What the TCF Is
The Transparency and Consent Framework is IAB Europe's standard for handling consent in digital advertising. Before it existed, each ad vendor asked for consent in its own way, and publishers had no shared method to tell dozens of partners what a user had agreed to. The TCF solved that by defining a common list of purposes, a global list of registered vendors, rules for how consent prompts describe them, and a standard format for passing the user's choices along.
Three groups take part. Publishers, including app developers, show the prompt. Consent management platforms, registered with IAB Europe, build and run the prompt and produce the consent signal. Vendors, such as ad networks, measurement providers and data platforms, register on the Global Vendor List and read the signal to decide what they may do.
This entry explains the framework, not your legal obligations. Using the TCF does not by itself make processing lawful.
Purposes, Vendors and the TC String
The TCF defines standard purposes, such as storing or accessing information on a device, using limited data to select advertising, creating profiles for personalised advertising, measuring advertising performance, and developing and improving services. It also defines special purposes and features, such as security and fraud prevention or matching data from different sources, with their own rules.
When a user makes choices in a TCF prompt, the CMP encodes them into a TC string. The string records which purposes the user consented to, which vendors they allowed, any objections to legitimate interest, and which CMP and policy version produced it. Vendors decode the string and act on it. On the web, the string is available through a JavaScript API. In apps, it is written to local storage.
TCF Versions
The framework has evolved through several versions. TCF v2.0 replaced the original version in 2020. TCF v2.2, launched in 2023, removed legitimate interest as a legal basis for advertising and content personalisation purposes, required CMPs to show the number of vendors, and asked for clearer descriptions of purposes.
TCF v2.3, published in 2025, made the disclosed vendors segment of the TC string mandatory from 28 February 2026. That segment lists the vendors the user was actually shown, so a vendor can tell the difference between "not disclosed" and "disclosed but not consented." CMPs and vendors had to update to the new format by that date.
Google also uses an Additional Consent mode, which lets CMPs pass consent for ad tech providers that are not registered on the IAB Global Vendor List.
TCF in Mobile Apps
In apps, the CMP writes TCF values to NSUserDefaults on iOS and SharedPreferences on Android. The keys are standardised: IABTCF_gdprApplies says whether GDPR applies to the user, IABTCF_TCString holds the full string, and other keys hold decoded purpose and vendor consents for easy reading. Any SDK in the app can read them without a direct integration with the CMP.
Timing matters. SDKs should check the keys after the CMP has finished, and listen for changes when the user updates their choices. Initialising measurement or ad SDKs before the CMP resolves can cause data to be collected or shared without a valid signal.
TCF and Attribution
Measurement providers use TCF signals to decide what to collect and what to forward. A user who declines device storage or ad measurement purposes should not have identifiers shared with ad networks for attribution. Postbacks can carry consent so the network knows how it may use the conversion.
Linkrunner's iOS SDK reads TCF consent set by your CMP, and Linkrunner supports Google consent signals for the Digital Markets Act. See the Trust Center for Linkrunner's privacy and compliance posture.
Common TCF Implementation Problems
Most TCF issues in apps come from timing and storage. SDKs that start before the CMP writes its values see no consent and either collect nothing or, worse, assume defaults. Apps that clear local storage on logout can wipe TCF keys, so the next session behaves as if the user never answered. Multiple CMPs in one app, sometimes added by different teams or SDKs, can overwrite each other's values.
Version drift is another problem. A CMP or vendor SDK that has not been updated for the current TCF policy version may produce or reject strings in ways that reduce ad fill or measurement. Keep CMP and ad SDK versions current, especially around TCF policy deadlines.
Finally, check the Global Vendor List entries for your partners. If a measurement or ad partner is not registered, TCF consent cannot cover it directly, and you may need Google's Additional Consent mode or a separate mechanism. Ask partners how they read and honor TCF signals before you rely on them.