Topic starter
11/07/2026 8:36 pm
TL;DR: TCF 2.3 tightens disclosure, surfaced-vendor signalling, and purpose language before 28 February 2026, OneTrust says. Consent records now need to prove what was shown, what was accepted, and what downstream use was authorised.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “IAB TCF 2.3: Preparing for Compliance”.
By the numbers:
- TCF 2.3 was officially announced on June 19th, 2025, and becomes mandatory on February 28th, 2026.
- The Court clarified on March 7th, 2025, that the TC string qualifies as personal data under GDPR when combined with other identifiers.
Key questions
Q: When should organisations prioritise consent governance over banner redesign?
A: They should prioritise governance first whenever consent choices drive legal basis, vendor eligibility, or downstream data use.
Q: What are the signs that consent controls are failing in practice?
A: Consent controls are failing when banners, preference settings, and downstream activation do not match, or when teams cannot reliably test changes before release.
Q: What breaks when TCF 2.3 disclosure state is not tracked correctly?
A: When disclosure state is not tracked correctly, a vendor can inherit a processing signal that does not match what the user actually saw.
Practitioner guidance
- Audit disclosed-vendor handling Verify that your CMP, vendor list, and reporting flows use a consistent disclosed-vendors field and that the TC string reflects the correct binary state for every vendor.
- Rewrite first-layer consent language Replace legal and technical phrasing with plain-language purpose descriptions, concrete examples, and a visible vendor count on the first layer of the CMP.
- Test consent resurfacing end to end Confirm users can reopen the CMP, change choices, and trigger updated consent logs and downstream enforcement without breaking attribution or processing controls.
Bottom line: TCF 2.3 raises consent governance from interface design to evidentiary control across disclosure, logging, and downstream processing.
Glossary terms: Consent Management, Transparency & Consent Framework, TC String, Legitimate Interest
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 8 hours ago by NHI Mgmt Group
11/07/2026 9:06 pm
TCF 2.3 turns consent from a presentation layer into a governed data-control problem. The shift from optional to mandatory disclosure signalling means organisations can no longer treat consent capture as a frontend compliance exercise. Once the TC string and vendor disclosure state become audit-relevant, the control surface spans UI, API, logging, and vendor verification. Practitioners should view this as a governance model for privacy state, not a banner refresh.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should privacy teams handle TC strings as personal data?
A: They should treat TC strings like regulated records whenever they can be linked with other identifiers. That means applying access control, retention rules, and logging discipline, then ensuring vendors and publishers can demonstrate how the string was created, shared, and used. The key is evidencing control, not just storing the token.
👉 Read our full editorial: TCF 2.3 raises the bar for consent governance in EU adtech