The complete guide to IAB GDPR Framework and iubenda’s Consent Management Platform

Major advertising networks now require publishers to gain GDPR consent before showing personalized ads. In this guide you’ll find out how you can meet this requirement with the IAB Transparency and Consent Framework and our Cookie Solution.

What’s the IAB Transparency and Consent Framework (TCF)?

The IAB Europe Transparency and Consent Framework is an initiative of IAB Tech Lab — a non-profit organization made up of digital publishers, ad-tech companies, marketers, and other companies involved in interactive marketing. The board is made up of some pretty well-known brands such as Google, AppNexus, LinkedIn, Microsoft and others.

The association behind the Tech Lab – IAB Europe – is the leading industry association for the online advertising ecosystem. This association represents over 5,500 organizations at the EU-level and its mission it is to shape the regulatory environment by developing harmonized business practices in order to promote the development and ensure the sustainability of the digital advertising sector while demonstrating the value that such innovative sector brings to the EU economy. Starting May 25, 2018, the General Data Protection Regulation (GDPR) went into effect and became fully enforceable, meaning that those that fall within its scope are expected to comply and, if found to be non-compliant, would risk heavy fines and sanctions.

As essentially all parties within the digital advertising ecosystem process personal data in some way (e.g collecting user data or accessing user devices), they are required to comply with the GDPR.

IAB Europe founded the GDPR Implementation Working Group (GIG), a group consisting of parties from both the supply and demand sides of the digital advertising ecosystem, in 2017. The GIG is aimed at helping member companies, and the digital advertising industry at large, to understand EU rules on data protection and privacy in a practical way and collaborates on guidance and solutions to the GDPR.

Though GDPR is primarily a legal challenge, a technological response was also necessary to meet the transparency and control requirements that arise as a result of GDPR implementation. It was out of this necessity that the IAB Tech Lab GDPR Technical Working Group was formed within the IAB Tech Lab.

The Technical group’s efforts resulted in the development of the IAB Europe Transparency & Consent Framework (TCF). The Framework and the associated Consent Management Provider API was developed as a way to “give the publishing and advertising industries a common language with which to communicate consumer consent for the delivery of relevant online advertising and content”.

In practice, the TCF provides a standardized process for getting users’ informed consent and allows the seamless signaling of users’ s consent preferences across the advertising supply chain.

It’s made up of an ever-growing list of publishers and advertisers that have agreed to be bound by its standards and use the framework to facilitate user choice via a convenient, easy to use interface.

Who should enable the TCF / Who does it best apply to

The IAB Transparency and Consent Framework is, ideally, meant for first-party publishers who work with third-party advertisers (i.e publishers who run ads on their website). It’s highly recommended that you enable this feature if you fall within this category as some advertising networks may limit access to their network if not implemented, which could, in turn, potentially decrease your ad revenue.

Publishers further stand to benefit from this initiative in that it makes it easier to be more transparent with users and allows you as the data controller, to have more control over how your users’ data are processed and for which purposes.

If you run ads on your website it’s highly recommended that you enable this feature: some advertising networks may limit access to their network if not implemented, which could, in turn, potentially decrease your ad revenue.

iubenda Cookie Solution and integrated TCF

Despite being a relatively new initiative, the IAB Transparency and Consent Framework is rapidly becoming the industry standard with many huge vendors such as Google, Adobe and AdRoll involved in its implementation.

As a registered Consent Management Platform, we’ve worked hard to ensure that our Cookie Solution integrates seamlessly with and complies with the policies and specifications of this Framework, hereby giving you, our users, the additional option to easily enable and use it for your website and apps.

How to enable the IAB TCF in the Cookie Solution

The Cookie Solution gives you the option to allow your users to customize their advertising tracking preferences directly from your website. While this feature is optional, it is heavily recommended that publishers, in particular, enable this feature as failure to do so can potentially result in reduced reach and ad revenue.

Additionally, once enabled in the Cookie Solution, this feature automatically blocks the scripts of advertisers that are a part of the IAB Vendor Network (provided that the individual advertisers adhere to the standards of the network) prior to receiving user consent.

This tutorial assumes that you’ve already activated the Cookie Solution and generated your cookie policy. If you haven’t already done this, you can read that tutorial here.

To enable this feature, head to your dashboard and click on the website that you’d like to update. Next, click the <>EMBED button in the Cookie Solution area:

This will take you to the embed section for the Cookie Solution.
This feature is available on all channels.

To enable, scroll to the bottom of this section and click the checkbox on the bottom left (as pictured below):

Note: you can enable this option also on the Cookie Solution customization panel (Cookie Solution > Edit).

Integration

IAB’s minimum configuration requirements

The minimal configuration requirements you’ll need for adherence to the TCF are to:

• provide explicit accept and customize buttons for your site users (i.e. banner: { acceptButtonDisplay: true, customizeButtonDisplay: true }, see snippet below); and
• provide a link or button (e.g. in the footer) that allows your users to reopen the consent modal and edit their preferences.

In terms of content, the banner notice for TCF v2.0 should provide:

• information about the fact that information is stored on and/or accessed from the user’s device (e.g. use of cookies, device identifiers, or other device data); 
• information about the fact that personal data is processed, and the nature of the personal data processed (e.g. unique identifiers, browsing data);
• a link to the list of vendors;
• a list of purposes (using at least the standardized names and/or stack names);
• information about the special features used by the vendors;
• information about the scope of the consent choice;
• information about the fact that the user can withdraw their consent at any time, and how to resurface the Framework UI in order to do so;
• a link to a relevant layer of the Framework UI dealing with processing on the basis of legitimate interests where more information can be found.

Cookie Solution snippet

Once enabled, your Cookie Solution embed code will go from this:

<script type="text/javascript">
    var _iub = _iub || [];
    _iub.csConfiguration = {
        "lang": "en",
        "siteId": XXXXXX, //use your siteId
        "cookiePolicyId": YYYYYY, //use your cookiePolicyId
        "countryDetection": true,
        "consentOnContinuedBrowsing": false,
        "perPurposeConsent": true,
        "banner": {
            "acceptButtonDisplay": true,
            "customizeButtonDisplay": true,
            "rejectButtonDisplay": true,
            "position": "float-top-center"
        }
    };
</script>
<script type="text/javascript" src="//cdn.iubenda.com/cs/iubenda_cs.js" charset="UTF-8" async></script>

To this (note the stub-v2.js script, "enableCMP": true and other TCF options):

<script type="text/javascript">
    var _iub = _iub || [];
    _iub.csConfiguration = {
        "lang": "en",
        "siteId": XXXXXX, //use your siteId
        "cookiePolicyId": YYYYYY, //use your cookiePolicyId
        "countryDetection": true,
        "consentOnContinuedBrowsing": false,
        "perPurposeConsent": true,
        "enableCMP": true,
        "googleAdditionalConsentMode": true,
        "banner": {
            "acceptButtonDisplay": true,
            "customizeButtonDisplay": true,
            "rejectButtonDisplay": true,
            "position": "float-top-center"
        }
    };
</script>
<script type="text/javascript" src="//cdn.iubenda.com/cs/tcf/stub-v2.js"></script>
<script type="text/javascript" src="//cdn.iubenda.com/cs/iubenda_cs.js" charset="UTF-8" async></script>

Consent to ad personalisation

Now, if you intend to serve personalized ads to users, you’ll need to ensure that explicit consent to ad personalization is collected before you can display personalized ads for end-users (Google will not serve ads, not even non-personalized ads, if the user has not expressed a preference in regards to cookies).

In order for vendors to read the consent collected, __tcfapi function that the CMP (iubenda) makes available must be present. This function is only available after consent has been collected. In order for vendors to read the consent properly, two methods are available:

• Directly blocking the vendor scripts (using another prior blocking method), then executing them only after consent has been collected. This method requires more implementation work and it’s a bit slower in terms of execution time, but it allows personalized ads to be served from the first page view (where consent hasn’t been collected yet) and gives you more direct and solid control in regards to ensuring compliance.
• Not directly blocking the vendor scripts, but rather, ensuring that the __tcfapi function is loaded before the vendor scripts are loaded, through some specific configuration, but this will only work from the second page view, when consent is already present on the page. This method is easier to implement and it’s very high-performing in terms of load speed, however, in this situation, you have less direct control as you must rely on the vendor’s adherence to IAB’s guidelines for compliance.

Here are the implementation instructions:

• Directly blocking the vendor scripts
• Not directly blocking the vendor scripts

Allow users to update their TCF preferences even after closing the cookie banner

This TCF feature gives you the option to let your visitors update their advertising tracking preferences even after closing the cookie banner.

To implement, just add the iubenda-advertising-preferences-link class to a custom link or button, for example:

<a href="#" class="iubenda-advertising-preferences-link">Update your advertising tracking preferences</a>

And place anywhere on your site (typically added to the site footer). Once clicked, the link/button will trigger the opening of the advertising tracking settings modal:

To meet IAB’s requirements, please note that if you don’t implement the iubenda-advertising-preferences-link class, we’ll automatically display a small widget that hovers on your pages:

Additional Features & Settings

Multiple options for accepting/rejecting cookies

The IAB feature allows users to consent/reject cookies both on an individual basis or as a bulk action, for the convenience of your website users.

Request new consent

When enabled, return users who have accepted cookies on your site prior to the activation of the IAB feature will see the cookie banner and be asked for fresh consent, hereby allowing these users the equal opportunity to individually modify their preferences as the other users of your site.

You can find this setting under Advanced view > IAB Transparency and Consent Framework.

Request new consent at vendor list update

Since the IAB vendor list is updated almost weekly, you may want to choose how to handle new consent requests, avoiding showing the cookie banner to users who have already given consent a few days or weeks before.

On Advanced view > IAB Transparency and Consent Framework, you’ll find a section called Request new consent at vendor list update, where you can choose between three different values:

• Never (default value) – users who have already given consent will not be shown the cookie banner again. Consent for new vendors will be set to off.
• Immediately – users will get prompted with a new consent request whenever the vendor list is updated.
• With a delay – users will get prompted with a new consent request x days after the update of the vendor list (you’ll have to specify the number of days).

Provide gdpr and gdpr_consent parameters into the request to the vendor

Some vendors may ask you to explicitly provide gdpr and gdpr_consent parameters into their request. Here’s a snippet to meet this requirement:

<script type="text/javascript">
    __tcfapi('addEventListener', 2, function(tcData) {
        if (tcData.eventStatus !== 'useractioncomplete' && tcData.eventStatus !== 'tcloaded') {
            return;
        }
        var gdpr = tcData.gdprApplies ? 1 : 0;
        var gdpr_consent = tcData.tcString;
        console.log({ gdpr: gdpr, gdpr_consent: gdpr_consent });

        // Remove event listener to avoid invoking the ads multiple times
        __tcfapi('removeEventListener', 2, function(success) {
            console.log('event listener removed', success);
        }, tcData.listenerId);
    });
</script>

Once replaced the console.log line with the request to the vendor by using the gdpr and gdpr_consent variables, add this snippet below the iubenda_cs.js script, and it will automatically invoke the vendor script with the correct consent data.

Visual result

Now when your users click on the “Learn more and customize” button (or the “advertising preferences panel” link) in your cookie banner in order to manage their preferences, they will see the following options:

Note: when the user indicates that they would like to manage preferences by opening the preference window, all cookies are “turned off” by default as a positive affirmative/ “Opt-in” action is legally required for valid consent.

See also

• How to collect consent for Google Ad personalization
• TCF 2.0 Transition Guide
• Introduction to the Prior Blocking of Cookie Scripts