Real Cookie Banner is compatible with the Transparency & Consent Framework (TCF) in specification 2.0 and newer. In this article we explain what TCF is, when you need it and how to set up your TCF compatible cookie banner with Real Cookie Banner.
What is TCF?
The Transparency and Consent Framework (TCF) is a standard of the European digital marketing industry association IAB Europe. It allows user to consent for data collection and processing in accordance with applicable EU law and to share it with in a standardized format 3rd-party services (e.g. advertising networks). Some services require consent according to the TCF standard to be used on your website.
TCF brings clear guidelines to which website operators (publishers), advertisers (vendors) and CMPs (cookie banner manufacturers) must comply. As a result, the functionality, look and feel, and the way consent is obtained is changed and intentionally restricted by TCF.
If you as a website owner considering using TCF on your website, be sure to read the IAB Europe Transparency & Consent Framework Policies. It describes all the binding rules you have to follow. It also explains the legal functionality of the TCF standard.
When should you use TCF?
As a website operator (publisher), you can only obtain consent according to the TCF standard for service providers (vendors) that are listed on the Global Vendor List (GVL) as a TCF-certified member of the standard.
Typically, advertising networks such as Google Adsense or yield management solutions such as Ezoic use TCF. With this type of consent, they don’t have to rely on you as the website operator to obtain consent, but rather see exactly what consents you obtained, when, for whom, and for what purpose based on the standardized communication of the obtained consent.
Consequently, you will only need to use TCF if, for example, an advertiser who wants to advertise on your website asks you to obtain consents in compliance to the TCF standard.
Before you set up TCF in your cookie banner, you should be aware of what you want to obtain consent for. You should know what the vendor’s name is in the GVL and what ID it has. In addition, you should check for which purposes according to the TCF standard you as a website operator must obtain consent to be able to use the service. The vendor automatically provides you with all the purposes that it could process and you, as the website operator, should restrict these as far as they are really needed.
We would like to explain what this means in practice using Google Adsense as an example. In the documentation of the service you can find the following explanations:
- Interoperability guidance for vendors working with Google via the IAB TCF v2.0
- Publisher integration with the IAB TCF v2.0
In these documents it is explained to you that Google has the Vendor ID 755 in the GVL and is called “Google Advertising Products”. In addition, all requested purposes are explained in the documents as well as the legal basis (consent or legitimate interest) on which they should be used.
For example, if you only want to serve non-personalized ads, you will understand from the documentation that “Create a personalised ads profile” (Purpose 3) and “Select personalised ads” (Purpose 4) are not necessary. You as a publisher can therefore decide in Real Cookie Banner not to ask for consent for these purposes from your visitors.
TCF is disabled by default in Real Cookie Banner because it adds a lot of complexity that is not needed for most websites.
Therefore, you need to enable TCF for Real Cookie Banner in your WordPress backend under Cookies > Settings > Transparency & Consent Framework (TCF).
In the process, you need to agree to the IAB Europe legal documents and specify the country where you run your website. After that, the Global Vendor List (GVL) will be downloaded automatically, which contains all the vendors for which you could obtain consents. Every thursday the GVL is updated by IAB Europe. Real Cookie Banner automatically takes care that you always use the latest GVL for your consents.
Real Cookie Banner only support the service-specific scope of TCF. This should be the “TCF-mode” you need for nearly every website. You can use consents obtained in this way on other websites via Consent Forwarding instead of using TCF group-specific scope. There are no plans to support group-specific scope in the near future.
The previous steps have prepared that we can obtain consents for the use of certain purposes for certain vendors. We now need to create the vendors.
Under Services (Cookies) you will find a new tab TCF Vendors. In this tab you can add a TCF vendor to your cookie banner by clicking the button Create TCF vendor configuration or Add TCF vendor. We recommend using the search feature in the very long vendor list. You can find the vendor by its name or vendor ID.
Then you can make settings for the TCF vendor, similar to non TCF standardized services. All fields are automatically prefilled according to the vendor’s information, and you can change certain values. It is important at this point to request only the purposes that you really need. You should deactivate all other purposes!
Content Blocker for TCF vendors
The TCF standard takes care that when consent is given to use a particular service, the content of the consent is communicated to the vendor. What TCF does not take care of, however, is that if consent is not given, no data is transferred to the vendor.
In the European Union the IP address, which must always be transmitted to load content on the Internet, qualifies as personal data (see ECJ ruling dated 19 October 2016, Case C‑582/14). Consequently, in our legal opinion, to act in accordance with Art. 6 GDPR, you usually need to obtain a consent to transfer data to e.g. Google for Google Adsense.
If a user rejects e.g. Google Adsense as TCF consent, you as a website operator should therefore ensure that no scripts etc. are loaded by Google Adsense and personal data is transmitted to Google. You can do this by using content blocker feature in Real Cookie Banner.
You can create a content blocker under Content Blocker using the Create content blocker or Add content blocker button. Please note that no explicit content blocker templates can be provided for TCF services, since it is not known which service of a TCF vendor you are using. You can create a custom content blocker or extend one of the existing content blocker templates by adding the TCF vendor that is responsible for the playing out e.g. scripts, images or videos (and removing the connected non TCF service).
Please note that currently no visual content blockers are supported for TCF vendors. Usually, you use TCF consents to serve ads and almost no user will probably consent to their delivery after rejecting them once.
The TCF standard prescribes in certain points, how a cookie banner with TCF has to look like. New elements like stacks, purposes, special purposes, features, special features, vendors and legal basis will be automatically integrated into the cookie banner as soon as you have at least one TCF vendor created.
However, you can customize the look of the cookie banner in the WordPress Customizer. Any features that we know are not TCF compliant will be hidden once you enable TCF compatibility. Also, we will show a notice if color contrasts in your cookie banner do not comply with the TCF standard.
After enabling TCF for your cookie banner, you should go to the WordPress Customizer and review each setting you made to make sure it is in compliance with the IAB Europe Transparency & Consent Framework Policies.