Skip to content
Login Contact

Legitimate Interest Assessment on TCF String

Introduction

Legitimate interest is one of the six legal bases for processing personal data. In this sense, Article 6.1.(f) of the General Data Protection Regulation states:

“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”

Legitimate interest differs from other legal bases in that it does not focus on a specific purpose (e.g., fulfilling a contract with the individual, fulfilling a legal obligation, protecting vital interests, or performing a public task), and it does not rely on processing data for which the individual has specifically consented. Legitimate interest is more flexible and, in principle, could apply to any type of processing for any reasonable purpose.

Marfeel Solutions, S.L. (hereinafter “Marfeel” or “the Company”) conducts this Legitimate Interest Assessment Report for the purpose of determining whether Marfeel has a legitimate interest to save and communicate to Vendors the Users’ privacy choices in the form of the “TCF String” on the web pages where Marfeel Compass is deployed and integrates with the publisher’s Consent Management Platform (CMP).

A three-part assessment should be conducted to determine if Marfeel has a legitimate interest. This requires evaluating: Part 1: The purpose of the processing. Part 2: The necessity of the processing. Part 3: The balance of interests.

PART 1: The purpose of the processing.

The International Advertising Bureau (hereinafter “IAB”) is the European-level association for the digital marketing and advertising ecosystem, whose mission is to lead political representation and promote industry collaboration to provide frameworks, standards, and programs that enable companies to thrive in the European market while complying with privacy laws.

This association enacted the Transparency and Consent Framework (hereinafter “TCF”), which establishes a series of mandatory privacy rules for vendors registered with it.

On June 3, 2024, the IAB updated the TCF to align with Court Judgment C-604/22 (IAB Europe vs APD) of the European Court. This judgment ruled that the TCF String constitutes personal data and therefore those processing this data must have a legitimate basis for doing so. It should be noted that the TCF String is an alphanumeric string that stores the user’s privacy choice made through a Consent Management Platform (CMP).

Marfeel is registered with the IAB under vendor number 943.

Marfeel does not operate its own CMP. Instead, Marfeel Compass seamlessly integrates with the publisher’s CMP and relies on the consent signals and TCF String made available through that CMP.

For the proper operation of Marfeel Compass in environments where the TCF applies, Marfeel must retain and communicate the TCF String for the following reasons:

i) To ensure and be able to demonstrate that the user has accepted or rejected the processing of their personal data for different purposes and vendors. Throughout this report, the term “user” refers to readers or users of the websites where Marfeel Compass is deployed.

ii) To ensure that the user’s privacy choice is respected across interactions and that processing is carried out in accordance with the signals provided by the publisher’s CMP.

iii) To facilitate the Company in demonstrating compliance with the principle of accountability under Article 5(2) of the General Data Protection Regulation.

iv) To assist data protection authorities in conducting investigations and audits relating to TCF vendors.

PART 2: The necessity of the processing

Firstly, it is important to analyze whether all the information included in the TCF String is strictly necessary to achieve the processing purposes outlined above.

  • General metadata: standard markers indicating details about the implementation of the TCF by the publisher (e.g., CMP ID used, language of user interfaces, use of non-standard texts in interfaces like custom stacks or illustrations), and a daily timestamp of when users have made/updated their choices.
  • User consent per purpose and per vendor when consent is the legal basis (“1” signifies user consent and “0” signifies user refusal or withdrawal of consent).
  • User right to object per purpose and per vendor when legitimate interest is the legal basis (“1” indicates user was informed and “0” indicates user was not informed or objected to processing).
  • Publisher restrictions: specific metadata regarding the publisher’s implementation of the TCF, such as indicating a general prohibition for certain providers pursuing specific data processing purposes.
  • Where applicable, user choices for purposes not covered by the TCF or for vendors not participating in the TCF (“1” indicates user agreement and “0” indicates no agreement).

In accordance with paragraphs 416, 417, and 418 of the decision of the Belgian Data Protection Authority dated February 2022, it is noted that:

“The Dispute Chamber notes that the information processed in the TCF String is limited to data that is strictly necessary to achieve the intended purpose…”

Therefore, it is observed that the processing of the components of the TCF String, and hence the TCF String itself, is strictly necessary to achieve the aforementioned purposes.

Finally, in compliance with the principle of storage limitation, Marfeel clarifies that the TCF String is retained for a period not exceeding 1 year. After this time, the Company proceeds with its deletion, and the publisher’s CMP may request the user again to indicate their privacy preferences.

PART 3: The balance of interests.

The TCF String is an alphanumeric string that abstractly represents a user’s privacy choice, without directly attributing that choice to a specific user.

Additionally, the combined state of these privacy choices is not unique, as many users may express identical preferences. Therefore, these choices cannot be considered particularly private data, nor are they related to the personal or professional sphere of the individuals concerned.

The TCF String does not involve any special categories of personal data or data relating to criminal convictions and offences.

Users reasonably expect that their privacy choices, once expressed through a CMP, will be technically stored and respected. Without the processing of the TCF String, vendors would be unable to honour those choices or demonstrate compliance.

As stated in the “Practical guide to carrying out a Legitimate Interest Assessment (LIA) in connection with Special Purpose 3” by the IAB:

The processing of the TCF String ensures that users’ privacy choices can be respected (i.e., granting, refusing, or withdrawing consent and exercising their right to object), and that they do not have to make these decisions again with each subsequent interaction.

The TCF String does not introduce additional privacy risks, nor does it create new cross-site tracking vectors. Its design reflects the principle of data minimisation.

It is not possible to offer an “opt-out” of the TCF String processing because:

i) It is technically necessary to preserve and communicate users’ privacy choices;

ii) It allows Marfeel to demonstrate compliance with data protection regulations;

iii) Its design incorporates the principle of minimisation and does not introduce additional privacy risk.

CONCLUSIONS:

Marfeel has a legitimate interest to save and communicate to Vendors the Users’ privacy choices in the form of the “TCF String” on web pages where Marfeel Compass integrates with the publisher’s CMP.

Processing the TCF String is strictly necessary to respect and transmit users’ privacy choices and to demonstrate compliance with the TCF framework and the accountability principle under the GDPR.

Date: March 18, 2026