The focus on privacy and transparency is putting increasing pressure on those who regulate the digital world. The GDPR requires those who collect and process data from EU users to comply with several rules, including obtaining explicit and informed consent from users on the use of their personal information, under penalty of fines of up to €20 million or 4% of annual revenues.
However, it should be noted that the advertising industry’s challenge is not limited to obtaining users’ consent in compliance with regulations: it extends to distributing these preferences to all companies that are part of the digital advertising ecosystem, i.e., publishers, advertisers, and technology providers.
This is where the IAB’s Transparency and Consent Framework (TCF) comes into play, which was created to establish a standard for collecting and sharing user consent to the delivery of profiled content and ads online.
This framework enables website and app owners, advertisers, and tech companies to comply with the GDPR and ePrivacy Directive when processing personal data or accessing and/or storing information (cookies, ad identifiers, device identifiers and other tracking technologies) on a user’s device.
Released to the market ahead of the GDPR’s entry into force in May 2018, the TCF covers approximately 30% of the distribution of programmatic advertising within the European market and has now reached version 2.0, which completely replaced the previous version as of 15 August 2020. Version 2.0 introduces new features for both users and publishers.
By revising and making more granular data processing purposes, users can now make more informed choices about the processing of their data.
The number of processing purposes has increased from 5 to 10:
- To store and/or access information on a device.
- Select basic ads.
- Create a personalised ad profile.
- Select customised ads.
- Create a custom content profile.
- Select custom content.
- Evaluate ad performance.
- Evaluate content performance.
- Apply market research to generate audience insights.
- Develop and refine products.
To which two purposes have been added:
- Ensuring security, preventing fraud, and debugging
- Select customised content.
In addition, signals have been introduced obliging the Consent Management Platforms (CMP) to offer users the possibility to exercise their right to object to processing based on a legitimate interest directly via the user interface.