TCF 2.3 Is Now in Force: Is Your Consent Framework Actually Compliant?

The 28 February 2026 enforcement deadline has passed. Here is what your organisation needs to know — and do — right now.

Why This Matters Right Now

The IAB Transparency & Consent Framework version 2.3 (TCF 2.3) reached its enforcement deadline on 28 February 2026. For publishers, adtech vendors and ad-supported businesses operating across the EU and EEA, this is not a grace period — it is the line.

Organisations that have not updated their Consent Management Platform (CMP) configuration, vendor disclosures and consent banner UX are now operating outside the updated framework standards, with corresponding regulatory exposure.

What makes TCF 2.3 particularly significant is that it does not simply add new boxes to tick. It raises the bar on what informed, genuine and fair consent actually looks like in practice. Regulators across Europe have been watching — and enforcement against dark patterns, vague purpose descriptions and manipulative consent flows has already begun.

What Changed in TCF 2.3

TCF 2.3 is an evolution of v2.2, not a ground-up rebuild. But that should not understate its implications. The changes target the areas where regulators have consistently found organisations falling short: transparency, fairness and genuine user control.

Here is what has changed:

1. Clearer Purpose Descriptions

Generic language like “Optimise your experience” or “Provide enhanced features” is no longer acceptable.

TCF 2.3 requires concrete, plain-English purpose descriptions that give users a real understanding of how their data will be used, for example:

• “Measure which pages are most popular”
• “Show ads based on pages you have visited”

Marketing language has no place in a consent interface.

2. Strengthened First-Layer Transparency

The first layer of your consent banner — what users see immediately — must now clearly state:

• That personal data is processed (not just cookies)
• That third-party vendors are involved
• A clear, one-click route to the full vendor list and detailed explanations

The first layer must inform, not merely prompt a click.

3. Cleaner Legal Basis Signposting

TCF 2.3 tightens the distinction between Consent and Legitimate Interest (LI) as legal bases for data processing.

Users must be able to clearly identify:

• Which purposes rely on Consent
• Which rely on Legitimate Interest

Critically, where Legitimate Interest is used, objecting must be as easy as giving consent. If vendors rely solely on consent, that must also be clearly reflected in the interface.

4. Mandatory Disclosed Vendors Technical Requirement

This change is both legal and technical.

CMPs must now support an updated TC string that includes a mandatory Disclosed Vendors section. Every active vendor must be declared with the following information:

• Processing purposes
• Legal basis
• Data collected
• Storage periods
• Privacy policy links

For OneTrust users, this requires republishing on a compatible CMP version (202510.1.0 or later).

5. Dark Pattern Elimination

TCF 2.3 formally codifies what regulators have long demanded.

• “Accept” and “Reject” buttons must have equal visual prominence
• No colour bias
• No hidden reject flows
• No friction asymmetry

This is one of the highest-risk areas for enforcement action. The standard is unambiguous: equal means equal.

6. Plain Language and Accessibility

Language across the banner and preference centre must be:

• Plain
• Consistent
• Understandable to non-expert users

Accessibility expectations are rising — particularly for large publishers and high-traffic platforms. Organisations should treat readability as a compliance obligation, not simply a design preference.

Why This Matters for Your Organisation

TCF 2.3 has implications that extend well beyond your cookie banner. Consider the following scenarios:

⚠️ Scenario 1: The Publisher with Outdated Vendor Declarations

A large media group has 180 vendors active in its CMP but has not reviewed the vendor list since TCF 2.2 was implemented.

Under TCF 2.3, every active vendor must be correctly declared with current purpose, legal basis, storage and policy data. Without a review, the organisation is signalling consent for processing that may not be properly disclosed — a direct regulatory risk and a potential breach of the GDPR transparency principle.

⚠️ Scenario 2: The Adtech Business Relying on Legitimate Interest

A programmatic advertising platform uses Legitimate Interest as the legal basis for audience segmentation.

Under TCF 2.3, this must be clearly labelled and objection mechanisms must be frictionless. If the interface buries the objection option or describes LI purposes in vague terms, the business risks regulatory scrutiny and potential exclusion from DSP/SSP integrations that require TCF compliance as a trading condition.

⚠️ Scenario 3: The CMP That Has Not Been Republished

An organisation upgraded to TCF 2.3-capable software but never republished the CMP on the updated version.

The TC string being transmitted across the supply chain does not include the Disclosed Vendors section. Downstream vendors therefore receive signals that do not meet the updated framework requirements.

This is a silent compliance gap that often goes undetected until an audit or partner query surfaces it.

At board level, TCF 2.3 touches regulatory exposure, reputational risk, vendor governance, UX design standards and CMP release management. It is not a banner refresh. It is a governance exercise.

What Your Organisation Should Do Now

If you have not already completed a TCF 2.3 readiness review, the following actions should be prioritised immediately:

1. Audit your purpose wording. Review every purpose description in your CMP and replace vague marketing language with clear explanations of data use.
2. Review your first-layer banner. Confirm it clearly communicates personal data processing, third-party involvement and a direct route to the full vendor list.
3. Validate Legitimate Interest usage. Ensure LI purposes are clearly labelled and that objection mechanisms are as accessible as consent options.
4. Conduct a full vendor list review. Cross-reference your vendors against the IAB Global Vendor List and confirm all disclosure fields are accurate.
5. Republish your CMP. OneTrust users should confirm they are running a compatible version (202510.1.0 or later) and republish.
6. Test for dark patterns. Verify equal prominence between Accept and Reject options with no hidden flows or visual bias.
7. Document your compliance rationale. Maintain records of your review process, decisions and changes implemented.

How The DPG Can Help

The DPG works with privacy, legal and technology teams to translate framework updates like TCF 2.3 into practical, auditable compliance programmes.

We understand that the gap between reading the guidance and implementing it correctly — across real CMP configurations, live vendor relationships and existing UX designs — is where many organisations struggle.

Whether you need:

• A rapid TCF 2.3 readiness assessment
• Hands-on support reconfiguring your OneTrust CMP
• A structured vendor governance programme

The DPG provides expert advisory and implementation support tailored to your organisation’s specific context.

We work with mid-to-large enterprises navigating GDPR, UK GDPR and ePrivacy obligations — including organisations running complex adtech supply chains, cross-border publishing operations and programmatic advertising programmes where TCF compliance is both a commercial and regulatory requirement.

Ready to Validate Your TCF 2.3 Compliance?

The DPG offers structured TCF 2.3 readiness reviews, OneTrust CMP implementation support and ongoing consent governance advisory. Get in touch here.