- TCF v2.1: We will continue accepting TCF v2.1 strings, but encourage CMPs to follow IAB guidance on implementation milestones as the industry moves over to TCF v2.2.
- Google consent management solutions: Google consent management solutions, available in Ad Manager, AdSense and AdMob's Privacy & messaging tab, plans to support TCF v2.2 for its GDPR consent messages by early November, in alignment with the IAB's updated 20 November 2023 implementation deadline for CMPs.
Google will participate in the IAB Europe Transparency & Consent Framework v2.0 and comply with its Specifications and Policies. We'll begin reading and passing the TC string for all ad requests starting from when the IAB fully transitions from TCF v1.1 to v2.0. Until then, if a publisher deploys an IAB TCF v2.0 consent management platform (CMP), there will be no change in our existing ad serving behaviour (unless a publisher enables a beta; details to follow).
There are a few important implementation details that publishers should keep in mind if they choose to use the IAB TCF v2.0.
To integrate with the IAB TCF v2.0 a publisher must implement a TCF v2.0 registered CMP on their site. The CMP creates and sends the TC (Transparency & Consent) string. Then, Google’s ad tags and SDKs consume the TC string they receive from the CMP.
If you don't have consent for Google for Purpose 1 (Store and/or access information on a device), you should not call Google’s ad tag.
General guidance
If you have already implemented an IAB TCF v2.0 registered CMP on your site, AdSense will automatically begin consuming the TC string from the CMP without the need for re-configuration.
Any CMP vendor selections in your IAB TCF v2.0 registered CMP will override Ad Technology Provider selections in the EU user consent controls. This includes if you have selected to serve non-personalised ads for all EEA users via the EU user consent controls.
If you have set NPA in your ad request, we will look at that and the consent indicated by the TC string and apply the most conservative setting.
- Passing TC string to tags: GPT, GPT Passbacks, AdSense, and Ad Exchange tags will automatically communicate with the IAB CMP to forward the TC string to AdSense without publisher configuration. IMA SDK and mobile ads SDK will automatically obtain, parse and respect the TC string from within local storage. For other tag types you will need to pass the following signals manually:
gdpr={0,1}andgdpr_consent={tc string}. - Passing TC string to programmatic: The IAB TC string is automatically passed to Google’s programmatic channels without configuration required by publishers.
- Passing the TC string to non-programmatic creatives: Work with your creative provider to identify whether you need additional configuration for your creatives to ensure they consume the TC string correctly. AdSense offers support for the IAB TCF macros (
GDPRandGDPR_CONSENT_XXXX) to enable you to manually pass the TC string to other creative vendors as needed.
Consent policies: Personalised and non-personalised ads
As communicated in August 2019, our interoperability guidance is intended to reflect Google's existing policy requirements, in particular the requirements of Google's EU user consent policy and our policies against fingerprinting for identification (for example, those contained in our Requirements for third-party ad serving). Google’s policies continue to apply and are more restrictive than TCF v2.0 in some cases.
Publishers should review the registration settings for the vendors that they choose to work with via the TCF v2.0. The following requirements apply specifically when Google is a vendor in the publishers’ CMP.
Google will serve personalised ads when all of the following criteria are met:
- The end user grants Google consent to:
- Store and/or access information on a device (Purpose 1)
- Create a personalised ads profile (Purposes 3)
- Select personalised ads (Purposes 4)
- Legitimate interest (or consent, where a publisher configures their CMP to request it) is established for Google to:
- Select basic ads (Purpose 2)
- Measure ad performance (Purpose 7)
- Apply market research to generate audience insights (Purpose 9)
- Develop and improve products (Purpose 10)
If the consent requirements for personalised ads are not met, Google will serve non-personalised ads when all of the following criteria are met:
- The end user grants Google consent to:
- Store and/or access information on a device (Purpose 1)
- Legitimate interest (or consent, where a publisher configures their CMP to request it) is established for Google to:
- Select basic ads (Purpose 2)
- Measure ad performance (Purpose 7)
- Apply market research to generate audience insights (Purpose 9)
- Develop and improve products (Purpose 10)
We will handle the following scenarios according to the table below:
| Description | Ad serving behaviour |
|---|---|
|
Lack of consent for Google to store and/or access information on a device (Purpose 1) In line with our existing EU user consent policy, consent for cookies or mobile identifiers is required for both personalised and non-personalised ads. For non-personalised ads, consent for cookies or mobile identifiers is still required because non-personalised ads still use cookies or mobile identifiers to combat fraud and abuse, for frequency capping, and for aggregated ad reporting. |
Publishers should not call Google’s ad tags. If consent is missing for Google for Purpose 1 in the TC string, Google will drop the ad request and no ads will be served. |
|
Lack of consent for Search Ads publisher products (AdSense for Search, Adsense for Shopping and Programmable Search Engine) to apply market research to generate audience insights (Purpose 9) Search Ads publisher products do not require consent for Purpose 9. |
Search Ads publisher products may serve ads if consent is obtained for the other required purposes. |
|
Global scope and out-of-band scope Per our existing EU user consent policy, you must clearly identify each party that may collect, receive or use end users’ personal data as a consequence of your use of a Google product. Learn more about Scope of Legal Basis |
Because it is infeasible to clearly identify each party when using global scope, we do not support it. During the transition period that starts when we begin reading and passing the TC string for all ad requests, we will serve non-personalised ads to allow publishers to make adjustments. After the three-month transition period, we will not serve an ad if the TC string indicates 'Out-of-band' or 'Global scope'. |
|
Invalid TC string The TC string is not parseable (for example, some fields are missing). |
During the transition period that starts when we begin reading and passing the TC string for all ad requests that we will serve non-personalised ads to allow publishers to make adjustments. After the three-month transition period, we will not serve an ad if the TC string is invalid. |
Flexible vendor registration & publisher restrictions
TCF v2.0 affords publishers the ability to customise a variety of restrictions. These allow publishers to indicate their own preferences, which will take precedence over a vendor’s preferences, where applicable. Publishers can never cause a vendor to operate under a lawful basis or for a purpose which conflicts with the vendor’s Global Vendor List registration. Hence these are termed restrictions in that they never expand the scope of what a vendor can do but only restrict it.
Publishers should review the registration settings for the vendors that they choose to work with via the TCF v2.0. If a vendor has registered flexibly with 'legitimate interest' as the default lawful basis for a purpose where Google requires 'consent' per our interoperability guidance, if a publisher wants to work with that vendor via Google products they should choose consent for that vendor in the publisher restrictions of their CMP.
Google is flexibly registered for purposes 2, 5, 6, 7, 9 and 10 and defaults to legitimate interest. Unless a publisher configures their CMP to restrict Google to consent for these purposes, Google will rely on legitimate interest where the CMP has established it with the user. Google isn't flexibly registered for purposes 1, 3 and 4 and always requires consent for these purposes.
Scope of Legal Basis
The IAB TCF v2.0 provides options for publishers to choose the scope of a Legal Basis for the processing of personal data as outlined below. This information is passed using the TC string. Google policies require that publishers choose either (a) service-specific scope or (b) group-specific scope.
- Service-specific scope: A legal basis is applicable only on the service, for example a publisher website, on which the legal basis is obtained and managed. (ALLOWED when working with Google)
- Group-specific scope: A Legal Basis is applicable only on a pre-defined group of services, for example a number of digital properties of one or more publishers that implement CMPs with their group’s scope, each of which allows users to manage their choices regarding Legal Basis established for the group across all the services of the group. All component digital properties must be disclosed at the consent moment. (ALLOWED when working with Google)
- Global scope: A Legal Basis is not only applicable on the service on which the Legal Basis is obtained and managed, but across all publisher digital properties, that implement CMPs with global scope each of which allows users to manage their choices regarding globally established Legal Bases across all such publisher digital properties. (NOT ALLOWED when working with Google)
- Out-of-band (“OOB”): A Legal Basis has not been established using the framework and is therefore not reflected in any signals within the framework and cannot be managed by users within the framework. (NOT ALLOWED when working with Google)
Publishers should choose service-specific (or group-specific) scope if they want to work with Google.
Real-time bidding (RTB) & Open Bidding
The IAB TCF v2.0 logic will apply to bid requests, bid responses and creatives, and cookie-matching requests.
We will allow bid requests to be sent and enable cookie matching when a vendor registers with 'Consent' or, in limited cases, 'Not used' for Ad Personalisation (Purposes 3 and 4 in the TC string). Vendors that register for 'Consent' for the Personalised Ad purposes (Purposes 3 and 4 in the TC string), but have not been granted consent by the user:
- Won’t receive bid requests.
- Won’t receive a response to cookie match requests.
- Won’t be allowed to win an auction. Google will block creatives that have vendors that do not meet our policy requirements from winning auctions or serving ads.
Additionally, the user must have given Google consent for Purpose 1, Purpose 3 and Purpose 4.
