TCF 2.3 raises the bar for consent governance in EU adtech

At a glance

What this is: IAB TCF 2.3 is a consent framework update that strengthens transparency, vendor disclosure, and user choice handling for EU advertising ecosystems.

Why it matters: It matters because privacy and identity teams must now treat consent strings, vendor disclosure, and legal-basis mapping as governed data flows that can affect compliance evidence across consent, IAM, and lifecycle controls.

By the numbers:

• TCF 2.3 becomes mandatory on February 28th, 2026, replacing TCF 2.2.

👉 Read OneTrust's guidance on preparing for IAB TCF 2.3 compliance

Context

IAB TCF 2.3 is a governance update for how consent, vendor disclosure, and purpose signalling are encoded across advertising technology systems. The practical problem is not banner design alone, but whether organisations can prove that user choice, legal basis, and downstream disclosure are consistent across the consent string, CMP, and vendor stack.

For identity and privacy teams, the important issue is that consent data is now part of a broader accountability chain. Where organisations rely on shared vendor ecosystems, they need controls that connect user-facing choice, technical logging, and vendor lifecycle oversight so consent evidence can stand up to regulatory scrutiny.

Key questions

Q: What breaks when consent disclosure is not encoded clearly in the TC string?

A: When disclosure status is unclear, teams can no longer prove whether a vendor was properly shown to the user before processing began. That creates a governance gap between user choice, legal basis, and downstream data use, which can make consent records unreliable as compliance evidence and expose the organisation to regulatory challenge.

Q: Why does TCF 2.3 matter for GDPR accountability teams?

A: TCF 2.3 matters because it turns consent mechanics into evidence-bearing controls. If the TC string can be linked to an individual, then logging, retention, vendor disclosure, and user choice handling all become part of a GDPR accountability story. Teams need to treat the consent stack as regulated data processing.

Q: What do privacy teams get wrong about CMP updates?

A: The common mistake is treating CMP changes as a banner refresh instead of a workflow change. The real work is aligning UI language, vendor disclosure status, consent logging, and legal-basis handling across systems so the organisation can prove what the user saw and what the platform actually did.

Q: Who is accountable when a consent framework update is missed?

A: Accountability usually sits with the organisation operating the CMP, the privacy team governing consent policy, and the business owners relying on the data. Where a standard changes, teams must recheck vendor lists, legal basis logic, and logging before the framework deadline to avoid non-compliant processing.

Technical breakdown

Why the TC string now matters as regulated personal data

The TC string is not just a technical flag. Under the CJEU ruling described in the source, it can become personal data when paired with other identifiers such as an IP address or user ID, which means the string can no longer be treated as a purely internal routing token. That changes the control expectations around access, retention, and auditability. If the consent record can identify a person or be linked back to one, it belongs in the same governance conversation as other regulated identity data. Practical implication: store, transmit, and log TC strings with privacy-aware controls and traceable retention rules.

Practical implication: Treat TC strings as regulated data and align logging, retention, and access controls accordingly.

How disclosed-vendor signalling changes consent orchestration

TCF 2.3 makes the previously optional disclosed-vendor segment mandatory, creating a binary signal for whether a vendor was disclosed to the user. That matters because many consent workflows have relied on ambiguity between user objection, disclosure status, and legal basis. The new field narrows the gap between policy and technical enforcement by making disclosure status machine-readable in the string itself. For organisations running large vendor lists, this is less about UI polish and more about downstream decision integrity. Practical implication: rework CMP logic so vendor disclosure status is generated, stored, and propagated consistently across systems.

Practical implication: Update CMP logic so disclosure status is consistently encoded and propagated across systems.

Why consent UX updates are now an operational control issue

TCF 2.3 requires clearer first-layer messaging, concrete examples, resurfacing consent UI, and plain-language purpose descriptions. These are not cosmetic changes. They are operational controls because they affect whether users can understand the choice, revisit it, and exercise rights without friction. In practice, that means product, legal, privacy, and engineering teams need a shared version of the same consent journey, not separate interpretations of it. If the user cannot reliably reopen or understand the consent experience, the framework fails at the point where governance meets execution. Practical implication: test consent journeys as end-to-end controls, not isolated front-end screens.

Practical implication: Validate consent journeys end to end, including reopening, explanation quality, and audit logging.

Threat narrative

Attacker objective: The objective is to exploit governance ambiguity in consent handling so personal data processing can continue without clear, defensible user disclosure.

1. Entry occurs through ambiguous or incomplete consent disclosure, where users may not clearly know which vendors are covered by a legal basis statement.
2. Escalation follows when downstream systems treat the consent string as sufficient evidence even though disclosure status, objection handling, and processing intent are not aligned.
3. Impact appears as invalid consent processing, compliance exposure, and regulatory challenge when the organisation cannot prove what the user saw or agreed to.

NHI Mgmt Group analysis

Consent strings are becoming governance objects, not implementation details. TCF 2.3 shows that privacy operations fail when the control surface is treated as a banner problem instead of a data governance problem. Once the TC string can be linked to an individual, it sits at the intersection of identity, consent, and audit evidence. Practitioners should govern it as a lifecycle record with clear ownership and traceability.

Disclosure ambiguity is the real failure mode TCF 2.3 tries to remove. The update is aimed at the point where vendors may not know whether they were disclosed to the user, especially when legitimate interest and special purposes interact. That is a control gap, not just a wording gap. The practical lesson for privacy programmes is that ambiguous state transitions create compliance risk even when the UI appears complete.

TCF compliance now depends on system-wide consistency, not CMP configuration alone. The framework ties user-facing choice, technical signalling, and vendor participation into one accountability chain. That means consent governance must extend into vendor inventory management, logging, and downstream policy enforcement. Organisations that stop at template updates will still struggle to prove that processing matched disclosure.

GDPR accountability is moving closer to machine-enforced consent mechanics. The ECJ and Belgian Market Court discussion in the source underscores that technical standards can influence legal exposure when they structure how personal data is processed. That does not make the framework a substitute for GDPR, but it does make consent tooling part of evidence production. Practitioners should treat consent architecture as a regulated control plane, not a UI layer.

Special-purpose processing needs tighter control mapping than general-purpose adtech workflows. The source highlights a narrow edge case where legitimate interest and objection handling do not fully resolve disclosure uncertainty. That edge case matters because edge cases become operational defaults at scale. Teams should map every purpose, vendor, and legal basis combination to explicit control ownership before the deadline.

What this signals

Consent governance is converging with identity governance. Once consent artefacts can be linked back to an individual, privacy programmes inherit the same evidence, retention, and traceability expectations that identity teams already manage for privileged access and lifecycle records. That makes the control question less about banner compliance and more about how reliably a system can prove state transitions across the full data flow.

The practical signal for teams is that consent operations will need to be tested like any other governed control plane. Organisations that still manage consent as a front-end workflow will struggle to reconcile vendor disclosure, user objection, and downstream processing in a way regulators can review quickly.

This also creates a stronger case for explicit accountability mapping across consent tooling, vendor inventory, and audit evidence. The organisations that will cope best are those that can connect user-facing choice to system logs and lifecycle records without manual reconstruction.

For practitioners

• Map disclosure state to every vendor record Ensure each vendor in the CMP has an explicit disclosed or not-disclosed status and that the value is generated consistently in the TC string.
• Revalidate consent journeys end to end Test whether users can reopen the CMP, understand each purpose in plain language, and change choices without breaking logging or downstream policy enforcement.
• Review vendor lifecycle and legal basis mappings Check that all active vendors are listed on the current framework version and that consent, legitimate interest, and special purpose handling are aligned.
• Align consent logs with audit evidence Make sure consent records, processing logs, and vendor disclosure data can be correlated quickly during regulatory review or incident investigation.

Key takeaways

• TCF 2.3 shifts consent from a UI compliance task to a regulated governance control with evidence requirements.
• The most material change is the removal of vendor disclosure ambiguity through machine-readable signalling in the TC string.
• Teams that cannot align CMP logic, vendor inventories, and audit logging before the deadline will carry avoidable GDPR exposure.

Key terms

• Transparency & Consent Framework: A standard that helps organisations exchange consent signals in a consistent format across publishers, vendors, and advertising intermediaries. It does not replace legal responsibility for personal data processing, which still sits with the parties that collect, store, or use the data.
• TC String: A compact encoded record that carries consent and vendor disclosure information in the IAB framework. It matters because it can become regulated personal data when combined with other identifiers, which makes its generation, storage, and sharing part of privacy governance.
• Consent Management: The process of showing a user what an agent is allowed to do, for how long, and against which systems. In MCP environments, consent is not just a legal formality. It is a control that limits delegated access and creates accountability for agent actions.

What's in the full article

OneTrust's full blog covers the operational detail this post intentionally leaves for the source:

• The updated TCF 2.3 UI requirements for publishers, vendors, and CMP operators.
• The disclosure ambiguity scenario involving Legitimate Interest, Special Purposes, and the user’s Right to Object.
• The technical change to the TC string that makes the Disclosed Vendors segment mandatory.
• The step-by-step migration actions for organisations still running TCF 2.2 logic.

👉 The full OneTrust post covers the UI changes, vendor disclosure updates, and migration steps in detail.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, and identity lifecycle controls. It is a practical fit for practitioners who need to connect access, evidence, and accountability across security programmes.