1. Sourcepoint
  2. Releases
  3. Dialogue pre-release notifications

Migration to IAB TCF 2.3

In this article, we will cover the upcoming transition to the Interactive Advertising Bureau Transparency and Consent Framework (IAB TCF 2.3), its impact on Sourcepoint clients, and what your organization needs to do in order to prepare for the migration.

IAB TCF 2.3 overview

The migration to IAB TCF 2.3 addresses a long-standing issue involving vendors that declare only special purposes. Previously, the legitimate interest (LI) purpose bit in the tcString was used to indicate that such a vendor was disclosed to the end-user. However, this approach caused inconsistency and ambiguity.

With IAB TCF 2.3, the inconsistency and ambiguity has been resolved by introducing the Disclosed Vendors section as a mandatory part of the tcString.

  Note: Only IAB vendors exposed to the end-user through the consent message will be relayed in the Disclosed Vendors section of the tcString. Custom and Google ATP vendors will not be relayed in the section.

Review the table below for how the migration to IAB TCF 2.3 impacts different aspects of the digital advertising ecosystem:

Publishers

The publisher's CMP should handle the inclusion of the new Disclosed Vendors section when generating the tcString.

  Note: Like Sourcepoint clients who use Sourcepoint's CMP solution, Sourcepoint clients who operate their own CMP will not need to do anything in order to migrate to IAB TCF 2.3.
CMPs CMPs need to add support to write the new Disclosed Vendors section into the tcString. This section includes a bit for each vendor that the CMP has exposed to the end-user through the consent message.
Vendors

Vendors must be able to recognize and take action based on the mandatory Disclosed Vendors section of the tcString. Vendors should check whether they were exposed or not exposed to the user (bit set to 1 or 0) and act accordingly.

  • If a vendor declares only special purposes and its bit in the Disclosed Vendor section is 0 (not disclosed), the vendor cannot operate under the TCF.
  • If a vendor has received a positive purpose consent or legitimate interest bit but is not marked as disclosed (bit = 0), the tcString is erroneous — since a vendor listed in the vendor array must have been exposed to the end-user.

The core section, publisher restrictions section, and policy version remain unchanged in the migration to IAB TCF 2.3.

IAB TCF 2.3 tcString

As mentioned above, the migration to IAB TCF 2.3 makes the Disclosed Vendors section of the tcString mandatory.  

The tcString decoder does not provide a setting or flag that allows your organization to distinguish between a IAB TCF 2.2 tcString and a IAB TCF 2.3 tcString. However, your organization can distinguish between the different tcString formats by reviewing the sections of the string. An IAB TCF 2.2 tcString will have 2 sections delimited by the "." character while the IAB TCF 2.3 tcString will have 3 sections delimited by the "." character.

//EXAMPLE OF IAB TCF 2.3 tcString

CQesAAAQesAAABwABCENCPFgAP_gAEPgAAyIKoNB5C4USCFAKCJ1YJsgIAQXwQAA4gQABgAAAwAAgBIQAIQEkAECJACIAAACAAIAIAAAIAAAEAAAAEAAIIAFAAAAAEAAIAgAIAAAAAABQAAAAAAIAAAAAAAAAAAAAAAAgAAAABIAAAAAAAAAAAAEACAEAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAABBS-AgAAoAC4AJAAoACcAHcAQgAlIBNADXgHbATEAxYCN4E_QKXgDhICYACwAKgAeABBADIANAAmABVAD8AIQAdwA9gCRAE_AOIAh0BR4C8wG0AN1HQFwAFgAVABBADIANAAmABVADEAH4AaIA7gB7AEWAJEAT8A4gCHQETgJkAUeAvMBtADdQH9koBAACwAmABVADEAcQBDoCjwF5lICIACwAKgAggBkAGgATAAqgBiAD8ANEAiwBIgDiAIdAROAvMBuoD-yoAEABRCASAAsAKoAYgA_ADuAJSAh0BE4D-y0AEAdwAA.IKoNB5C4USCFAKCp1YJsgIAQXwQAA4gQABgAAAwAAgBIQAIQEkAECJECIAAACAAIAIAAAIAAIEAgAAEAAIIAFAAAAAEAAIAgAIAAAAAABQAAAAAAIAAAAAAAAAAAAAAAAgAAAABIAAAAAAAAAAAAEACAEAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAAIAAAABAA.YAAAAAAAAAAA

The IAB has confirmed that they have evaluated the proposal with multiple string sizes and organizations should not be concerned with restrictions or limitations of the number of vendors that can be included in the tcString.

IAB TCF 2.3 migration timeline

IAB TCF 2.3 is already available and the specification, implementation guidelines, iabtcf-es JavaScript library, and TCF validator have all been updated to support the migration.

The industry is currently within the transition period from IAB TCF 2.2 to IAB TCF 2.3 and Sourcepoint has already detected organizations leveraging the tcStrings leveraging the IAB TCF 2.3 specification. 

Transition Period up to February 28, 2026
Enforcement Date March 1, 2026

Any tcString created after March 1, 2026 without the Disclosed Vendors section will be considered invalid.

Any tcString created before March 1, 2026, will remain valid until they are updated or expire.

Migrate to IAB TCF 2.3

For Sourcepoint clients, the IAB TCF 2.3 migration will be handled exclusively server-side and your organization will not have to configure, edit, or make any other changes to migrate to IAB TCF 2.3.

  • No mobile SDK upgrades required
  • No need to save a vendor list
  • No need to relaunch a consent campaign

Once the migration is complete, all GDPR TCF vendor lists currently supporting IAB TCF 2.2 will be automatically updated to support IAB TCF 2.3.

  Note: Any GDPR TCF vendor lists that are still supporting IAB TCF 2.1 will be updated to IAB TCF 2.3 only after completing the migration to IAB TCF 2.2.

Articles in this section

Was this article helpful?
0 out of 0 found this helpful

Comments

0 comments

Article is closed for comments.