Following an inclement few months, which included the Information Commissioner's Office (ICO) releasing its Update Report into Ad Tech and Real-Time Bidding, IAB Europe has released the second iteration of the Transparency & Consent Framework (TCF).

Notably, Google has announced that it will be integrating with the framework, with completion expected by the close of Q1 2020. To determine the potential impact of the updated policies, ExchangeWire spoke to various stakeholders to ascertain the benefits associated with adopting TCF v2.0, how the framework helps to protect consumer privacy, and what future steps can be taken to champion user rights whilst maintaining income from advertising spend.

TCF v2.0 demonstrates that we can achieve cross-industry change

The latest iteration of the Transparency and Consent Framework will deliver greater consumer control, while also evolving the industry’s compliance with privacy principles. This could not be more timely given the recent ‘Adtech Update Report’ released by the ICO.

With the ICO expressing concerns about knowledge and understanding of GDPR and ePrivacy requirements by companies involved in RTB, it is crucial that UK digital ad players review their current practice to ensure that they are operating in line with the law.

The TCF v2.0 is central to this. It’s the only cross-industry initiative of its kind and the most likely approach to effect real change across the digital ad ecosystem when it comes to meeting transparency and consent requirements. With the ICO making clear that it will not hesitate to take regulatory action if its concerns are not satisfactorily addressed, TCF v2.0 has a key role to play in helping to demonstrate that we can deliver cross-industry change.

The latest TCF release includes significant improvements for consumers – for example, people will have more granular control over the processing of their data and can exercise their ‘right to object’ – but it’s important to point out that it is not a silver bullet when it comes to privacy concerns; the issues in the ICO’s report go beyond what is covered by the TCF. The framework will, however, continue to evolve and adapt based on feedback from the ICO and other regulators, allowing it to change with our dynamic industry.

It’s in all of our interests for companies in the digital advertising sector that process personal data to implement TCF v2.0 – from advertisers and media owners to agencies and ad tech companies. Not only does it help to ensure that individual companies are functioning on the right side of the law, it also helps to build a responsible, self-regulated and sustainable digital ad industry.

Jon Mew, CEO, IAB UK

Consent can be established for the European digital supply chain

TCF v2.0 represents a mature and good faith effort to reconcile the often conflicting requirements of GDPR and ePrivacy and has placed the industry at the discussion table with regulators. It appears that consent CAN be established for the digital media supply chain in Europe. Going forward, the industry will need to establish consistency for consent implementations, and will also need to address related areas of regulatory concern that TCF v2.0 has not been chartered with solving, including the handling of special category data, an over-reliance on legitimate interest, and the safeguarding of personal data across the programmatic exchange environment.

These are significant challenges and further changes will no doubt be necessary. But rapid and consistent adoption of TCF v2.0 will be an essential part of any good news story the industry is able to tell in 2020.

Colin O'Malley, founder, The Lucid Privacy Group

Clarification, flexibility, and control

In general, TCF v2.0 better serves each stakeholder by clarifying key aspects of the framework that had been criticised in v1 (purposes, features and stacks). It gives more flexibility and control to publishers which can now determine for each vendor that they select what legal basis are authorised on their websites. TCF v2.0 is a technically nimbler way to circulate consent information between vendors by giving more depth to the information that can be passed along the chain via the Transparency and Consent string.

TCF v2.0 gives internet users a better picture of what is going to happen with their personal data. End users will have the ability to access more and better information in a way that is more understandable: the notion of stacks corresponds to a more progressive access to the information which ensures that most users will not be interrupted with massive amount of legal jargon while other interested users are always able to access granular information. TCF v2.0 also reinforces user control over their data by facilitating the ability to oppose to specific vendors regardless of the legal basis they’re using.

TCF v2.0 also incorporates feedback received from various data protection authorities. In particular it establishes more specific purposes for advertising data processing. This allows for a clearer description of purposes that will be easier to understand. All in all it is a good step towards a valid GDPR consent for the industry.

The advertising ecosystem cannot operate without a standard way to communicate user choices between stakeholder. The TCF is already the most widely adopted consent standard out there. If Consent Management Platforms correctly do their work product-wise, TCF v2.0 will definitely become the best way forward for any stakeholder belonging to the advertising ecosystem, from advertisers to publishers.

There are still a lot of things that can be improved. An ideal future version of the TCF would allow sufficient and revocable cryptographic protection to user personal data. This would effectively guarantee that no personal data is accessed by a third party without a valid consent.

Romain Gauthier, CEO & co-founder, Didomi

Making a compelling case for advertising’s benefit to consumers

As an industry, we need to make a compelling case for the benefits we bring to consumers. To do this, we need to show we are working together to address their concerns about data protection, and this is why robust, industry-wide standards are so important.

Consumers and regulators are concerned about accountability, and the Transparency and Consent Framework gives us an important way to deliver a key piece of that accountability: the ability to demonstrate that the consumer was given appropriate notice and choice with respect to the various purposes for which their personal data may be processed, and by whom.

TCF v2.0 has taken on board regulatory and consumer feedback and improved on V1 in several key ways to give consumers more control over their data. Importantly, it also helps encourage as many companies as possible to align around a single standard and is now gaining critical mass in the industry.

We want to work with regulators to address their concerns and we believe TCF v2.0 is well placed to play a central role in this.

Alice Lincoln, SVP data policy & governance, MediaMath

New framework marks an important milestone for the industry

The TCF v2.0 is an important milestone for the digital advertising industry. The new version includes several much-needed features that improve control for publishers and enhance transparency to users. These improvements include more clearly defined purposes, publisher vendor restrictions, the ability to define legitimate interest as a legal basis, and support for out-of-band legal basis (which is when consent is achieved outside of the TCF). There are also a number of technical enhancements that make the TCF v2.0 more robust to integrate with.

As an industry, it’s important that we all support the new version and take advantage of its improvements. By coming together and adopting the same framework for managing user consent, we ensure that digital advertising respects users’ privacy and remains a viable way to support publishers’ businesses.

Scott Menzer, co-founder and VP, product & operations, ID5

Broad collaborative approach supporting business and consumers

Eighteen months is a long time in today’s fast-changing data privacy landscape. Since the introduction of GDPR on May 25 of 2018, we’ve benefited from the perspectives of consumers, regulators, the courts, and the industry. That’s why version two of the IAB Europe’s Transparency and Consent Framework (TCF) provides even greater control for publishers over vendors and data processing purposes, transparency requirements and legitimate interest, and more granular disclosures to consumers. In addition, consent management platforms (CMPs) now have the ability to capture, store and signal a user’s right to object in addition to consent choices.

The TCF v2.0 was created with input from all corners of the digital ecosystem. This broad, collaborative approach has generated a framework that supports a wide range of publisher business models while benefiting consumer data protection through more transparency and choice.

Ari Levenfeld, chief privacy officer, Quantcast

Industry needs to continue showing transparency

There is a range of benefits for all parties within the advertising ecosystem. For consumers, the biggest benefits of TCF v2.0 are increased transparency and more detailed choices for how companies use and share their data. From a high level, it provides publishers with greater control, while also providing them a technical solution for how to collect and transfer personal data for digital advertising.

The implementation of the framework does not guarantee that the processing procedures of the participants are compliant. It’s a standardised, technical solution that makes it easier for participants to comply with the first steps of data collection for certain advertising activities (and signal that information to partners approved by the consumer). In terms of the benefits to consumers, it offers a unified solution (Google will also join) in which they will receive full transparency and choice across the ecosystem.

Once the framework is implemented across supply, demand, and ad tech vendors, everyone can get back to focusing on their business and providing privacy-compliant solutions, as opposed to juggling different standards. This is motivation enough.

It’s important to stay in communication with the data protection authorities and other industry players, in order to continue developing technical solutions that fit not only the EEA but other privacy regulations around the world. But as an industry, we also need to continue to show transparency with regards to how digital advertising works, so we can continue to gain (and keep) the trust of consumers. Lastly, it’s important to continue educating consumers on the value of personalised advertising.

Arndt Groth, CEO, Smaato

Speaking the same language

The primary benefit of the TCF v2.0 is that it is the only industry framework which allows, to those who have adopted it, to speak the same ‘GDPR language’ by adhering to the standard signals and TCF policies. Furthermore, it helps publishers and advertisers, as owners of digital properties, to build user trust by being transparent about their relationship with third party vendors, users to exercise their choice over data processing purposes and vendors, and vendors to have legal certainty as the data processing purpose language is standardised across many digital properties implementing the TCF. Without frameworks such as the TCF, every company, publisher, vendor or advertiser, would be left to fend for itself, and would have to invest even more resources to reconcile different purposes and obligations across many websites.

TCF v2.0 is rightfully considered to be a user and publisher version. Users will now be able to exercise very granular choices over 10 data processing purposes AND they will have specific control over how they are sharing their precise geolocation data and if they are allowing active fingerprinting of their devices. They will also be able to object to data processing in case vendors are relying on legitimate interest. Publishers, on the other hand, will have more control over how their partner vendors process data as TCF v2.0 allows publishers to signal their permissions, per purpose, to vendors.

Main challenge of the TCF v2.0, and generally speaking of any privacy-related effort, is communicating complex terms to users, and complying with the transparency requirements of the law in a limited space of a mobile phone screen. GDPR is supposed to raise awareness about privacy among users, and not numb them. Hence, designing effective and good user interfaces is of paramount importance, and our current and future greatest challenge.

Stevan Randjelovic, brand safety manager, GroupM EMEA

Building a sustainable and efficient solution for best practice operators

Several of Comscore’s publisher clients have opted to build their own, or contract with, a Consent Management Platform that integrates with the TCF. The TCF v2.0 therefore facilitates the collection of privacy signals for Comscore’s Audience and Advertising Measurement services.

This means that publishers now have a choice to use the TCF, or use our specifically adapted javascript tags for the collection of consent signal for syndicated measurement services.

For Comscore’s Audience and Advertising Measurement solutions TCF v2.0 enables a standardized and distributed network solution for a variety of Consent Management interfaces that European consumers can be shown when accessing online services. The TCF v2.0 provides a granular level of controls so the consumer can manage their privacy choices as they surf online.

Several publishers, consent management platforms and digital services vendors have aligned already to use the TCF v2.0 as a key solution for helping users manage privacy choices. The early adopters have demonstrated that the technical framework is functional to the design which should encourage more publishers that the solution is scalable. Further discussions with national privacy authorities to reassure the market that the framework is an appropriate and efficient solution to managing privacy compliance would encourage more publishers to adopt the framework over the long term.

The framework will continue to evolve, adding additional functionality in future versions to help manage privacy compliance on additional use cases. Cross-industry support for the roadmap, as well as support for governance of the framework, will help build a long term, sustainable and efficient solution for the best practice operators in the industry.

Stuart Wilkinson, head of industry relations EMEA, Comscore

Establishing user trust is a condition for the industry to survive

All the learnings from TCF v1.0 contributed to making v2.0 a much more mature framework, including feedback from the authorities. Thanks to these improvements, Google has committed to join, which is by far the most significant news coming with v2.0.

The TCF v2.0 iterates on the same principles of transparency and standardisation that inspired v1.0. It does it by introducing more granular purposes that users can customize their data processing from and makes the requirements for consent collection stricter, to the user’s benefit.

Pressure from advertisers to comply with the GDPR is leading vendors to request publishers to adopt the TCF. With Google joining, the TCF v2.0 is going to be the standard, meaning that publishers not adopting it will definitely have repercussions on their ad serving.

What’s even more important, though, is correct application of the TCF, as often websites that don’t work with any of the vendors adhering to the TCF wrongly adopt it. Other websites adopt it, but don’t follow the guidelines. This seriously undermines the trust of the framework – particularly when these deviations to the guidelines are sanctioned by the authorities – and is something the whole industry should vigilate over.

Right now the TCF only applies to the EU, causing a disparity both on user rights and on the capability for publishers to monetize their traffic. With Safari and Firefox banning third party trackers and the increased penetration of ad blockers, establishing user trust is becoming not just a requirement from regulators, but a condition for the industry to survive. And it might even be too late.

Andrea Giannangelo, CEO and head of product, iubenda

We have to go beyond simply complying with given standards and regulations

"The development of TCF v2.0 is a positive step towards providing greater transparency to consumers. The IAB has incorporated publisher feedback and the increased flexibility of the framework will surely encourage its adoption.

"To ensure user privacy and an enhanced consumer experience, however, the industry will need to take steps beyond simply complying with a given standard or regulation. It’s a matter of ensuring consumer preferences are preserved across media environments and geographies, and integrating those consent signals into a technology solution.

"Data with consent attached is simply better data, and not just from a privacy point of view. It’s inherently more effective when used to buy and sell advertising inventory. Media sellers and media buyers understand this, and the industry should come together to leverage consent to create better deals for all players."

Ben Barokas, founder & CEO, Sourcepoint

With the plethora of benefits available under TCF v2.0 as outlined above, Google set to adopt the framework by Q1 2020, and the ICO looking for meaningful engagement from the industry, this is the opportune time to adopt the framework. Registrations to join the TCF v2.0 are now being accepted and can be submitted here.