Topic starter
11/07/2026 8:36 pm
TL;DR: IAB TCF 2.3 tightens transparency, makes disclosed vendor signalling mandatory in the TC string, and requires publishers and CMPs to support clearer purpose language, resurfacing consent, and stronger vendor disclosure controls before 28 February 2026, according to OneTrust. The practical shift is that consent operations now need auditable data-flow governance, not just updated banners.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “IAB TCF 2.3: Preparing for Compliance”.
By the numbers:
- TCF 2.3 was officially announced on June 19th, 2025, and becomes mandatory on February 28th, 2026.
- The Court clarified on March 7th, 2025, that the TC string qualifies as personal data under GDPR when combined with other identifiers.
Key questions
Q: What breaks when TCF 2.3 disclosure state is not tracked correctly?
A: When disclosure state is not tracked correctly, a vendor can inherit a processing signal that does not match what the user actually saw.
Q: When should organisations prioritise consent governance over banner redesign?
A: They should prioritise governance first whenever consent choices drive legal basis, vendor eligibility, or downstream data use.
Q: What are the signs that consent controls are failing in practice?
A: Consent controls are failing when banners, preference settings, and downstream activation do not match, or when teams cannot reliably test changes before release.
Practitioner guidance
- Audit disclosed-vendor handling Verify that your CMP, vendor list, and reporting flows use a consistent disclosed-vendors field and that the TC string reflects the correct binary state for every vendor.
- Rewrite first-layer consent language Replace legal and technical phrasing with plain-language purpose descriptions, concrete examples, and a visible vendor count on the first layer of the CMP.
- Test consent resurfacing end to end Confirm users can reopen the CMP, change choices, and trigger updated consent logs and downstream enforcement without breaking attribution or processing controls.
Bottom line: TCF 2.3 raises consent governance from interface design to evidentiary control across disclosure, logging, and downstream processing.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:06 pm
TCF 2.3 turns consent from a presentation layer into a governed data-control problem. The shift from optional to mandatory disclosure signalling means organisations can no longer treat consent capture as a frontend compliance exercise. Once the TC string and vendor disclosure state become audit-relevant, the control surface spans UI, API, logging, and vendor verification. Practitioners should view this as a governance model for privacy state, not a banner refresh.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should privacy teams handle TC strings as personal data?
A: They should treat TC strings like regulated records whenever they can be linked with other identifiers. That means applying access control, retention rules, and logging discipline, then ensuring vendors and publishers can demonstrate how the string was created, shared, and used. The key is evidencing control, not just storing the token.
👉 Read our full editorial: TCF 2.3 raises the bar for consent governance in EU adtech