English
Deutsch
PolskiTCF Explained: What It Is, Why It Matters and Which CMPs Are Certified
Contents
Whenever someone visits a website and clicks “Accept All” or “Reject All” on a cookie banner, a massive chain reaction happens behind the scenes. The website now knows the visitor’s choice, but how do the dozens of advertising networks and analytics tools (like Google, Facebook, or external ad servers) know what was decided? The answer is TCF.
What is TCF?
TCF stands for Transparency and Consent Framework. It was created by the digital advertising industry (IAB Europe) to solve a huge communication problem.
To understand TCF without legal jargon, imagine a large restaurant. The waiter (the website’s cookie banner) takes a highly specific order from the guest: “A salad, but no tomatoes and no dressing.” However, there are 50 different chefs in the kitchen (the advertising partners), and they all speak different languages. If the waiter just yells into the kitchen, mistakes will happen.
TCF is like a universal ticketing system. The waiter punches the order into a machine, and it prints out a barcode. Every single chef in the kitchen has a scanner that reads this barcode perfectly. In the digital world, TCF takes the visitor’s choices on the cookie banner and packages them into a single, standardized digital code (called the “TC (Transparency and Consent) String”).
Why is TCF so important?
Without TCF, every advertising platform would have to build a custom connection with every single cookie banner to understand if they are allowed to track a user. This would be technical chaos.
Thanks to TCF:
- Users get clear, standardized information about who wants to process their data and for what exact purposes.
- Advertisers don’t have to guess. They read the TCF signal and instantly know: “I am not allowed to show personalized ads to this user.”
- Websites find it easier to stay legally compliant because participating vendors read the recorded choices from the TCF signal; whether other tags are blocked depends on the site’s own setup.
Which CMPs are TCF Certified?
To generate this universal code, a website must use a Consent Management Platform (CMP)—the software that creates the actual cookie banner. Not every banner can speak the TCF language. To do so, the CMP must pass strict tests and be officially certified by IAB Europe.
Some of the most popular and reliable TCF-certified CMPs include:
- Usercentrics
- Cookiebot
- OneTrust
- Didomi
- InMobi CMP (formerly Quantcast Choice)
Using a certified CMP is meant to ensure that the privacy choices made by the visitor are translated into the TCF standard and made available to the vendors in the framework; whether every tag on the page acts on them still depends on the setup.
Summary: How TCF Helps in Consent Management
In short, TCF acts as the ultimate digital translator. It helps manage consent by standardizing communication. Instead of manually configuring hundreds of marketing tags to behave properly when a user rejects cookies, TCF automates the process. It ensures that the user’s “Yes” or “No” is instantly broadcasted to the entire advertising ecosystem in a language every system understands, ensuring privacy choices are respected across the board.
Questions and answers
Do TCF and Google Consent Mode run side by side, or does one replace the other?
They run side by side, and that is exactly where setups with a certified banner still fail.
Google, as a vendor, takes from the TC String whatever was agreed within the framework. What the Google tags on the page follow in a typical setup, however, is Consent Mode: the command the banner sends to the tags. A certified tool generally handles both, but they are two outputs of the same click, and one does not reliably replace the other.
The failure looks harmless. The TC String is written correctly, while the update command to the tags is missing or arrives too late. Checks that look at the TC String report that everything is in order, while the tags keep operating in the denied state. It shows most clearly in the browser’s Network tab: a request that goes out without identifiers even though consent was given.
Does TCF cover tools outside the IAB vendor list, such as a custom endpoint?
It does not. The TC String speaks about vendors on the Global Vendor List and about purposes defined within TCF; a tool outside that list has no place in it.
As a result, two systems usually run in parallel on the same page: the TC String for the advertising ecosystem and separate signals for everything else, namely the consent categories issued by the CMP. Google is a special case: it is on the Global Vendor List and its tags can read the TC String, but Consent Mode remains a separate mechanism, not part of the TC String. TCF certification concerns the TC String; the other signals have to be connected tag by tag.
The typical misunderstanding starts right here: from the fact that a CMP “supports TCF”, the conclusion is sometimes drawn that every script on the page is covered by it. Covered are the ones that read the TC String. A custom endpoint does not read it and, unless the CMP blocks it separately, runs exactly as its code says, regardless of what the visitor chose in the banner.
Related articles
