A Publisher’s Guide to IAB TCF 2.0 and CMP
The General Data Protection Regulation (GDPR) came into effect in May 2018. This is by far the most comprehensive framework that requires publishers to follow a set of rules regarding the collection and storage of user data, including personally identifying information (PII) such as names and addresses.
This and other legislation have led to the rise of Consent Management Platforms (CMPs) that need to comply with IAB’s Transparency and Consent Framework (TCF).
In this post, we’ll look at what TCF and CMPs are, how they work, and why publishers need to integrate them.
What is TCF?
TCF stands for the Transparency Consent Framework. It’s built on the GDPR (General Data Protection Regulation) legislation to give users greater control and transparency over the use of their personal data.
TCF is a standardized protocol for communicating the state of user consent between first and third parties and the consent management system (CMP) in use on the publishers’ websites.
IAB Europe launched the first TCF version back in 2018.
How Does IAB TCF Work?
The IAB Transparency and Consent Framework serves as a framework for informing first parties (such as publishers), third parties (such as advertisers), and the consent management platform in use on the first party’s website about the status of user consent.
From a list of IAB-approved vendors, publishers choose the ones they want to collaborate with. The user’s consent is saved in a first-party cookie (or local storage) in the user’s browser and is shared in the IAB Framework.
TCF v2.0 vs v1.0
The IAB TCF v2.0 is the most current version of the framework. The first version of TCF was too adtech-focused. With TCF v2.0, IAB continues to support the main initiative–encouraging ad tech vendors, publishers, and agencies to comply with GDPR when processing personal data or accessing and/or storing information on a user’s device.
TCF v2.0 vs v1.0
Below are 3 main differences between TCF v2.0 and TCF v1.0.
- Improved Transparency
TCF v2.0 is more transparent for users because it contains more detailed descriptions of what data will be collected and processed.
- Publisher-focused
More freedom in the publisher-partner relationship. Publishers have more control over how their partners collect and store personal information. Publishers can easily restrict any data collection for any of their ad tech vendors.
- Greater Control
Consumers have a right to object to their data being processed. TCF v2.0 allows consumers to easily give, refuse, or revoke their consent at any time. More info here.
To gather consent form about website visitors and what data is collected when they visit the website, publishers use IAB-certified Consent Management Platforms (CMPs).
What is a CMP?
A CMP, or Consent Management Platform, is a technology used by website owners to collect data from users. It complies with handling users’ personal information, such as meeting the General Data Protection Regulation (GDPR) and IAB Europe’s TCF.
CMP helps publishers to efficiently capture and store user consent.
How Does a CMP Work?
There are four key functions of a CMP:
1. Consent Notification: For CMP it’s a must to inform users that their personal data is going to be collected. It can look like consent pop-ups or privacy notice when a user visits the site.
2. Privacy Preferences for Users: CMP allows users to exercise consent and choose preferences at granular levels.
3. Proof of Compliance: If you have CMP there is a possibility to check the audit log. This means that there is a chronological record of all the activities done regarding the user data.
4. Capturing and Sharing: Combines user preferences in an IAB-compliant consent cookie and then the data is legally shared with approved partners.
Examples of CMP
- It can look like a ‘banner’ at the bottom of the website.
- Pop-up message. For example, when a user visits a website, a pop-up asks his consent to use personal data. The pop-up function allows consuming the content only when a user has pressed the ‘consent’ button.
Source: bannertag.com
Why Do Publishers Need to Implement an IAB and Google-approved CMP?
If your CMP isn’t updated to the latest version (TCF v2.0), you won’t be able to show personalized ads to visitors in Europe and the UK. This can cause a dramatic drop in ad revenue, especially for publishers with a large portion of European traffic.
*According to Google, if you have misconfigured CMP and failed to send a valid TCF string starting from October 15th, 2020, all existing personalized ads will be served as non-personalized.
Note that if a website doesn’t have user consent, it can still display general branding or contextual ads, but not personalized.
In order to meet the best practice regarding data collection and user privacy, your CMP must be IAB-approved. The full list of approved vendors can be found here.
In addition, publishers using Google AdSense, Ad Manager, or AdMob are required to integrate a Google-approved (CMP), like Setupad, when serving ads to users in the European Economic Area (EEA) or the UK. Failure to do this will result in a heavily limited ad serving and targeting for users of these platforms.
You can find the list of approved vendors here.
What are the Best CMP Platforms for Publishers?
You can work with any IAB-approved CMP. However, to make this easier, our experts suggest choosing between one of the best free CMPs:
1. Setupad
Setupad CMP is a publisher-oriented GDPR solution. It’s Google-approved, complies with IAB’s TCF v2.0makes the collection of user consent simple and transparent.
Main benefits of Setupad’s CMP:
- Supports IAB’s TCF v2.0
- Sleek and customizable design
- Free for Setupad clients
- Multiple languages support
- Easy-to-understand, intuitive interface
- Most of the data (except for TCF string) is stored in Local Storage as opposed to in a cookie*
*Store consent in a cookie isn’t advised because it can sometimes lead to server errors. IAB recommends storing consent in the backend of the CMP or the local storage.
Setupad’s CMP lets the end-users choose between IAB Purposes and Vendors before submitting their consent.
Elgars Grodnis, CMP Project Lead: «The creation of Setupad’s CMP is just one of the many ways we support publishers and content creators in the development of their businesses. No matter where a user is located, Setupad’s CMP guarantees that publishers are always protected and able to optimize their ad revenue, which is instrumental to our ambition to meet the needs of the rapidly changing industry.»
2. Quantcast
Quantcast is one of the first and most popular CMP solutions on the market. Despite being core partners with IAB, Quantcast was often cited as too complicated to set up and a lack of customer service.
About Quantcast:
- Supports IAB’s TCF v2.0
- Core partners with IAB and 14-year trusted relationship with publishers and advertisers
- No need for Google Ad Manager (GAM) or Google AdMob account.
- Has a free plugin Quantcast Choice
- Multi-language support
3. Google Funding Choices
This CMP by Google is among the most popular choices for publishers because it’s integrated with Google’s advertising services (Google AdMob, Google Ad Manager, and Google AdSense). However, if you don’t use Google’s advertising platforms, you won’t be able to use this CMP.
You will be able to personalize your message in the “Privacy & Messaging” tab on Google AdMob, Google Ad Manager, and Google AdSense.
Main benefits of Funding Choices:
- Supports IAB’s TCF v2.0
- GDPR and CCPA compliant
- Multiple languages support
- Free
- Ad blocking recovery message
- Text customization option
We hope that this article helped you to better understand the concept behind CMP.
If you are still struggling with CMP set-up, email us at [email protected].
