If you received an email from Microsoft, Google, or your CMP in early 2026 warning you about TCF v2.3, you may have felt a familiar wave of compliance anxiety wash over you.
Before that anxiety turns into expensive action, there’s something important to establish, which is that TCF v2.3 does not apply to most websites. If you run a standard business website, a WooCommerce store, or a lead generation site (even one using Google Ads and GA4) there is a strong chance this update has nothing to do with you.
This post explains clearly what TCF v2.3 is, who it actually affects, and what you should do if it does apply to your situation.
The Quick Version
TCF v2.3 is a technical update to the IAB Europe’s Transparency and Consent Framework. It is an industry standard that governs how consent signals are communicated between websites and advertising technology vendors in the programmatic advertising ecosystem.
It became mandatory on 1 March 2026. The requirement applies to publishers monetising traffic from the EEA, UK, and Switzerland. Traffic from the US, Asia, and other regions is not affected.
Websites that need to comply but haven’t will find their ad requests defaulting to Limited Ads, a significantly reduced serving mode that strips out personalisation, remarketing, and frequency capping, with a direct and measurable impact on programmatic revenue.
But here’s the key point: TCF is not a law. It is a technical framework, and it is only relevant if your website operates within the programmatic advertising ecosystem in a specific way.
Does Your Website Actually Need TCF v2.3?
The clearest way to answer this is with a simple checklist.
You almost certainly need TCF v2.3 if your website:
- Displays third-party programmatic ads (Google AdSense, Google Ad Manager, AdMob).
- Sells advertising space directly or via an ad network.
- Operates as a media publisher, content platform, or news site monetising through display advertising.
- Works with ad tech partners who explicitly require IAB TCF compliance.
- Runs real-time bidding (RTB) inventory.
You almost certainly do not need TCF v2.3 if your website:
- Runs Google Ads or Microsoft Ads to drive traffic to your site, but does not display third-party ads on your site.
- Operates as an eCommerce store (including WooCommerce).
- Is a lead generation, services, or informational website.
- Does not monetise traffic through advertising networks.
This is an important distinction that caused significant confusion when Microsoft sent emails to a broad contact list earlier in 2026. Running ads is not the same as showing ads. If you use Google Shopping to drive traffic to your store, that does not mean you need TCF. If you show Google AdSense ads on your website, that is a different scenario.
So, in short, if you advertise your business using Google or Microsoft tools, TCF is not your concern. If you display advertising on your website as a revenue stream, it is.
What Is The TCF And Why Does It Exist?
The Transparency and Consent Framework (TCF) was created by IAB Europe to solve a specific problem in the programmatic advertising supply chain. When a page loads with programmatic ads, dozens, sometimes hundreds, of advertising technology vendors may be involved in serving those ads. Each of those vendors needs to know whether the user has consented to their data being used. Without a standardised way of communicating that consent across the entire supply chain, GDPR compliance at scale would be practically impossible.
The TCF standardises the process of obtaining user consent for the processing of personal data within the digital advertising ecosystem. Publishers and vendors often rely on dozens or even hundreds of partners in programmatic advertising. Without a common protocol, ensuring that each partner receives and respects user consent would be almost impossible.
The framework does this through a TC string, which is a compact, encoded string generated by your CMP that records what the user was shown, what choices they made, and which vendors were disclosed to them. This string is passed along with every ad request, telling each vendor in the chain whether they have permission to process that user’s data.
What Changed In v2.3?
The TCF has evolved through several versions. TCF v2.2 (2023) focused on policy, most notably removing legitimate interest as a legal basis for personalised advertising. TCF v2.3 is a technical update focused on proof and verification.
The core change is making the Disclosed Vendors segment mandatory in every TC string.
Previously, this segment was optional. That created a significant transparency gap. Consent strings could indicate that vendors had consent, without any verifiable record of whether those vendors had actually been shown to the user in the CMP interface. The mandatory Disclosed Vendors segment solves the transparency problem courts identified, providing mathematical proof that vendors receiving consent signals were actually presented to users.
This change was driven directly by legal pressure. TCF v2.3 responds directly to a March 2024 CJEU ruling and a May 2025 Brussels Court of Appeal judgment clarifying IAB Europe’s role as ‘joint controller’ for the TC string. These rulings demanded technical proof that vendors receiving consent signals were actually disclosed to users in CMP interfaces.
In technical terms, the Disclosed Vendors segment is a binary bitfield within the TC string. Each vendor registered in the IAB’s Global Vendor List has a position in the field. A bit value of ‘1’ means the vendor was displayed in the CMP interface; ‘0’ means they were not. Every TC string generated after 1 March 2026 must include this segment, correctly formatted, and must include Google (listed in the Global Vendor List as vendor ID 755).
What Happens If You Need It And Don’t Have It?
Any TC string generated on or after 1 March 2026 that does not conform to the v2.3 specification will trigger either a revenue-affecting fallback or a complete drop of the ad request.
The fallback is Limited Ads, which is a serving mode in which ad personalisation, behavioural targeting, frequency capping, and remarketing are all disabled. Failure to migrate will result in valid consent strings becoming invalid, causing ad requests to default to Limited Ads and potentially slashing programmatic revenue by over 50%. Some demand sources may not bid at all on inventory flagged as unconsented, reducing fill rates further still.
Publishers who rely on programmatic demand typically see CPMs drop sharply when inventory shifts to Limited Ads. The revenue impact is immediate and measurable. A sudden drop in fill rates and eCPMs for EEA traffic since 1 March 2026 is a strong signal that something is wrong with your TC string output.
What Do You Need To Do?
If your website does fall into the category that requires TCF v2.3, the practical steps depend on your CMP.
If you’re using a major commercial CMP (CookieYes, Cookiebot, OneTrust, Usercentrics, Osano, and most others listed in our CMP comparison post), the transition to v2.3 was almost certainly handled automatically before the deadline. IAB Europe notes that CMPs should not be required to re-surface the consent UI for this change, so for publishers using a commercial CMP, there should be no re-surfacing requirement tied to this update. Check with your CMP provider to confirm they are generating v2.3-compliant strings.
If you’re using a self-hosted or custom consent solution, this requires a manual update. Your TC string generation logic needs to include the Disclosed Vendors segment correctly. This is a development task and should be prioritised urgently if not already done.
How To Check Your Current Status
Google’s AdSense Help Centre introduced a new TCF error report code (1.4) specifically to flag strings missing the required Disclosed Vendors segment. This code represents scenarios in which the Disclosed Vendors section required of all TCF v2.3 strings is missing, malformed, or does not include Google. If you’re seeing this error in your reporting, your implementation needs attention.
You can also verify your TC string output using the IAB TCF Consent String Decoder, which will show you whether the Disclosed Vendors segment is present.
What’s The Difference Between TCF v2.3 And Google Consent Mode v2?
Since both involve consent signals and Google, these two frameworks are frequently confused. They are distinct requirements serving different purposes, and whether you need one, the other, or both depends on your setup.
Google Consent Mode v2 is relevant to anyone using Google Ads, GA4, or Google’s advertising tools to market their own business, regardless of whether they display advertising on their site. It governs how Google tags behave when users decline consent, and enables modelled conversion data for non-consented EEA/UK traffic. This applies to the vast majority of business websites. For a full explanation, see our post on Google Consent Mode v2.
TCF v2.3 is relevant only to publishers who display programmatic advertising on their site as a revenue stream, and need to pass consent signals through the ad tech supply chain. It is not required for websites that simply use Google Ads to drive traffic.
The two can overlap, so for example, a media publisher running Google Ad Manager and Google Ads campaigns needs both. A WooCommerce store running Google Ads only needs Consent Mode v2.
A Quick Self-Check
Still unsure whether TCF v2.3 applies to your site? Ask yourself these questions:
Does your website display ads from Google AdSense, Google Ad Manager, or a programmatic ad network?
If yes, TCF v2.3 likely applies to you. Contact your CMP to confirm compliance.
Does your website use Google Ads or Microsoft Ads to drive traffic to your own products or services?
If that’s all you do, TCF v2.3 does not apply. Google Consent Mode v2 is what matters for your setup.
Did you receive an email from Microsoft about TCF v2.3?
Microsoft sent this to a broad contact list in February 2026. Receiving it does not mean you are non-compliant or that TCF applies to your situation. Use the self-check above to assess.
Are you using a commercial CMP already?
If yes, and your CMP is from a major provider, the update was almost certainly applied automatically. Verify with your provider.
TCF v2.3 is a significant and consequential update for the programmatic advertising industry, but for the majority of business websites, it is simply not relevant. The key is knowing clearly which category you fall into, and acting accordingly.
If you’re not sure whether your setup requires TCF compliance, or if you want to review your overall consent management approach, get in touch with the team.
