and cross-browser testing — applies equally to TCF implementations.
CMP Configuration for TCF v2.3
The publisher's role in TCF v2.3 migration is primarily configuration rather than custom development, provided you are using a commercial CMP. The CMP is responsible for: generating TC strings with the mandatory disclosedVendors segment; maintaining a current GVL; rendering the consent interface with vendor count displayed on the first layer; and storing consent records with timestamps.
Publishers operating private CMPs have a more significant development task. The IAB Tech Lab's iabtcf-es TypeScript library provides the reference implementation for v2.3 TC string encoding and decoding. The library encodes the disclosedVendors segment as a BitField or Range encoded vector immediately following the Core String, with a Segment ID of 1. Publishers should also review their publisher restrictions configuration — the migration is a good moment to audit whether current restrictions are intentional and correctly configured.
