The IAB Europe and the IAB Tech Lab on Thursday released a second version of the Transparency and Consent Framework (TCF), which publishers and technology companies use to pass consent data for online advertising while still complying with Europe’s General Data Protection Regulation (GDPR).
The TCF update will be in a public comment period for the next month, and the final version will be ready to implement in June or July, said IAB Europe CEO Townsend Feehan.
The new framework has more granular publisher controls for collecting consent and claiming legitimate interest. Legitimate interest is when publishers can use audience data without explicit consent because it’s necessary to provide their services.
The TCF update is also a precondition for Google to join the IAB-backed program. Publishers and ad tech companies expected Google to integrate with the TCF last summer, but that connection didn’t happen.
“Google is committed to integrating with v2 and will announce timing soon after v2 is finalized,” according to a Google spokesperson.
The TCF updates reflect new guidance from regulators and the first GDPR enforcement cases brought in the second half of 2018, Feehan said.
For instance, the French data protection authority, known as CNIL, recently issued guidance that data collection for some audience profiling is covered by legitimate interest, such as story curation by a news aggregator.
A travel or ecommerce site, however, couldn’t use that data to personalize offers without explicit consent. Such personalization may improve revenue but isn’t necessary for the consumer to use the service.
Types of consent
Consent in the updated TCF has gotten incredibly granular. To pick two examples, the previous iteration provided options to pass consent for purposes like personalization or measurement.
In the new version, those categories have been subdivided.
For instance, the option to collect and designate consent for personalization now allows publishers to collect data either to create ad profiles or create content profiles. These options are designed to help publishers clarify their data processing rights.
And the option to collect and use data for measurement has been split into three elements: to measure ad campaign performance, measure content performance or generate audience insights. Those controls will help publishers delineate between attribution tech to track ad campaigns and vendors, such as Chartbeat, that don’t contribute ad data but measure and track users on a site.
Holiday deadline
The revisions have taken longer than expected, but even regulators have experienced a “voyage of discovery” about how GDPR’s language will be interpreted, Feehan said.
There’s an urgency to implement the TCF v2 before August or September, according to many sources in the IAB Tech Lab and IAB Europe GDPR working groups. They expect, two months from now, that comments will have closed and the final version will be ready.
And that Google will clinch the deal by implementing the TCF.
If the framework is to be significantly adopted this year, publishers must be able to test and implement the tech before the holiday season begins.
“If it drags much later, you get close to Q4, and then most publishers or merchants are just going to put off any new site implementations until the new year,” said one source who requested to speak anonymously due to a nondisclosure agreement.
There should be a strong surge of adoption for the TCF v2 in Germany and Scandinavian countries, where some large publishers haven’t joined the framework because they wanted more specific options for legitimate interest, said Dennis Buchheim, SVP and general manager of the IAB Tech Lab.
And as regulators start to bring more GDPR enforcement cases, other businesses will add compliance.
Will Google buy in?
But the big adoption surge should come with Google.
Google’s Ad Manager is the publisher tech provider for most sites and media companies in Europe, and it serves more ads in the bloc than every other company combined.
Many publishers opted into Google’s separate GDPR compliance program, even if they worked with ad tech vendors in the TCF, because they expected that the two consent frameworks would shortly sync together. There have been quiet signs that the IAB Europe and Google are at long last coming to an agreement.
Google account executives have advised some European publishers to implement a consent management platform (CMP) from the IAB framework, sources told AdExchanger. And last month, the IAB Europe notified CMPs that it had tightened consent requirements, so actions like scrolling a page or navigating elsewhere on the site don’t qualify as consent. This brings the TCF in line with Google’s consent interpretation.
