IAB TCF 2.2: Why the Industry's Consent Framework Still Fails GDPR

The Framework That Was Meant to Save Behavioural Advertising

When the Note that the APD's February 2022 ruling was partially annulled on appeal by the Belgian Market Court in 2023, complicating the compliance picture. that IAB Europe's Transparency and Consent Framework violated the GDPR in multiple respects, the industry scrambled to release TCF 2.2. The updated specification arrived in May 2023 with tightened language around legitimate interests, the removal of certain processing purposes from that legal basis, and a rebranded "user choice" signal architecture. Yet a granular technical and legal review reveals that TCF 2.2 does not resolve the fundamental contradictions between how the framework operates and what Articles 5, 6, and 7 of the GDPR actually require. For DPOs and compliance officers relying on a certified CMP as a compliance shield, this gap represents direct organisational liability.

The Consent String Is Not Consent

TCF's core mechanism is the euconsent-v2 cookie — a base64-encoded binary string stored under the .consensu.org domain and propagated via the __tcfapi JavaScript API. This string encodes a user's choices across vendors and purposes using bit-field compression. The APD's 2022 ruling identified IAB Europe as a joint controller for this string precisely because the organisation sets the encoding schema and distributes the decoding libraries. Clarify that TCF 2.2 was developed under the APD-imposed action plan, but IAB Europe's joint controller status was later partially overturned on appeal, so the 'revised role' claim has a more complex legal basis., but the consent string architecture remains unchanged.

The deeper problem is epistemic: the string records a signal, not a verified act of consent. Under Article 7 GDPR and the No change needed., the controller must be able to demonstrate that consent was freely given, specific, informed, and unambiguous. A bit flipped to 1 in a TC string satisfies none of these criteria independently. The string does not capture which UI element the user interacted with, whether the consent layer was pre-ticked, how long the banner was displayed before the user engaged, or whether the "accept all" button was disproportionately prominent — all factors relevant to a dark-pattern analysis under Specify that Guidelines 03/2022 target dark patterns on social media platforms; reference also the EDPB's related work and national DPA guidance for broader CMP dark-pattern analysis..

Vendor List Auditing: A Structural Accountability Gap

Replace with 'over 1,000 registered vendors' or cite the current GVL count directly from IAB Europe's published list. Registration requires vendors to self-declare their processing purposes, data retention periods, and legal bases. IAB Europe does not perform independent technical auditing of vendor behaviour against these declarations. This is not a minor procedural gap — it is a structural failure with direct GDPR consequences.

Under Article 5(2) GDPR, the accountability principle requires controllers to be able to demonstrate compliance. A publisher relying on TCF to manage third-party vendor consent is, in effect, a controller for the personal data processing triggered by those vendors on their pages. If a GVL-registered vendor declares it processes data only for "Basic Ads" (Purpose 2) but its JavaScript payload also fingerprints the user agent and sets cross-domain identifiers, the publisher has facilitated unlawful processing — and cannot escape accountability by pointing to the vendor's self-declaration.

Technically, this can be verified. Tools such as browser HAR file analysis, DNS-over-HTTPS query logging, and Content Security Policy (CSP) violation reports can capture outbound requests made by vendor tags. A robust vendor audit workflow should:

• Deploy each GVL vendor's tag in an isolated browser profile with a known TC string granting only specific purposes, then intercept all network requests using a proxy (e.g. mitmproxy) to detect out-of-scope calls.
• Check Set-Cookie response headers and document.cookie writes against the vendor's declared storage disclosures in the GVL.
• Monitor DNS queries for known data broker domains not listed in the vendor's GVL entry using a local DNS resolver with logging.
• Compare the vendor's declared data retention against actual cookie expiry values in the Max-Age or Expires attributes.

This kind of technical due diligence is not optional — it is the minimum required by Article 28 GDPR for processors and by the accountability principle for any controller relying on third-party signals.

Legitimate Interests and the Purpose 2 Problem

TCF 2.2's headline change was restricting the use of legitimate interests (LI) as a legal basis. Specifically, Purposes 3 through 6 (ad personalisation, profile building, content personalisation, and measurement) can no longer rely on LI — only consent. Purpose 2 (Basic Ads) retains LI eligibility, which has made it a magnet for abuse. Publishers and SSPs are incentivised to categorise processing under Purpose 2 to avoid triggering consent requirements, even when the actual processing — particularly real-time bidding data flows — goes well beyond contextual advertising.

From a legal basis perspective under Article 6(1)(f) GDPR, a legitimate interests assessment (LIA) for Purpose 2 must still satisfy the balancing test and account for reasonable data subject expectations. The CJEU's reasoning in C-252/21 (Meta/Bundeskartellamt) reinforced that behavioural profiling cannot be laundered through LI simply by attaching a contextual-sounding label. The TC string provides no mechanism to enforce the quality or validity of a publisher's LIA — it merely records that LI was the declared basis.

Signal Integrity and Downstream Propagation

Even assuming a valid consent signal is captured, the propagation of the TC string through the programmatic supply chain introduces integrity risks. In a typical header bidding setup, the TC string is passed as a URL parameter in OpenRTB bid requests — often as &gdpr;_consent= appended to the auction endpoint. There is no cryptographic signing of the string, no timestamp binding it to a specific page view, and no mechanism preventing a downstream buyer from storing and replaying the string for future processing outside the original consent scope.

The __tcfapi API does expose a listenerId mechanism and the eventStatus field (tcloaded, cmpuishown, useractioncomplete) to allow vendors to distinguish between page-load signals and active user choices. However, compliance with this distinction is voluntary and unaudited. A vendor receiving a TC string in a server-to-server call has no reliable way to determine whether it was generated by a useractioncomplete event or simply cached from a previous session.

Actionable Recommendations for DPOs and Technical Teams

1. Do not treat CMP certification as a compliance certificate. A certified CMP confirms the UI meets IAB's technical specification — it does not certify that your implementation, vendor selection, or LIA documentation meets GDPR requirements.
2. Implement your own vendor technical audits on a quarterly basis using the proxy-based methodology described above. Document findings and vendor responses as part of your Article 5(2) accountability record.
3. Contractually require GVL vendors to provide updated LIAs and DPIAs on request. Standard Article 28 processor agreements are insufficient if the vendor is also a controller — use joint controller agreements under Article 26 where appropriate.
4. Instrument your CMP to log the eventStatus value alongside every TC string stored. This creates an auditable record distinguishing passive loads from genuine user actions.
5. Audit Purpose 2 usage among your active vendors. Any vendor using LI for Purpose 2 while participating in RTB should be required to produce a documented LIA — and that LIA should be reviewed by your legal team, not accepted on faith.
6. Consider server-side consent enforcement rather than relying solely on client-side TC string propagation. A consent enforcement layer in your CDN or tag management server can block vendor tag firing unless a verified, session-bound consent signal exists.

The Compliance Illusion

TCF 2.2 is a sophisticated coordination mechanism for the programmatic advertising industry. It is not, in its current form, a reliable GDPR compliance tool. The gap between a correctly rendered consent banner and demonstrably lawful processing across hundreds of downstream vendors is where regulatory exposure lives. DPOs who treat CMP deployment as the end of the consent compliance workflow — rather than the beginning of a continuous vendor accountability programme — are accepting liability they may not have quantified.

This article was produced with AI assistance and editorially reviewed. Legal questions should always be discussed with a qualified data protection expert.