IAB TCF v2.4 Is Here. Your v2.2 Strings Expire in February.
If your consent management platform still writes TCF v2.2 strings, the clock has run out. TCF v2.3 became mandatory for all newly generated consent strings on February 28, 2026, and legacy v2.2 strings stop working after February 1, 2026. The framework moved twice while many publishers were still reading about the first move.
What v2.2 changed, and why it still matters
TCF v2.2 was released in May 2023 as an update to v2.1, and it made one change that reshaped the whole framework: it removed legitimate interest as a legal basis for advertising and content personalization. Vendors can now only use consent for purposes 3 through 6, creating and selecting personalized ads and content profiles. The change followed decisions by data protection authorities that consent, not legitimate interest, is the appropriate legal basis for that processing.
The framework also required consent management platforms to display the total number of vendors seeking data access on the first screen, with standardized purpose descriptions and illustrative examples, and it deprecated the getTCData command, requiring vendors to use event listeners to obtain the TC string instead. Publishers and vendors had to implement v2.2 by November 20, 2023, a deadline originally set for September 30 and extended once because of the complexity.
The European Court of Justice added a legal foundation in March 2024, ruling that the TC string is personal data under GDPR, because it relates to an identifiable user when combined with another piece of information like an IP address, and that IAB Europe is a joint controller in relation to the creation and use of TC strings. The string is not a technical artifact. It is personal data, and the framework that creates it carries controller responsibility.
What came after v2.2
TCF v2.3 was announced in June 2025 and became mandatory for all newly generated TC strings on February 28, 2026. It refines publisher restrictions and vendor disclosures, and it is the version new strings must use. Legacy v2.2 consent strings stop working after February 1, 2026, which means a publisher still writing v2.2 strings is writing strings the ecosystem will reject. Related reading: Consent Mode in the Denied State: Auditing Tags When the Answer Is No.
TCF v2.4 followed, with specifications published July 23, 2026 and a web implementation deadline of October 23, 2026. It adds cross-device consent, new feature disclosures, and a simplified legitimate-interest signal for special purposes. The mobile app and connected TV deadline is February 23, 2027. IAB Europe published TCF Policies v5.0.b alongside the v2.4 technical specification in May 2026.
Google's own requirement sits alongside the IAB versions. Since January 16, 2024, publishers serving personalized ads in the EEA or the UK need a Google-certified consent management platform that works with TCF v2.2 or later. A CMP that is not certified cannot pass the consent signals Google requires, and without those signals most advertisers refuse to display advertising at all.
What to check this week
Ask your CMP which TCF version it writes for new strings. If the answer is v2.2, you are already behind, and the fix is a CMP update, not a configuration change. Check that your vendor list is current, that publisher restrictions are set where you need them, and that the TC string your site generates validates against the current specification. A missing or invalid TC string is the quietest revenue leak in publishing: the ads simply do not serve, and no error message tells you why. More on this: Auditing Consent Mode Signals From Banner to Tag.
Frequently asked questions
What breaks if I stay on TCF v2.2?
New strings created under v2.2 are invalid after the transition, and legacy v2.2 strings stop working after February 1, 2026. Vendors may refuse inventory without a valid TC string.
Do I need a Google-certified CMP?
Yes, for personalized ads in the EEA or UK since January 16, 2024. Google requires a certified CMP that works with TCF v2.2 or later.
What changed in TCF v2.4?
Cross-device consent, new feature disclosures, and a simplified legitimate-interest signal for special purposes. The web deadline was October 23, 2026.
Is the TC string personal data?
Yes. The European Court of Justice ruled in March 2024 that the TC string is personal data under GDPR, and that IAB Europe is a joint controller for it.