Google's IAB TCF membership

IAB Europe released the TCFv2 and Google has announced that it will integrate the framework by August 15th 2020.

📕 What is TCF v2, launched by the IAB?

The revised version of the framework focuses on improving the way publishers communicate to users how they use their data, to ensure consent requests are clearer, and users properly informed. It also aims to give publishers more control over how their ad tech vendor partners can use their data. The aim is to give the publishing and advertising industries “a common language with which to communicate consumer consent for the delivery of relevant online advertising and content.” Users can now exercise a right to object if a business uses the legitimate interest (opt-out) basis, just as easily as revoking consent.

The TCFv2 includes 12 purposes, including two special features. The purposes relate to online ad delivery such as profiling, content and ad measurement. The special features are additional controls added for geolocation data and fingerprinting. These features also require an extra level of consent.

Google’s interoperability with TCF v2.0

It revolves around :

• Bidding on bid requests Google receives through Google Bid Manager or Adx.

• Sending bid requests from publishers using Google Ad Manager to third-party bidders.

• Allowing third-party ad tracking and third-party ad serving to occur.

✅ You’ll need a TCF v2-registered CMP to monetize with Google

To integrate with the IAB TCF v2, a publisher must implement a CMP on their site or app. The CMP creates and sends the consent string (TC string), then Google’s ad tags and SDKs consume it and send it to Google ad technology providers. Note that publishers will not be able to choose to use Google outside of TCF, and therefore will not be able to continue to use Didomi’s integration to display non-personalized ads.

✅ TCF strings will automatically be consumed and passed

If you have already implemented an IAB TCF v2-registered CMP on your site or app, Google Ad Manager will automatically begin consuming the TC string from the CMP without any configuration from publishers. Passing TC strings to tags, programmatic and mediation partners will be done automatically.

In the context of passing the string to non-programmatic creatives, you must work with your creative provider to identify whether you need additional configuration to ensure they consume the TC string correctly.

✅ Without consent for “Purpose 1” no advertising will be broadcast by Google

If you do not have consent for “Purpose 1” in the TC string (in which the user allows Google to “store and/or access information on a device”), Google will drop the ad request and no ads will be served by Google, whether they are personalized or non-personalized, nor sent to third-party bidders. This will have an impact not only on your Google inventory, but on any ad on your website managed by Google.

The reason why consent is also required for non-personalized ads is that these ads still use cookies or mobile identifiers (notably to combat fraud and abuse, for frequency capping, and for aggregated ad reporting). Take into account that there will be a revenue impact on websites and apps, but using Prebid/header bidding can help mitigate that impact.

✅ Consent strings must indicate consent (or legitimate interest)

For purposes 1 to 10, and for special purposes and features, the TC string must indicate that consent has been granted by, or legitimate interest has been established with, the user.

✅ Google will serve personalized versus non-personalized ads based on a set of criteria

Google will serve personalized ads when end users grant Google consent to:

1. store and/or access information on a device (Purpose 1);

2. create a personalized ads profile (Purposes 3);

3. select personalized ads (Purposes 4).

Legitimate interest is established for Google to:

1. select basic ads (Purpose 2);

2. measure ad performance (Purpose 7);

3. apply market research to generate audience insights (Purpose 9);

4. develop and improve products (Purpose 10).

If the consent requirements for personalized ads are not met, Google will serve non-personalized ads when the end user grants Google consent to Purpose 1; and legitimate interest is established for Google for Purposes 2, 7, 9 and 10.

✅ Global scope & out-of-band scope are not allowed when using Google for TCF purposes

This means they cannot be used on your websites and apps. In accordance with Google’s EU User Consent Policy, you must clearly identify each party that may collect, receive or use end users’ personal data as a result of your use of a Google product.

✅ TCF v2 and Google policies diverge on the scope of legal basis

The IAB’s TCFv2 provides options for publishers to choose the scope of a legal basis for the processing of personal data. Google policies require that publishers choose either service-specific scope or group-specific scope.

✅ Publishers can customize restrictions

Publishers can customize a variety of restrictions, and indicate their own preferences, which will take precedence over a vendor’s preferences, where applicable. As Google uses legitimate interest for certain purposes and does not mark them as flexible, it implies that a publisher adding a publisher restriction on the basis of legitimate interest for Google will block some purposes for Google. Didomi doesn't recommend to do so.

✅ Publishers should review the registration settings for the vendors they choose to work with

Say a vendor has registered flexibly with “legitimate interest” as the default lawful basis for a purpose where Google requires “consent”. If you want to work with that vendor via Google products, then you should choose consent for that vendor in the publisher restrictions of your CMP. Note that restrictions are only used to change the choices of the vendor. If a vendor has made a choice that the publisher is happy with, the publisher can leave it as it is.

✅ Bear in mind Real-Time Bidding (RTB) & Open Bidding

The IAB TCF v2 logic will apply to bid requests, bid responses and creatives, and cookie-matching requests. Google will allow bid requests to be sent and enable cookie matching when a vendor registers with “Consent” or, in limited cases, “Not used” for Ads Personalization (Purposes 3 and 4 in the TC string). Additionally, the user must have given Google consent for Purposes 1, 3, and 4.

✅ Surface all Ad Tech Partners (ATPs) in your CMP

Ensure that you are surfacing all of your ATPs in your CMP. This will ensure that Google can continue to make call outs to all partners in your waterfall.

✅ Publishers will be able to continue to use vendors that are not on the Global Vendor List (GVL)

Google have pointed out already that they will continue to accept ad tech providers that publishers have selected from existing monitoring tools. On our side, Didomi will integrate the GVL, including all vendors outside the TCF, to pass on the consent.