The IAB Tech Lab and IAB Europe on Tuesday released the second version of the Transparency & Consent Framework (TCF), the collaborative industry solution for conducting targeted advertising in compliance with GDPR. Google has committed to its long-awaited integration with the framework by the end of Q1 2020.
The TCF initially was a feature included with bid requests that could be checked on or off to indicate whether consent was collected for targeting. TCF 2.0, the updated format, greatly expands publishers’ bidstream options for collecting and assigning consent, said IAB Europe CEO Townsend Feehan.
It’s a significant enough overhaul of the framework that the update is not backwards compatible, meaning publishers that have already adopted the first version must implement new technology.
The TCF’s registration requirements have also become more sophisticated, Feehan said. Companies must now disclose specific kinds of data they use or collect and their role in ad campaigns.
Publishers need finer controls over consent data, not just on or off options. For instance, a vendor could require explicit consent to use data to target ads but still collect data for other use cases under legitimate interest, like fraud detection or article curation for a news site. Some vendors could be either data processors or data collectors, depending on the publisher and the kind of data available.
Despite the additional work to join the framework, the IAB Europe and IAB Tech Lab expect the update will help gain traction after a tough first year and a half.
The additional controls should “answer many objections” publishers had with the limited consent features in the first version, said Dennis Buchheim, EVP and general manager of the IAB Tech Lab, which operates the technical specifications while IAB Europe oversees policy decisions.
Publishers have also hesitated to adopt the framework because of concerns, largely from other trade and advocacy groups, about the viability of data-driven advertising as its practiced today under GDPR, Feehan said. The TCF 2.0 addresses issues raised by the French CNIL and the UK’s watchdog group, the Information Commissioner’s Office.
An uptick in enforcement cases will also spur adoption, she said, as European companies that expected regulators to limit themselves to US tech giants recognize they’re at risk.
The IAB Europe can’t track the number of publishers integrated with the framework – most of those sign-ups are being done by consent management platforms – but it estimates between 20% and 25% of bid requests emanating from the EU include a TCF consent string. That’s a relatively low adoption rate compared to other IAB and Tech Lab initiatives, such as ads.txt, which was industry standard after a year.
But Google was a strong backer of ads.txt from the get-go, and it could help TCF reach a tipping point once it integrates the industry standard with its own online consent signals.
“I think where we start to see the hockey stick curve is driven by Google being engaged now and integrating,” Buchheim said. He also said that Google will integrate with the framework gradually, and at different times with different publishers, not in a sudden change across the board.
“In line with the IAB Europe timeline we expect to integrate with TCF 2.0 shortly after the switchover from TCF 1.1 and when 2.0 goes fully live, which we currently understand as by end of Q1 2020,” Chetna Bindra, Google’s senior product manager for user trust, privacy and transparency, said in a statement. “We will provide greater detail on our integration approach in the coming weeks.”
Next year should be decisive for TCF adoption, Buchheim said. Many brands put all new product implementations on hold starting around September because they don’t want to waste money on tests or, worse, risk some new tech misfiring and interrupting holiday season campaigns. That explains why the line in the sand for Google to join comes after the first few months of 2020.
Buchheim said there will also be opportunities to reach media and tech companies that, to date, haven’t urgently needed to invest in GDPR solutions.
“With CCPA nipping at our heels,” he said, “there’s going to be more interest from US companies that have been on the sidelines so far.”
