Transitioning to IAB’s TCF 2.4: what you need to know

The IAB Europe Transparency and Consent Framework (TCF) has a new version. TCF 2.4 and the TCF Policies v5.0.b focus mainly on helping users understand what they’re agreeing to.

TCF 2.3 changed the consent string. TCF 2.4 mostly changes the text your users see, plus one small change in how some vendors signal that they were disclosed.

What is TCF 2.4?

TCF 2.4 is the latest version of the IAB Europe Transparency and Consent Framework. It comes with an updated set of rules, the TCF Policies v5.0.b.

The TCF is the industry standard that helps publishers and advertisers meet the requirements of the General Data Protection Regulation (GDPR) and the ePrivacy Directive when they process personal data for advertising:

• It gives Consent Management Platforms (CMPs) like iubenda a standard way to inform users and collect their consent (or objections)
• It passes consent signals consistently along the advertising supply chain, from your site to every vendor you work with

What changes from TCF 2.3?

TCF 2.3 made the “Disclosed Vendors” segment mandatory in every consent string. TCF 2.4 builds on that and makes four changes.

Standard texts and illustrations for Features

Features are the means vendors use to process data, such as matching data from different sources. CMPs now have to show a standard explanatory text for Features, plus illustrations for each one. Both come from the Global Vendor List (GVL), so every CMP shows the same wording.

A new name for Special Feature 2

Special Feature 2 is now called “Identify devices based on information actively requested”.

No more Legitimate Interest workaround for Special Purposes

Some vendors that only process data for Special Purposes used to signal Legitimate Interest to show they’d been disclosed to the user. TCF 2.4 removes this workaround. These vendors now rely on the Disclosed Vendors segment introduced in TCF 2.3.

Consent scope: one device or many

Some publishers save consent with the user’s account, so the choice follows the user to every device where they sign in. When that’s the case, the banner now has to say so. This comes from the TCF Policies v5.0.b.

If you don’t do this, nothing changes.

TCF 2.3	TCF 2.4
Features described in each CMP’s own words	Standard texts and illustrations for Features, from the GVL
Special Feature 2 under its previous name	Special Feature 2 renamed “Identify devices based on information actively requested”
Special Purposes vendors could signal Legitimate Interest to show disclosure	Special Purposes vendors rely on the Disclosed Vendors segment
Consent saved across devices not covered	Banner states when consent follows the user’s account across devices

Why this change?

The TCF already standardized how consent is signaled. TCF 2.4 brings the same consistency to what users read. With standard texts and illustrations, a user sees the same explanation of each Feature wherever they go. When consent follows their account, a clear statement tells them their choice applies on every device where they sign in.

What’s the timeline for implementation?

Here are the key dates to keep in mind:

• October 23, 2026: deadline for websites. CMPs need to show the new texts and disclosures by this date
• February 23, 2027: deadline for mobile apps and CTV

What does this mean for iubenda customers?

If you use iubenda’s Privacy Controls and Cookie Solution, we handle the main changes for you.

• Feature texts and illustrations, built in. The Features section of your banner’s second layer shows the standard GVL text and illustrations, in the languages your banner uses.
• Nothing to configure. The new texts appear with both TCF 2.3 and TCF 2.4 configurations, and the change to how Special Purposes vendors signal disclosure is handled on our side.
• TCF 2.4 becomes the default. By October 23, 2026, we’ll set tcfVersion to 2.4 by default. Want to switch before then? Set tcfVersion: 2.4 in your configuration.

One thing to check: do you save consent with user accounts?

Your banner already tells users how far their consent reaches: “Your choices apply only to this domain.” For most sites, that’s correct and you don’t need to do anything.

If you save consent with your users’ accounts, so their choices apply on every device where they sign in, turn on the new multi-device consent notice. You’ll find it in your Privacy Controls and Cookie Solution configuration, under IAB TCF > Consent, as “Display a multi-device consent notice” (or set multiDeviceConsentNotice: true if you configure the banner in code). It’s off by default. Once on, it adds a second sentence to your banner and to the TCF section of your preferences panel: “Your choices apply only to this domain. They’re saved with your account and apply on every device where you’re signed in.”

FAQ