TCF 2.3 raises the bar for consent governance in EU adtech

At a glance

What this is: OneTrust’s analysis says TCF 2.3 tightens EU adtech consent governance by making disclosure clearer, requiring more usable consent interfaces, and turning the disclosed-vendors signal into an auditable binary field.

Why it matters: It matters because privacy and identity teams now need evidence that consent state, vendor disclosure, and downstream processing stay aligned across CMPs, logs, and internal systems.

By the numbers:

• TCF 2.3 was officially announced on June 19th, 2025, and becomes mandatory on February 28th, 2026.
• The Court clarified on March 7th, 2025, that the TC string qualifies as personal data under GDPR when combined with other identifiers.

Context

TCF 2.3 is not just a banner-copy update. It is a governance change for how consent, vendor disclosure, and downstream processing are represented across the adtech stack, with the TC string now treated as a control object rather than a simple technical artefact.

For privacy, IAM, and data governance teams, the important question is whether consent state can be trusted end to end. The update matters wherever publishers, CMPs, and vendors rely on the same consent record to justify access to personal data and ad delivery.

Key questions

Q: What breaks when TCF 2.3 disclosure state is not tracked correctly?

A: When disclosure state is not tracked correctly, a vendor can inherit a processing signal that does not match what the user actually saw. That creates audit risk, weakens the legal basis for downstream processing, and makes consent records unreliable across publishers, CMPs, and vendors. Teams need a governed consent state, not an implied one.

Q: When should organisations prioritise consent governance over banner redesign?

A: They should prioritise governance first whenever consent choices drive legal basis, vendor eligibility, or downstream data use. A redesigned banner without auditable logging, vendor verification, and resurfacing logic still leaves the organisation unable to prove what the user accepted or rejected. The control problem is state management, not visual presentation.

Q: What are the signs that consent controls are failing in practice?

A: Consent controls are failing when banners, preference settings, and downstream activation do not match, or when teams cannot reliably test changes before release. Other warning signs include inconsistent enforcement across channels, unclear treatment of third-party cookies, and fragmented records that make it hard to prove compliance. These gaps usually point to weak governance rather than a single technical defect.

Q: How should privacy teams handle TC strings as personal data?

A: They should treat TC strings like regulated records whenever they can be linked with other identifiers. That means applying access control, retention rules, and logging discipline, then ensuring vendors and publishers can demonstrate how the string was created, shared, and used. The key is evidencing control, not just storing the token.

Technical breakdown

Why the disclosed-vendors signal changes consent governance

The disclosed-vendors field is moving from optional metadata to a mandatory binary signal, which means the consent record now has a clearer state model. A value of 1 or 0 creates a more deterministic representation of whether a vendor was surfaced to the user. That matters because the legal basis for some processing, especially around legitimate interest and special purposes, depends on whether disclosure can be evidenced rather than inferred. In practice, this turns disclosure into a control that must survive audit, not a UI detail that can be loosely interpreted.

Practical implication: Treat disclosure state as governed data, with validation in the consent pipeline and logging that proves how each vendor was classified.

How resurfacing consent UIs affects lifecycle control

TCF 2.3 expects users to reopen the CMP interface at any time and revisit consent choices. That introduces a lifecycle requirement, not a one-time collection event. If a CMP can only capture consent but cannot reliably resurface, it creates a governance gap between initial choice and later review or revocation. The practical effect is similar to other identity lifecycle failures: a control exists only at enrollment and then disappears during operation. For practitioners, the issue is less about interface design than about whether the system preserves user agency throughout the consent lifecycle.

Practical implication: Verify that consent state can be reopened, amended, and re-logged without breaking downstream enforcement.

Why the TC string now behaves like regulated data

The European Court of Justice ruling reinforced that the TC string can qualify as personal data when combined with other identifiers, which changes how teams should think about its handling. Once a consent token can be linked back to an individual, it becomes part of the regulated identity and privacy surface, not merely a technical exchange value. That creates expectations around access control, retention, and evidence handling. For teams running large CMP estates, the operational issue is whether consent strings are governed with the same discipline as other personal-data records.

Practical implication: Apply personal-data handling controls to TC string storage, transmission, and logging across publishers, vendors, and CMP integrations.

NHI Mgmt Group analysis

TCF 2.3 turns consent from a presentation layer into a governed data-control problem. The shift from optional to mandatory disclosure signalling means organisations can no longer treat consent capture as a frontend compliance exercise. Once the TC string and vendor disclosure state become audit-relevant, the control surface spans UI, API, logging, and vendor verification. Practitioners should view this as a governance model for privacy state, not a banner refresh.

Consent lifecycle management is the core operational gap this update exposes. Many programmes can collect an initial choice, but far fewer can reliably resurface, revise, and propagate that choice across downstream systems. That gap is especially material where legitimate interest, special purposes, and vendor disclosure interact. The practical conclusion is that consent records need lifecycle integrity, not just point-in-time capture.

TC strings now sit closer to identity and authorisation data than privacy teams often assume. The ECJ view that a TC string can be personal data strengthens the case for treating consent artefacts as governed records with access, retention, and evidentiary controls. That intersects with broader IAM and data governance because the same record may influence who can process what and under which legal basis. Practitioners should align consent records with the same control expectations used for sensitive identity-linked data.

Disclosure ambiguity is the named failure mode TCF 2.3 is trying to remove. If a vendor cannot tell whether it was disclosed to the user, the consent model becomes operationally unreliable even when the UI appears compliant. That ambiguity matters because downstream processing decisions depend on a state that can now be asserted, disproved, or challenged. Teams should treat ambiguous disclosure state as a governance defect, not a cosmetic metadata issue.

Consent governance and vendor governance are converging. Publishers and CMP owners now need evidence that every vendor in the stack is correctly represented, not merely listed. That pushes adtech closer to the same accountability patterns seen in wider third-party risk and identity governance programmes, where records must be both current and provable. The practitioner takeaway is that vendor onboarding and consent enforcement can no longer be managed as separate workflows.

From our research library:

• 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
• Read next: Shadow AI and AI Agent Discovery Guide

What this signals

TCF 2.3 is a governance signal, not a UI tweak. Teams that only update banners will miss the real control change, which is the need to prove vendor disclosure, consent resurface, and downstream logging all stay aligned. That puts consent records closer to regulated identity evidence than to marketing preference data.

Disclosure ambiguity is the specific control gap this update exposes. When a vendor cannot determine whether it was shown to the user, the consent model becomes contestable even if the CMP appears functional. The practical response is to validate state propagation across CMP, vendor list, and internal systems before the 2026 deadline.

For practitioners

• Audit disclosed-vendor handling Verify that your CMP, vendor list, and reporting flows use a consistent disclosed-vendors field and that the TC string reflects the correct binary state for every vendor.
• Rewrite first-layer consent language Replace legal and technical phrasing with plain-language purpose descriptions, concrete examples, and a visible vendor count on the first layer of the CMP.
• Test consent resurfacing end to end Confirm users can reopen the CMP, change choices, and trigger updated consent logs and downstream enforcement without breaking attribution or processing controls.
• Reconcile processing basis with vendor state Check that vendors relying on legitimate interest or special purposes are not treated as approved for processing when the consent record shows no disclosure or a right-to-object outcome.

Key takeaways

• TCF 2.3 raises consent governance from interface design to evidentiary control across disclosure, logging, and downstream processing.
• The update matters because the TC string and vendor disclosure state now need to survive operational use, not just initial capture.
• Teams that cannot resurface, verify, and reconcile consent state will struggle to prove compliance even if their banner text is technically updated.

Key terms

• Consent Management: The process of showing a user what an agent is allowed to do, for how long, and against which systems. In MCP environments, consent is not just a legal formality. It is a control that limits delegated access and creates accountability for agent actions.
• Transparency & Consent Framework: A standard that helps organisations exchange consent signals in a consistent format across publishers, vendors, and advertising intermediaries. It does not replace legal responsibility for personal data processing, which still sits with the parties that collect, store, or use the data.
• TC String: A compact encoded record that carries consent and vendor disclosure information in the IAB framework. It matters because it can become regulated personal data when combined with other identifiers, which makes its generation, storage, and sharing part of privacy governance.
• Legitimate Interest: A legal basis that may allow personal data processing without explicit consent when the controller can justify the need and balance it against the individual’s rights. In consent workflows, it requires clear disclosure, user choice where applicable, and careful governance to avoid overreach.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to broader security and privacy programmes that depend on trustworthy records.