When comparing CMPs, it is common to see terms such as “TCF compatible"or"IAB certified CMP”. This can create the impression that this certification is required to properly manage cookie consent.
That is not the case. The Transparency & Consent Framework, or TCF, addresses a much more specific need: standardizing the management and, above all, the transmission of privacy choices between the many participants in the digital advertising ecosystem.
For some publishers funded by programmatic advertising, this is an important requirement. For a brochure website, a WooCommerce store, a public-sector website or a company simply using a few services such as GA4, YouTube or Google Maps, the situation is very different.
What is the IAB TCF?
The TCF is a standard developed by IAB Europe. It defines a common framework through which publishers, CMPs and advertising technology providers can communicate the choices made by visitors.
Within this ecosystem, these providers are generally referred to as “vendors”. They can include advertising platforms, measurement providers, agencies, DSPs, SSPs and other intermediaries involved in delivering or measuring advertising.
The TCF notably organizes purposes, legal bases and a list of vendors. A compatible CMP presents the required information to the visitor and then generates a standardized signal representing the choices that were made.
This signal can then travel through the advertising chain so that its different participants have common information about the visitor’s choices.
Why does such a standard exist?
On a relatively simple website, consent management can remain very direct. The website might use GA4, YouTube and Google Maps. The CMP knows these three services and can make their loading conditional on the visitor’s choice.
Programmatic advertising is much more complex. When an advertising space is sold and an ad is displayed, numerous intermediaries may participate in the technical chain. They need a way to receive the necessary information about the user’s choices.
Making every publisher, CMP and advertising technology communicate through individual integrations would be extremely complicated. The TCF therefore provides a common protocol.
This is the context in which the framework makes sense.
The TCF is not the GDPR
This distinction is essential. The TCF is a standard proposed by a professional organization representing the digital advertising industry. It is neither a law nor a general requirement imposed on every European website.
IAB Europe itself describes the TCF as a voluntary standard. Its purpose is to facilitate compliance with certain requirements arising notably from the GDPR and the ePrivacy Directive in the specific context of the online industry.
A website may therefore need to collect consent for certain services without needing the TCF. Conversely, participating in the TCF obviously does not automatically make a website GDPR compliant.
This is the same distinction I make more generally in my article about the limits of a CMP in website compliance.
A CMP can work without the TCF
The term CMP is sometimes so closely associated with the TCF that the two concepts end up being confused. However, a Consent Management Platform can work perfectly well without participating in this framework.
A CMP can collect the visitor’s choice, prevent third-party services from loading before consent and allow that choice to be changed later without producing a TCF signal.
This is how tarteaucitron works. Its approach is mainly based on controlling the services actually present on the website. If Google Maps needs to be blocked, tarteaucitron blocks Google Maps. If YouTube needs to wait for consent, its iframe can be replaced by a placeholder allowing the visitor to enable it.
This approach is much more direct than an advertising chain potentially involving a large number of intermediaries.
Why tarteaucitron does not participate in the TCF
Not integrating the TCF is a choice I made, not a technical limitation discovered too late in tarteaucitron’s development.
Participating in the framework requires a CMP to register with IAB Europe, comply with its specifications and policies, pass its validation procedures and follow changes to the standard. Participation is also subject to a fee for CMPs.
I understand the value of this approach for companies that want to participate in this advertising ecosystem. It is simply not the direction I want to take tarteaucitron.
I prefer development choices to be driven by user needs, applicable rules, accessibility and contributions from the open-source community rather than by the requirements of a private organization connected to the advertising industry.
Does a website using Google Analytics need the TCF?
Not simply because it uses Google Analytics. Using GA4 may require appropriate consent management, but that does not mean the website needs the entire TCF infrastructure.
It is also important not to confuse the TCF with Google Consent Mode. Consent Mode communicates consent states to Google products. The TCF communicates standardized information across a much broader ecosystem of vendors.
They are two different mechanisms. tarteaucitron, for example, supports Google Consent Mode v2 without participating in the TCF.
What about Google Ads?
Again, using Google Ads does not automatically mean that every website must adopt the TCF. The specific advertising products being used and the way the website is monetized need to be considered.
A company buying a few Google Ads campaigns to sell its own products is not in the same situation as a publisher whose pages display advertising supplied through a network of partners and intermediaries.
It is mainly in the second situation that standards allowing an advertising chain to share visitor choices become important.
When does the TCF become genuinely relevant?
I would seriously consider the TCF when a website depends on programmatic advertising and works with partners using the framework. In that situation, TCF support can become a genuine criterion when choosing a CMP.
It is then not enough for a CMP to display a banner. It needs to be registered to participate in the framework and follow the specifications required to generate and transmit the signals expected by vendors.
For a publisher in this situation, choosing a CMP without TCF support can therefore genuinely be a problem.
It is simply not a rule that can be generalized to every website.
Does a typical brochure or e-commerce website need it?
In many cases, no. If the problem is controlling a reasonable list of third-party services present on the website, having a CMP capable of properly blocking them is generally much more important than its participation in the TCF.
For a website using GA4, YouTube, Google Maps, reCAPTCHA and a few clearly identified marketing tools, I would start by checking whether those services are actually under control.
Are scripts requiring consent blocked before a choice is made? Is refusal respected? Are iframes handled correctly? Can visitors change their decision later?
These are much more practical questions for this type of website. I explain how to verify the result in my article about checking whether trackers are actually blocked.
The number of vendors also needs to be understood
TCF interfaces can sometimes display an impressive number of partners. This does not mean that a website directly uses hundreds of companies in the same way it uses a YouTube video or a Google Maps embed.
It is a consequence of the structure of the advertising ecosystem and the vendors with which the publisher chooses to work within the framework.
IAB Europe itself recommends that publishers consider which vendors are actually necessary and warns that an unjustifiably large number of vendors may make it more difficult for users to make informed choices.
That complexity can be justified by an advertising model that genuinely requires it. I see no reason to reproduce it on a website that uses five clearly identified third-party services.
TCF or no TCF: start with the actual requirement
I would therefore not choose a CMP by treating TCF support as a box that must always be checked. I would start by looking at the website’s business model.
A publisher relying on a TCF-compatible programmatic advertising chain should naturally verify this requirement and choose an appropriate CMP. For that publisher, it is a structural feature.
A brochure website, online store, public-sector organization or company mainly trying to control a few third-party services does not necessarily have that requirement. A simpler CMP can be perfectly appropriate.
The TCF solves a real problem. But that problem is not shared by every website.
