TCF v2.2 - Implementation FAQs

Since March 2022, Vendors registering to the TCF are required to provide additional information that is not intended for user disclosures but can be used by Publishers for determining which Vendors they wish to establish transparency and consent for on their digital properties.

The additional information cover the following detail:

• Full legal entity address ;
• Business-to-business contact details ;
• Territorial scope - the EU/EEA/EFTA/UK jurisdictions where the vendor operates in the context of its TCF registration. Note that this is different from the place of establishment ;
• Environment – environment(s) where the vendor operates such as web, mobile apps, CTV apps ;
• Type of service – Vendor’s type of service(s) such as SSP, DSP, DMP ;
• International transfer – indication if the vendor transfers data outside EU/EEA ; when applicable, indication if the data transfers are covered by an EU adequacy decision.

This additional information is available here and can be used by Publishers to, for example, avoid requesting user’s consent for Vendors that operate in technical environments and jurisdictions that are not relevant to their online services, as well as generally better understand each TCF Vendor’s scope of operations and whether it transfers data outside of the EEA.

Publishers can also work with their CMPs and Vendor-partners to better understand which Vendors are active on their digital properties (e.g. contribute to the selling of their ad inventories) to supplement their selection process.

The TCF Policies does not impose a maximum number of Vendors for which a Publisher establishes legal bases, as it depends on the nature of the services and content provided by the Publisher as well as its business model, and no objective criteria have been laid down by Data Protection Authorities in that respect.

Where a Publisher puts in place a “consent or pay” system, i.e. a TCF implementation offering two or more choices to users for access to the Publisher’s content and services (for instance one based on consent to the processing of personal data for certain Purposes and/or Special Features, and another based on an alternative, such as paid access), Appendix B, section C(h) of the TCF Policies accommodates such implementations.

Although the TCF Policies do not require to allow users to make granular and specific consent or opt-in choices for each Purpose and/or Special Feature in such installations, Publishers should consider providing an appropriate level of choice granularity in order for users’ consent to remain specific and fulfil legal requirements under the GDPR. 

For example, where a free version (subject to consent to processing) is made available alongside a paid version, a Publisher might conclude that conditioning access to the free version of their services to users’ consents for a subset of purposes that are necessary for monetisation (e.g. personalised advertising) provides the appropriate degree of granularity if kept separate from consent to purposes that are not a necessary part of the free version (for instance audience measurement or third-party content personalisation).

To help TCF participants in their implementation, the below table provides the best practice recommendations that have been provided so far by certain national regulators (last updated April 2025):