IAB TCF for publishers: when you need a certified CMP

You need an IAB TCF consent management platform if your site shows programmatic ads that read a TC string, and you need a Google-certified one if you serve Google AdSense, Ad Manager or AdMob ads to visitors in the EEA, the UK or Switzerland. Google has required that since 16 January 2024 for the EEA and the UK and since 31 July 2024 for Switzerland; only traffic from a certified CMP is eligible for personalized ads. If your site only uses Google Analytics, Google Ads conversion tracking, Meta Pixel or similar tags, you do not need the TCF: a consent banner that sends Google Consent Mode signals covers those.

What is the IAB TCF?

The Transparency and Consent Framework is a standard published by IAB Europe. IAB Europe describes it as a voluntary accountability tool, based on standardization, that supports compliance with parts of the ePrivacy Directive and the GDPR. It has three participants:

• Publishers, who run websites and apps;
• Vendors, the ad tech companies listed in IAB Europe's Global Vendor List (GVL), each declaring its purposes and legal bases;
• CMPs, registered consent management platforms that show the banner, collect choices per purpose and per vendor, and encode them in a TC string.

The TC string travels with ad requests, so every vendor in the auction can read what the visitor allowed. Without it, programmatic ad systems in Europe have no machine-readable consent to rely on. The IAB TCF glossary entry has the short version.

Which version is current?

IAB Europe launched TCF v2.3 in April 2025 and gave participants until the end of February 2026 to adopt it. The main change makes the "disclosed vendors" segment mandatory in every TC string, recording which vendors the visitor was actually shown. Google's Ad Manager documentation says that support for new TCF v2.2 strings was dropped at the deadline, and that requests that do not meet the requirement may default to Limited Ads.

What does Google require exactly?

Google's help page on consent management requirements for the EEA, the UK and Switzerland says AdSense, Ad Manager and AdMob partners must use a CMP that Google has certified and that integrates with the TCF. The consequences:

You have three ways to comply, according to Google: build your own consent solution and get it certified, use the messaging tools in the Privacy & messaging section of AdSense, Ad Manager or AdMob, or use a third-party certified CMP from Google's list.

Do I need the TCF if I only run Google Ads campaigns?

No. Advertisers measuring conversions or building remarketing lists with Google Ads, Google Analytics 4 or Floodlight need a banner that collects valid consent and sends Google Consent Mode v2 signals, including ad_user_data and ad_personalization. The certified-CMP requirement applies to publishers who earn money by showing Google's ads on their site. The same goes for Meta, LinkedIn or TikTok pixels: they rely on your banner blocking them until consent, not on a TC string.

What about other ad networks and header bidding?

Most programmatic ad networks and header bidding wrappers in Europe read the TC string to decide what they may do. If you run Prebid or a network that asks for a "TCF v2 CMP" in its documentation, you need one regardless of Google. Check each network's publisher requirements.

Is the TCF legally safe?

It is a framework, not a legal shield. The Court of Justice ruled on 7 March 2024 (C-604/22, IAB Europe) that a TC string can be personal data when it can be linked to an identifier such as an IP address, and that IAB Europe can be a joint controller for the processing linked to recording preferences in it. Using the TCF does not remove your own duties: the banner must still offer a refusal as easy as acceptance, list the vendors honestly, and avoid relying on legitimate interest for cookies, which European authorities rejected in the EDPB cookie banner taskforce report.

What should a publisher do?

1. List every ad product on the site: AdSense, Ad Manager, AdMob, other networks, header bidding.
2. If any Google publisher product serves ads to the EEA, the UK or Switzerland, choose a Google-certified TCF CMP, either Google's Privacy & messaging or a listed third-party CMP.
3. Configure the vendor list to the vendors you actually work with; long lists make the consent less informed.
4. Keep one banner only. Two consent tools on one page confuse visitors and fight over the same tags.
5. Check in Ad Manager or AdSense reports that requests carry valid TC strings after the change.

Where Cookiequiet fits, and where it does not

Cookiequiet is not a Google-certified consent management platform for the IAB Transparency and Consent Framework yet: websites that show Google AdSense, Ad Manager or AdMob ads to visitors in the EEA, the UK or Switzerland need a certified CMP for those ads. Everything else (Google Analytics 4, Google Ads conversion tracking, Meta Pixel, embedded videos, chat widgets) works with Cookiequiet's Consent Mode v2 integration. If your site has no programmatic ads, it is one script tag before your other scripts, with Reject all on by default and Consent Mode v2 switched on in the snippet the dashboard gives you, free for one website and €3 per website per month on Starter (see pricing). If it does, use a certified CMP for the whole site rather than running two banners.