On 21 August, 2019, IAB Europe and the IAB Tech Lab announced the version 2.0 of the Transparency & Consent Framework (TCFv2.0, hereinafter referred to simply as TCF in this document). It’s a policy that enables companies operating in the EU law area to streamline their GDPR compliance initiatives within the programmatic advertising ecosystem.
| Table of Contents |
|---|
Integration of TCF by your publishers
According to TCF guidelines, publishers use a consent layer provided by Consent Management Platforms (CMP) to obtain the visitor's consent for their personal data.
It can be specified differentially for various purposes (purposes) and vendors (data processors). The consent itself is represented as a “consent string”, which has a standardised format and can be interpreted by the TCF vendors. When a vendor receives it together with the other data, it has to decide whether and what type of data processing or forwarding was allowed by the end user.
Users consent is submitted by the publishers CMP via passing the TC String in the tracking URL view or click tags. When a creative is rendered, the src address of <img> html-tag is sent by the browser via HTTP GET request to Ingenious Server. Also when user clicks on this creative, click request is also sent to Ingenious tracking server.
In terms of TCF, the only instance able and allowed to generate consent strings is the Consent Management Platform (CMP). The publisher has two ways to implement a CMP functionality:
Build: Develop an in-house CMP and register it as internal CMP on IAB Europe and
Buy/Outsource: use a external CMP service registered with IAB Europe.
Signalling by Publisher’s CMP
To work as TCF publisher with Ingenious customers, partner have the publisher’s CMP has to provide the consent signal by setting values of parameters gdpr and gdpr_consent in the tracking URLview and click tags.
TCF can be activated on platform level
and then
...
publishers can activate it for particular ad spaces
...
If both platform and ad space have activated TCF, Ingenious suggest shows parameters for TCF signalling and macros to the advertiser's On-Page Tracking Code and to Creatives Tracking Code on publisher's side.
Note: tracking codes Creatives Manager in the Partner UI.
| Info |
|---|
Tracking tags already built in to partners or advertisers system are not replaced automatically when TCF is activated or deactivates. |
Macros
The supported URL parameters and the corresponding macros should be added only once and are defined below:
URL parameter | Corresponding Macro | Representation in URL |
|---|---|---|
|
|
|
|
|
|
XXXXX means here the numeric Vendor ID. E.g. &gdpr_consent=${GDPR_CONSENT_123} for Vendor ID 123.
Values to fill in the macros:
Macro | possible values | purpose |
|---|---|---|
|
|
|
| URL-safe base64-encoded Transparency & Consent string. | Only meaningful if Encodes the TC string, as obtained from the CMP JS API or OpenRTB |
...
If the URL contains another URL to use for redirect to the next vendor in the supply chain and use same method for TCF signalling, the redirect URL in the trg parameter should be URL encoded after adding of TCF params for the next vendor.
Vendor Registration
The registered Vendor ID of Ingenious Technologies is: 871
In order to register on IAB TCF v2.0 Global Vendor List (GVL) we claimed Purposes, Special Purposes, Features and Special Features described in https://iabeurope.eu/iab-europe-transparency-consent-framework-policies/, see “Appendix A: Purposes and Features Definitions”. The lawful bases could be chosen as Consent, Legitimate Interests or Flexible. Wherever we specified Legitimate Interest or Flexible as lawful basis, the Legitimate Interests is documented in our Privacy Policy https://www.ingenioustechnologies.com/privacy-policy/.
...
ID
...
Purpose Name
...
Allowable Lawful Basis
...
Ingenious Choice
...
P1
...
Store and/or access information on a device
...
Consent
...
Consent
...
P7
...
Measure ad performance
...
Consent, Legitimate Interests
...
Flexible (both is possible)
...
ID
...
Special Purpose Name
...
Allowable Lawful Basis
...
Ingenious Choice
...
SP1
...
Ensure security, prevent fraud, and debug
...
Legitimate Interests
...
Legitimate Interests
...
SP2
...
Technically deliver ads or content
...
Legitimate Interests
...
Legitimate Interests
...
ID
...
Feature Name
...
Ingenious Choice
...
F1
...
Match and combine offline data sources.
...
No
...
F2
...
Link different devices
...
Yes
...
F3
...
Receive and use automatically-sent device characteristics for identification
...
Yes
...
ID
...
Special Feature Name
...
Ingenious Choice
...
SF1
...
Use precise geolocation data
...
No
...
SF2
...
Actively scan device characteristics for identification
...
No
...
The current Vendor List can be accessed under https://iabeurope.eu/vendor-list-tcf-v2-0/
Example
The resulting URL in the tracking codes on the partner side looks like:http://trackignurl.com/amc=a.b.c.d&gdpr=1&gdpr_consent=${GDPR_CONSENT_123}
Partner's task is to replace these macros with the appropriate values described in the table below. For macro ${GDPR_CONSENT_XXXXX}, publisher must also check that the ID in the macro name is a valid Vendor ID. TC Strings must always be propagated as received from CMP without modification.
In example, if the TC String is: COvFyGBOvFyGBAbAAAENAPCAAOAAAAAAAAAAAEEUACCKAAA.IFoEUQQgAIQwgIwQABAEAAAAOIAACAIAAAAQAIAgEAACEAAAAAgAQBAAAAAAAGBAAgAAAAAAAFAAECAAAgAAQARAEQAAAAAJAAIAAgAAAYQEAAAQmAgBC3ZAYzUw
then the partner’s logic should replace the macro in the URL with the actual TC String so that the URL originally containing the macro is modified as follows when making the call to Ingenios Tracking:http://trackignurl.com/amc=a.b.c.d&gdpr=1&gdpr_consent=COvFyGBOvFyGBAbAAAENAPCAAOAAAAAAAAAAAEEUACCKAAA.IFoEUQQgAIQwgIwQABAEAAAAOIAACAIAAAAQAIAgEAACEAAAAAgAQBAAAAAAAGBAAgAAAAAAAFAAECAAAgAAQARAEQAAAAAJAAIAAgAAAYQEAAAQmAgBC3ZAYzUw
TCF settings on platform level
TCF can be enabled on platform level by our Customer Success. It is possible to choose own TCFv2.0 vendor ID or use Ingenious Vendor ID. This vendor ID is used for TCF macros in tracking links provided to partners in ad media code.
TCF settings on ad space level
When the platform has the TCF functionality activated, partners can control the TCF logic on ad space level.
There are three modes of TCF logic which can be set for the ad space
Inactive mode- This means that TCF macros are neither added to tracking links nor is tracking traffic treated restrictively. There is no TCFv2.0 based filtering for this ad space.
Setup mode without traffic restrictions - TCF macros appear in the ad media tracking links and can be used for setup and testing. Tracking system interprets and stores the TCF signals but there aren’t any restrictions in the request data storage and processing.
Restrictive mode - Ad media tracking links are generated containing macros for TCF. If GDPR applies and there is no sufficient consent, our system will restrict the amount of stored and processed request information according to purposes enabled by enduser.
Inactive Mode
If the platform operator has activated TCF functionality for the platform, the partner will be able to configure TCF mode on the ad space edit page.
The initial TCF mode is set to “Inactive mode” and does not change the default behaviour. This means that neither TCF macros are attached to the tracking links for creatives delivered through this ad space, nor is tracking traffic restricted. No tracking requests based on TCF consensus will be restricted.
Attention: Even if the partner sends reasonable filled GDPR parameters with a request, request processing will not be affected. It is necessary that the option must be set to “Restrictive mode” if requests are to be restricted based on TCF.
Setup mode
If setup mode is activated for the ad space, TCF params (s. Macros ) appear in ad media tracking code and product data feed urls. Partner is to properly obtain and set these params by obtaining the TC String from his CMP.
The parameter &gdpr_consent=${GDPR_CONSENT_XXXXX} contains the vendor id the consent String has to contain the consent for. We interpret the TCF parameters and pass them along with the request for diagnostics. The TCF params are also forwarded on redirects.
In the setup mode we don’t restrict the way we store and process the actual request.
Restrictive mode
IMPORTANT!
Before partner enablies restrictive mode it is required, that their Consent Management Platform is set up to obtain user consent for the Vendor IDs configured in your platform TCF settings. By default it is the Vendor ID 871 of Ingenious Technologies AG. If your platform is configured to use custom vendor ID, please inform partners about it.
If restrictive mode is not activated, both parameters gdpr and gdpr_consent are not applied during the tracking request processing.
In restrictive mode, we restrict the request handling in accordance to TCF policies and TCF features enabled for the given vendor id in the submitted consent string.
Parameter gdpr
If no value is provided, geoIP lookup takes place and GDPR applies for EU IP addresses.
If the parameter is set to 0 GDPR does not apply to request handling
If the parameter is set to 1, GDPR applies and we handle request in restrictive way
Parameter gdpr_consent (consent string)
A valid consent string Is compulsory when GDPR applies. Following restrictions are applied if we don’t encounter users consent for the purposes.
...
No consent on Purpose 1 - don’t create new cookies, ignore existing cookies
...
Applied rules for TCF parameters
Parameter gdpr
If no value is provided, geoIP lookup takes place and GDPR applies for EU IP addresses.
If the parameter is set to 0 GDPR does not apply to request handling
If the parameter is set to 1, GDPR applies and we handle request in restrictive way
Parameter gdpr_consent (consent string)
A valid consent string Is compulsory when GDPR applies. Following restrictions are applied if we don’t encounter users consent for the purposes.
No consent on Purpose 1 - don’t create new cookies, ignore existing cookies
No consent on Purpose 7 - don’t process given tracking request (optout)
Nested calls and redirects
If the URL contains another URL to use for redirect to the next vendor in the supply chain and use same method for TCF signalling, the redirect URL in the trg parameter should be URL encoded after adding of TCF params for the next vendor.
Example
The resulting URL in the tracking tags on the partner side looks like:http://trackignurl.com/amc=a.b.c.d&gdpr=1&gdpr_consent=${GDPR_CONSENT_123}
Partner's task is to replace these macros with the appropriate values described in the table below. For macro ${GDPR_CONSENT_XXXXX}, publisher must also check that the ID in the macro name is a valid Vendor ID. TC Strings must always be propagated as received from CMP without modification.
In example, if the TC String is: COvFyGBOvFyGBAbAAAENAPCAAOAAAAAAAAAAAEEUACCKAAA.IFoEUQQgAIQwgIwQABAEAAAAOIAACAIAAAAQAIAgEAACEAAAAAgAQBAAAAAAAGBAAgAAAAAAAFAAECAAAgAAQARAEQAAAAAJAAIAAgAAAYQEAAAQmAgBC3ZAYzUw
then the partner’s logic should replace the macro in the URL with the actual TC String so that the URL originally containing the macro is modified as follows when making the call to Ingenios Tracking:http://trackignurl.com/amc=a.b.c.d&gdpr=1&gdpr_consent=COvFyGBOvFyGBAbAAAENAPCAAOAAAAAAAAAAAEEUACCKAAA.IFoEUQQgAIQwgIwQABAEAAAAOIAACAIAAAAQAIAgEAACEAAAAAgAQBAAAAAAAGBAAgAAAAAAAFAAECAAAgAAQARAEQAAAAAJAAIAAgAAAYQEAAAQmAgBC3ZAYzUw
TCF settings on platform level
TCF can be enabled on platform level by our Customer Success. It is possible to choose own TCFv2.0 vendor ID or use Ingenious Vendor ID. This vendor ID is used for TCF macros in tracking links provided to partners in ad media code.
TCF settings on ad space level
When the platform has the TCF functionality activated, partners can control the TCF logic on ad space level.
There are three modes of TCF logic which can be set for the ad space
Inactive mode: This means that TCF macros are neither added to tracking links nor is tracking traffic treated restrictively. There is no TCFv2.0 based filtering for this ad space.
Setup mode without traffic restrictions: TCF macros appear in the ad media tracking links and can be used for setup and testing. Tracking system interprets and stores the TCF signals but there aren’t any restrictions in the request data storage and processing.
Restrictive mode: Ad media tracking links are generated containing macros for TCF. If GDPR applies and there is no sufficient consent, our system will restrict the amount of stored and processed request information according to purposes enabled by enduser.
Inactive Mode
If the platform operator has activated TCF functionality for the platform, the partner will be able to configure TCF mode on the ad space edit page.
The initial TCF mode is set to “Inactive mode” and does not change the default behaviour. This means that neither TCF macros are attached to the tracking links for creatives delivered through this ad space, nor is tracking traffic restricted. No tracking requests based on TCF consensus will be restricted.
| Note |
|---|
Attention: Even if the partner sends reasonable filled GDPR parameters with a request, request processing will not be affected. It is necessary that the option must be set to “Restrictive mode” if requests are to be restricted based on TCF. |
Setup mode
If setup mode is activated for the ad space, TCF params (s. Macros) appear in ad media tracking tag and product data feed urls. Partner is to properly obtain and set these params by obtaining the TC String from his CMP.
The parameter &gdpr_consent=${GDPR_CONSENT_XXXXX} contains the vendor id the consent String has to contain the consent for. We interpret the TCF parameters and pass them along with the request for diagnostics. The TCF params are also forwarded on redirects.
In the setup mode we don’t restrict the way we store and process the actual request.
Restrictive mode
| Note |
|---|
IMPORTANT! |
| Info |
|---|
If restrictive mode is not activated, both parameters gdpr and gdpr_consent are not applied during the tracking request processing. |
In restrictive mode, we restrict the request handling in accordance to TCF policies and TCF features enabled for the given vendor id in the submitted consent string.
Validation of TCF settings
Both Setup and Restrictive modes can be validated using tracking preview mode (Tracking Preview Mode )
Example:
Wenn calling a click code with following parameters appended
...&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_871}&preview_mode=1
the response JSON object will contain the following error information
"error" : { "code" : 401 , "reason" : "TCF2MissingTCString"}
Vendor Registration
The registered Vendor ID of Ingenious Technologies is: 871
In order to register on IAB TCF v2.0 Global Vendor List (GVL) we claimed Purposes, Special Purposes, Features and Special Features described in https://iabeurope.eu/iab-europe-transparency-consent-framework-policies/ , see “Appendix A: Purposes and Features Definitions”. The lawful bases could be chosen as Consent, Legitimate Interests or Flexible. Wherever we specified Legitimate Interest or Flexible as lawful basis, the Legitimate Interests is documented in our Privacy Policy https://www.ingenioustechnologies.com/privacy-policy/.
ID | Purpose Name | Allowable Lawful Basis | Ingenious Choice |
|---|---|---|---|
P1 | Store and/or access information on a device | Consent | Consent |
P7 | Measure ad performance | Consent, Legitimate Interests | Flexible (both is possible) |
ID | Special Purpose Name | Allowable Lawful Basis | Ingenious Choice |
|---|---|---|---|
SP1 | Ensure security, prevent fraud, and debug | Legitimate Interests | Legitimate Interests |
SP2 | Technically deliver ads or content | Legitimate Interests | Legitimate Interests |
ID | Feature Name | Ingenious Choice |
|---|---|---|
F1 | Match and combine offline data sources. | No |
F2 | Link different devices | Yes |
F3 | Receive and use automatically-sent device characteristics for identification | Yes |
ID | Special Feature Name | Ingenious Choice |
|---|---|---|
SF1 | Use precise geolocation data | No |
SF2 | Actively scan device characteristics for identification | No |
If there is a need for different set of TCF purposes and features, custom Vendor IDs can be set on Platform level by our Customer Success.
The current Vendor List can be accessed under https://iabeurope.eu/vendor-list-tcf-v2-0/
Common Infos about TCFv2.0
...