{"id":10545,"date":"2026-09-01T07:20:00","date_gmt":"2026-09-01T05:20:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/?p=10545"},"modified":"2026-10-24T05:23:54","modified_gmt":"2026-10-24T03:23:54","slug":"tcf-2-3-disclosed-vendors-segment-what-it-contains-and-how-to-read","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/data-privacy\/tcf-2-3-disclosed-vendors-segment-what-it-contains-and-how-to-read\/","title":{"rendered":"TCF 2.3 Disclosed Vendors Segment: What It Contains and How to Read It From a TC String"},"content":{"rendered":"

The disclosed vendors segment of a TC string reports which vendors the Consent Management Platform (CMP) says were disclosed in its interface. The transition to TCF 2.3 made this previously optional segment mandatory for newly generated strings. Disclosure is neither consent nor independent proof that the banner was displayed correctly.<\/p>\n

The Core always comes first. Segment types identify the remaining parts, so Disclosed Vendors does not have to occupy the second position. An optional PublisherTC segment may appear before or after it. This article covers the structure made mandatory with 2.3; the current specification also contains later changes.<\/p>\n

\"Disclosed
Core comes first; the two additional segment types can occur in either order. The bit count describes encoding, not proof of consent.<\/figcaption><\/figure>\n

The ambiguity addressed by the change<\/h2>\n

The change particularly concerns vendors declaring Special Purposes alongside Purposes based on legitimate interest. Previously, a zero in the vendor legitimate-interest section could mean either missing disclosure or an exercised objection. Separate disclosure information distinguishes those cases. It does not grant blanket permission for every purpose declared by a vendor.<\/p>\n

The segment is the CMP’s statement about disclosure. An incorrect CMP can also set an incorrect value. Verification of the interface, vendor information, stored choices and transmitted signals remains necessary. Making the field mandatory does not automatically prevent false disclosure claims.<\/p>\n

Structure: bit field or range list<\/h2>\n

Additional segments begin with three type bits. Disclosed Vendors has type 1<\/code>, binary 001<\/code>; PublisherTC has type 3<\/code>. The Core does not start with a separate three-bit type field. Its first field is the six-bit encoding version, currently 2<\/code>. That number is not the framework version \u201c2.3\u201d.<\/p>\n

Text<\/span>