In February last year, the Belgian Data Protection Authority (APD, “Autorité de Protection des Données”) issued a decision against IAB Europe related to the Transparency and Consent Framework (TCF), fining the organization 250k€ and instructing it to come up with a plan to solve the issues that were identified.
Since then, IAB Europe has come up with a plan to update its TCF, which will come into action over the following months. In this article, we review the context surrounding the APD decision, catching you up on the events from last before presenting IAB Europe’s action plan, and finally going over what these changes will mean in practice for Commanders Act users.
March 2023 update: On March 15th, 2023, IAB Europe confirmed that the Belgian APD has voluntarily suspended the six-month implementation period of IAB Europe’s action plan. As a result, the July 2023 deadline no longer applies. It’s now reported for Q4 2023
For more details and pending additional information, read the official IAB .\
More than a year ago, on February 2nd, 2022, the Belgian APD issued a decision against IAB Europe citing 4 issues with its Transparency and Consent Framework (what’s the TCF? Learn more ). According to the Belgian APD:
The Transparency & Consent (TC) string, the consent signal stored by players in the advertising industry, is personal information. As such, participants should establish a legal basis.
IAB Europe is a data controller of that information, whether or not it processes the consent information
IAB Europe is a joint controller with TCF participants (vendors, CMPs, publishers)
Security measures in place to protect the integrity of the consent signal were not sufficient
IAB Europe was subsequently fined and instructed to come up with an action plan to solve these issues. The IAB Europe, along with some TCF participants, has worked on the action plan and submitted it to the APD in April 2022. Despite additional procedural events in September, the action plan was reviewed on January 11th by the Belgian APD.
Of course, we will communicate with Commanders Act customers with specific action points before then.
Here are the main changes and obligations that will impact your Consent Management Platform if you’re using the TCF after April 2023:
New TC string special purpose
Users of the TCF will be required to add a new (special) purpose to the classification of purposes in the TCF, informing their users that they are capturing and sharing data subject choices via the TC String.
No more legitimate interest for targeted advertising
Going forward, users won’t be able to rely on legitimate interest for personalized advertising.
Specifically, the purposes impacted will be purpose 3 (create a personalized ads profile), purpose 4 (select personalized ads), purpose 5 (create a personalized content profile), and purpose 6 (select a personalized content profile).
Mandatory disclosures in the second layer of the CMP
After April, users of the TCF will be required to disclose new information in their CMP second layer:
The legitimate interests at stake
The categories of data collected and/or already held by Vendors
The retention periods (in the Vendors’ description)
Vendor-related changes
Publishers will be presented with a warning about the impact that a large number of vendors can have on the ability of users to make informed choices.
Additionally, the number of vendors will need to be disclosed in the first layer of the CMP. Finally, we will recommend using event listeners to ensure proactive communication of changed TC String to vendors.
As a Commanders Act customer, what do these changes in the TCF mean and what are you supposed to do? Don’t worry, we’ve got it all planned out.
Not a lot will be expected from Commanders Act customers. However, if you decide to continue using the Transparency and Consent Framework, you must know that consent notices/consent banners will be changing slightly (based on the changes listed in the previous section), and you should therefore be ready for it.
The migration from the TFC v2.2 will take place on November 20, 2023 serving as the hard deadline for the change. You will be must to regenerate your consent banners TCF before this deadline.
Once the migration will be complete, we will recommend that you recollect consent from your customers, as previously collected consent was deemed invalid following the Belgian APD decision. Additionally, you’ll most likely have to reduce your vendor list, and updating mobile SDK versions to get the new TCF various updates will be compulsory.
But don’t worry, we will remind you about this before the deadline.
To conclude, and while it’s important to be aware of the upcoming changes following this important industry decision, the impact on Commanders Act customers should be minimal, and we’re hoping to provide thorough assistance to everyone along the way If you wish to go further, you will be able to verify your TCF compliancy, since IAB Europe has released a new CMP Validator Chrome Extension available that includes all requirements of TCF v2.2.\
The IAB TCF v2.2 has new requirements. This page listing the new elements of the CMP IAB TCF UI standard.
This is an informative page. Almost every listed points above are automatically managed by our Consent Module (only the buttons "accept all" and "refuse all" are not automatically added). Simply follow our Migration guides for Web and for App to update you banner with these new requirement
The standard text has evolved with more precise list of usage of datas, and the total number of IAB TCF vendors must be displayed
IAB TCF requirements are very strict. If you wish to display a custom text, we strongly recommend you to ask a validation from IAB team. You can also refer to this
If you don't have yet an accept all / refuse all buttons in your privacy center, you must add them manually. You can refer to the step n°2 of for setup help
The TCF will add a new (special) purpose to the classification of purposes in the TCF, informing their users that they are capturing and sharing data subject choices via the TC String. The name of this new special purpose is "Use limited data to select content" (ID 11)
purpose 3 (create a personalized ads profile)
purpose 4 (select personalized ads)
purpose 5 (create a personalized content profile)
purpose 6 (select a personalized content profile)
3 major changes for the information provided by the Vendors
They can provide a cookie policy url in multiple languages (the displayed url will be the same then the browser language)
They must show the data retention period for each purpose
They must show data they will collect
Step by step guide to remains compliant on the Web for TCF v2.2
Here's the 5 steps to follow to remains compliant with the TCF on your website
Verify/Update your IAB Vendors
The Vendors List has evolved, we recommend to verify your IAB Vendors selected.
Data Governance > Consent Management > Vendors \
\
Sources > Privacy Banners > Edit (select your banner) > Privacy Center tab > ButtonsGenerate a new version of your Consent banner
Sources > Privacy Banners > Edit (select your banner) > Generate
&#xNAN;*We recommend to check the option 'reactivate the privacy', so all you users will have the new consent string format, including the new purpose and the updated vendors\
Generate a new version of the Web Container related to you Consent Banner
Sources > Web Containers > Edit (select your container) > Generate\
Deploy your latest versions of Web Container and Consent Banner\
The deadline to migrate is November 20, 2023
This page is to the attention the customers using the Commanders Act SDK with the IAB Consent Module in their mobile application
Here's the 2 steps to follow to remains compliant with the TCF on your mobile application
Requirements To be allowed to migrate on IAB TCF v2.2, your application must use the v5 of our SDKs If you're still using the v4, please refer to the main
Simply download the latest versions of our TCIAB SDK Modules
Upload the latest version to update your offline json's
(required if you're using other languages then EN, this link example is for FR language)
your privacy json file updated (needs to be modified, following the step "Update the content of your privacy json file")
Upload your CDN json file
Your privacy json file updated needs to be uploaded on CDN Commanders Act, please contact your consultant or our support team to upload the latest version of your json on our servers. (the content of this json file needs to be updated, following the next step.)\
Update the content of your privacy json file
Verify your vendor list "vendors": "15,48,501,506,520,539,512,895",
*if you left the "vendors" empty, it will be considered as ALL vendors by our SDK
Pay attention to your Vendor List, some Vendors aren't existing anymore in the GVL v3\
Add the new required fields
texts -> generic -> "illustationsButton": "illustrations"
texts -> generic -> "dataCategoriesDef" : "Data Categories"
texts -> vendors -> "legIntClaimTitle": "Legal policies"
Full json example:
The deadline to migrate is November 20, 2023
{
"information": {
"update": "2023-06-30",
"version": "1",
"vendors": "8,241",
"google_vendors" : "323,389,385,424",
"consentDurationInMonths": 6,
"significantChanges": "",
"resetSave": ""
},
"components": {
"firstLayerButton": ["RefuseAll", "Detail", "AcceptAll"],
"secondLayerButton": ["RefuseAll", "Save", "AcceptAll"]
},
"customisation": {
"content": {
"fontcolor": "#000000",
"backgroundcolor": "#ffffff",
"bordercolor": "#806423"
},
"button": {
"fontcolor": "#ffffff",
"backgroundcolor": "#4287f5",
"disabledBackground": "#E1E1E1",
"linkcolor": "#0907F7"
},
"order": ["Custom", "IAB"]
},
"texts": {
"generic": {
"saveButton": "Save & Exit",
"detailButton": "Details",
"acceptAllButton": "Accept All",
"refuseAllButton": "Refuse All",
"vendorButton": "Vendors",
"purposeButton": "Purposes",
"legalButton": "Legals",
"illustationsButton": "illustrations",
"backButton": "Back",
"purposeDef": "Purposes",
"consentDef": "Consent",
"legIntPurposeDef": "Legitimate Interest",
"flexiblePurposeDef": "Flexible Purpose",
"specialPurposeDef": "Special Purpose",
"featureDef": "Features",
"specialFeatureDef": "Special Features",
"dataCategoriesDef" : "Data Categories",
"partnersLinkText": "our partners",
"relatedVendorsButton": "show related vendors",
"month": "month",
"day": "day",
"seconds": "seconds",
"hours": "hours"
},
"popup": {
"title": "We respect your privacy",
"content": "We and our partners use technologies, such as cookies, and process personal data, such as IP addresses and cookie identifiers, to personalise ads and content based on your interests, measure the performance of ads and content, and derive insights about the audiences who saw ads and content. Click below to consent to the use of this technology and the processing of your personal data for these purposes. You can change your mind and change your consent choices at any time by returning to this site.\n",
"purposeTitle": "We and our {total_number} partners:",
"specialPurposeTitle": "We need your consent for all the purposes above, but we have legitimate interest for these purposes:",
"featureTitle": "For some of the purposes above we and our partners:",
"specialFeatureTitle": "For some of the purposes above we and our partners:"
},
"purposes": {
"title": "Find out more about how your personal data is processed and set your preferences below.",
"content": "You can set your consent preferences and determine how you want your data to be used based on the purposes below. You may set your preferences for us independently from those of third-party partners. Each purpose has a description so that you know how we and partners use your data.",
"privacy_policy_text": "Check our privacy policies",
"privacy_policy_url": "https://ourcompany.com/privacypolicies"
},
"vendors": {
"title": "See the partners we work with below. Expend each one to see how they process your data.",
"content": "You can set consent preferences for individual third-party partners we work with below. Expand each company list item to see what purposes they use data for to help make your choices. In some cases, companies may use your data without asking for your consent, based on their legitimate interests. You can click on their privacy policy links for more information and to object to such processing.",
"privacyPolicyText": "Privacy Policy",
"legIntClaimTitle": "Legal policies",
"deviceStorageTitle": "Storage Type:",
"deviceStorageCookieLifetime": "Cookie lifetime: ",
"deviceStorageOther": "Others",
"deviceStorageCookies": "Cookies",
"googleVendorsDef" : "Google Ad Technology Providers",
"domainsDef" : "Domain list",
"IABVendorsDef" : "IAB TCF Vendors"
},
"others": {
"title_purpose": "Other categories EN",
"title_vendors": "Other vendors EN"
}
},
"texts_fr": {
"generic": {
"saveButton": "J'accepte",
"detailButton": "DĂ©tail",
"acceptAllButton": "Tout Accepter",
"refuseAllButton": "Tout Refuser",
"vendorButton": "Afficher les partenaires",
"purposeButton": "Afficher les finalités",
"legalButton": "Informations légales",
"illustationsButton": "illustrations",
"backButton": "Retour",
"purposeDef": "Finalités",
"consentDef": "Consentement",
"legIntPurposeDef": "Intérêts légitimes",
"flexiblePurposeDef": "Finalités flexibles",
"specialPurposeDef": "Finalités spéciales",
"featureDef": "Fonctionnalités",
"specialFeatureDef": "Fonctionnalités spéciales",
"dataCategoriesDef" : "Categories de Data",
"partnersLinkText": "nos partenaires",
"relatedVendorsButton": "Voir les partenaires",
"month": "mois",
"day": "jours",
"seconds": "secondes",
"hours": "heures"
},
"popup": {
"title": "Le respect de votre vie privée est notre priorité",
"content": "Nous et nos {total_number} partenaires pouvons stocker et/ou accéder à des informations sur un terminal, sélectionner des publicités standard, créer un profil personnalisé de publicités, sélectionner des publicités personnalisées, mesurer la performance des publicités, mesurer la performance du contenu, exploiter des études de marché afin de générer des données d’audience, développer et améliorer les produits, créer un profil pour afficher un contenu personnalisé, sélectionner du contenu personnalisé, mesurer la performance des publicités, exploiter des études de marché afin de générer des données d’audience, développer et améliorer les produits, sélectionner des publicités standard, mesurer la performance du contenu, créer un profil personnalisé de publicités, sélectionner des publicités personnalisées, créer un profil pour afficher un contenu personnalisé, sélectionner du contenu personnalisé. Ces technologies peuvent traiter des données personnelles comme l'adresse IP et les données de navigation pour assurer la sécurité, prévenir la fraude et déboguer, diffuser techniquement les publicités ou le contenu. Elles peuvent mettre en correspondance et combiner des sources de données hors ligne, recevoir et utiliser des caractéristiques d’identification d’appareil envoyées automatiquement, relier différents terminaux. Elles peuvent analyser activement les caractéristiques du terminal pour l’identification, utiliser des données de géolocalisation précises.\n",
"purposeTitle": "Gérer vos préférences",
"specialPurposeTitle": "GĂ©rer vos special purposes",
"featureTitle": "GĂ©rer vos features ",
"specialFeatureTitle": "GĂ©rer vos specialFeatures"
},
"purposes": {
"title": "Gérer vos préférences P",
"content": "Nos partenaires P et nous déposons des cookies afin d'assurer la sécurité, améliorer votre expérience digitale et afficher des publicités et contenus personnalisés Vous pouvez accepter ou refuser ces différentes opérations.",
"privacy_policy_text": "Notre politique de confidentialitée",
"privacy_policy_url": "https://ourcompany.com/privacypolicies"
},
"vendors": {
"title": "Gérer vos préférences V",
"content": "Nos partenaires V et nous déposons des cookies afin d'assurer la sécurité, améliorer votre expérience digitale et afficher des publicités et contenus personnalisés Vous pouvez accepter ou refuser ces différentes opérations.",
"privacyPolicyText": "Politique de confidentialité",
"deviceStorageTitle": "Type de stockage:",
"legIntClaimTitle": "Legal policies"
"deviceStorageCookieLifetime": "Durée du cookie: ",
"deviceStorageOther": "Autres",
"deviceStorageCookies": "Cookies",
"googleVendorsDef" : "Partenaires Google Ad Technology",
"domainsDef" : "liste des domaines utilisés",
"IABVendorsDef" : "liste des partenaires IAB"
},
"others": {
"title_purpose": "Other categories FR",
"title_vendors": "Other vendors FR"
}
},
"categories": [{
"name": "Statistics",
"ID": "1",
/* Ajouter "isMandatory": "true" pour bloquer la category sur ON
If you are using sub-categories, only sub can be marked as mandatories */
"isMandatory": "true",
"related_vendors": [1],
"description": "These cookies allow us analyze user behavior on the site, measure and improve performance and the quality of our service."
},
{
"name": "Advertising",
"ID": "2",
"related_vendors": [2],
"description": "These cookies allow us display adverts matching your interests on the websites you visit."
},
{
"name": "Big category",
"ID": "30",
"description": "Here you can select the vendors.",
"subcategories": [{
"name": "GA",
"ID": "31",
"description": "Should we send information to GA."
},
{
"name": "Xiti",
"ID": "32",
"description": "Should we send information to AT Internet."
},
{
"name": "Vendor3",
"ID": "33",
"related_vendors": [1, 2],
"description": "Should we send information to this vendor3."
}
]
}
],
"vendors": [{ /* list here all the not IAB Vendors */
"name": "Commanders Act",
"ID": "1",
"description": "Allow Commanders Act",
"privacy_policy": "http://commandersact.com/privacypolicy"
},
{
"name": "Another non IAB Vendor",
"ID": "2",
"description": "The desc of another vendor",
"privacy_policy": "http://anothervendor.free.fr/privacypolicy"
}
],
"categories_fr": [{
"name": "Statistiques",
"ID": "1",
"related_vendors": [1],
"description": "Avec cette catégorie on remonte les stats."
},
{
"name": "Pub",
"ID": "2",
"related_vendors": [2],
"description": "Pour afficher de superbes pubs personalisées"
},
{
"name": "Super cat",
"ID": "30",
"description": "Une super cat.",
"subcategories": [{
"name": "Sous cat 1",
"ID": "31",
"description": "Mais on peut choisir que cette sous cat."
},
{
"name": "Sous cat 2",
"ID": "32",
"description": "Ou alors uniquement celle-ci."
},
{
"name": "Sous cat 3",
"ID": "33",
"related_vendors": [1, 2],
"description": "Ou plus en fait, mais la 3 c'est pareil."
}
]
}
],
"vendors_fr": [{
"name": "Commanders Act",
"ID": "1",
"description": "Permettre Ă Commanders Act d'envoyer des informations",
"privacy_policy": "http://commandersact.com/privacypolicy"
},
{
"name": "Autre Vendors",
"ID": "2",
"description": "Permettre Ă cet autre vendor d'envoyer pleins d'informations",
"privacy_policy": "http://anothervendor.free.fr/privacypolicy"
}
]
}