TCF v2.2 amendments - September 2024

On March 7, 2024, the Court of Justice of the European Union (CJEU) issued a judgement in a case involving IAB Europe and the Belgian Data Protection Authority (APD). The court clarified that Transparency and Consent (TC) Strings may be considered personal data under certain conditions, particularly if they can be linked with other identifiable data points, thereby enabling the identification of an individual with reasonable effort.

In response to the CJEU's reasoning, the Transparency & Consent Framework (TCF) Steering Group approved a new iteration of the IAB TCF Framework (v2.2), incorporating three new amendments. These changes aim to assist online ecosystem participants in adhering to the ePrivacy Directive and GDPR requirements as expected by regulators.

This updated version is based on measures proposed in the “action plan” submitted to and approved by the Belgian Data Protection Authority (APD). The plan ensures compliance with the finding that TC Strings may qualify as personal data under the GDPR, thus necessitating a legal basis for their processing. In this article, we will cover the following:

• Amendments

• Timeline

• Didomi updates and changes

For more information on the CJEU decision regarding IAB Europe’s Transparency and Consent Framework (TCF), please refer to our dedicated blog article.

---

Amendments

The three new amendments added as part of TCF v2.2 are:

• Inclusion Special Purpose 3

• New second layer UI requirement for CMPs

• Policies versioning

Inclusion of Special Purpose 3

A new special purpose, titled "Save and Communicate Privacy Choices" has been added to the TCF purposes taxonomy as Special Purpose 3, as outlined in IAB policies.

This purpose is specifically designed to address the processing of TC Strings to verify the consent and/or objection status of a vendor and/or purpose, ensuring end-users' privacy choices are respected. Vendors can declare this purpose at the registration level, provided they have conducted and documented a legitimate interest assessment (LIA) that demonstrates the end-users’ interests and fundamental rights do not outweigh the legitimate interests pursued.

Impact on UI notice	Impact on consent	Impact on console
New Special Purpose displayed when at least one IAB vendor included in the notice has declared it.	None	None

New secondary layer UI requirement for CMPs

TCF policies describe in Section D. c. VII: "c. When providing transparency about Purposes, Special Purposes, Features, Special Features and Vendors in connection with a legitimate interest for the same, a single secondary layer must be provided that allows the user to (...) VII. review where applicable the storage and access information relating to the CMP’s recording of Signals, including the maximum device storage duration."

CMPs should, at a minimum, disclose on the secondary layer of their UIs how the TC String is stored and the duration for which it is stored on the end-user's device. According to IAB recommendation, Didomi will address this requirement by including a dedicated section at the bottom of the second layer of the consent notice. The new section called "About the storage of your choices" will list the cookies added by Didomi to collect consent and their maximum duration.

This new section will only be displayed when TCF is enabled.

The names of the cookies will be retrieved dynamically based on the actual configuration (whether default names or custom names).

Impact on UI notice	Impact on consent	Impact on console
New section displayed in layer 2 when TCF is enabled	None	None

Policies versioning

The Policies version has been incremented from 4.0.a to 5.0, and this change must be reflected in the TC Strings.

Starting 4 October 2024, new TC Strings must be created under policies version 5.0. TC Strings created under policies version 4 before this date will remain valid.

Impact on UI notice	Impact on consent	Impact on console
None	Policies version changed from 4.0 to 5.0 in TC string	None

Timeline

The timeline for the migration to TCF v2.2 is as follows:

Date	Milestone
July 3rd, 2024	Deadline for Vendors to update their GVL registration
July 4th, 2024	Availability of Special Purpose 3 in the IAB TCF Global Vendor List (GVL) and corresponding translations as of Thursday July 4, 2024.
Mid July 2024	Didomi delivery to support the new amendments for both Web and Mobile SDKs
October 4th, 2024	Deadline for CMPs to implement the new policies and for publishers to deploy it

Didomi updates and changes

The new Policies do not require CMPs to resurface the Framework UIs. That is, there is no need to re-collect consent or re-publish the notice.

	Amendment	Impact on UI notice	Impact on consent	Impact on console
#1	Inclusion of Special Purpose 3	New Special Purpose displayed when at least one IAB vendor added in the notice vendors declared it	None	None
#2	New secondary layer UI requirement for CMPs	New sentence displayed in layer 2 when TCF is enabled	None	None
#3	Policies versioning	None	Policies version changed from 4.0 to 5.0 in TC string	None

Web SDK

The changes will be reflected automatically in your consent notice and no further action is required by your organization.

Mobile SDKs