repository·master·Indexed 21 days ago
https://github.com/interactiveadvertisingbureau/gdpr-transparency-and-consent-frameworkTechnical specifications for the Transparency and Consent Framework (TCF), providing standards for digital advertisers, publishers, and Consent Management Platforms (CMPs) to implement GDPR and ePrivacy compliant data processing. Includes specifications for TCF v1.1 and v2, the CMP JavaScript API v1.1, and reference Consent String SDKs for JavaScript, Java, Swift, C, and Scala.
The Transparency and Consent Framework (TCF) provides technical specifications to help digital advertising participants comply with EU data protection regulations, specifically the GDPR and ePrivacy Directive. This repository contains the technical specifications for different versions of the framework, which define how consent is managed and communicated across the advertising supply chain.
Key components include:
The CMP JavaScript API v1.1 is designed for on-page JavaScript tags to retrieve consent information and vendor list data from a Consent Management Provider (CMP).
This API specifies the minimum necessary functionality required for a CMP to provide vendor consent information to Demand-Side Platforms (DSPs) and Supply-Side Platforms (SSPs). It intentionally avoids standardizing publisher-specific UI controls or configurations, which should remain part of the CMP's proprietary functionality.
The Transparency and Consent Framework (TCF) is a standardized system designed to help digital advertising participants (Publishers, Vendors, and Consent Management Platforms) comply with the EU's GDPR and ePrivacy Directive (ePD).
The Consent String SDKs provide reference implementations for encoding and decoding web-safe base64 consent information according to the IAB EU's GDPR Transparency and Consent Framework.
These SDKs should be used by:
For the exact technical specification of the consent string format, refer to the IAB Github specification under the section "Vendor Consent Cookie Format".
The Mobile In-App CMP API v1.0 provides a standardized global interface within a mobile application. This allows publishers and third-party vendors (such as Ad Network SDKs) to access end-user consent information through a single source, ensuring that consent is not requested multiple times from the user.
This specification is dependent on:
The technical specifications for the TCF are primarily intended for:
A TC String is an encoded, compact, and HTTP-transferable string used in the TCF to encapsulate details about how transparency and consent were established. It communicates user preferences regarding Purposes, Special Purposes, Features, and Special Features to participating Vendors.
PublisherCC) and whether Purpose 1 (device storage/access) was disclosed (PurposeOneTreatment).The GVL JSON object contains the following top-level structure:
vendorListVersion: An integer that increments with each change.lastUpdated: Timestamp of the last update.purposes: An array of objects defining consentable data uses (each with id, name, and description).features: An array of objects defining informational data uses (each with id, name, and description).vendors: An array of vendor objects. Each vendor includes:id: Unique, incrementally-assigned ID.name: Vendor name.purposeIds: List of IDs for purposes the vendor requests consent for.legIntPurposeIds: List of IDs for purposes the vendor uses under legitimate interest.featureIds: List of IDs for features the vendor uses.policyUrl: URL to the vendor's GDPR policy.deletedDate: (Optional) If present, the vendor is considered deleted after this timestamp.{
"vendorListVersion": 0,
"lastUpdated": "2018-05-28T00:00:00Z",
"purposes": [
{
"id": 1,
"name": "Storage and access of information",
"description": "The storage of information, or access to information that is already stored, on user device..."
}
],
"features" : [
{
"id": 1,
"name": "Matching Data to Offline Sources",
"description": "combining data from offline sources that were initially collected in other contexts"
}
],
"vendors": [
{
"id": 1,
"name": "Vendor Name",
"purposeIds": [1],
"legIntPurposeIds": [2, 3],
"featureIds": [1, 2],
"policyUrl": "https://vendorname.com/gdpr.html",
"deletedDate": "2018-05-28T00:00:00Z"
}
]
}Mediation SDKs use the IABTCF_gdprApplies and IABTCF_TCString values to manage ad network participation:
IABTCF_gdprApplies == 0: The Mediation SDK can run mediation across all ad network SDKs.IABTCF_gdprApplies == 1: The Mediation SDK will only run mediation among 'GDPR ready' ad network SDKs.'GDPR ready' definition: A vendor is GDPR ready if it retrieves IABTCF_gdprApplies and IABTCF_TCString from the platform storage and passes these values downstream.
The CMP uses a stub pattern to ensure calls made before the full script loads are not lost. The sequence is as follows:
__cmp function that queues parameters, defines a postMessage handler for iframes, and starts an async load of the full CMP script.__cmpLocator is created to signal presence to iframes.__cmp function is replaced with the full API implementation.postMessage handler is replaced with the full CMP handler.The framework enables website and app operators to:
Key terminology: