TCF Upgrades (from to 2.0 to 2.3)

The IAB Europe Transparency and Consent Framework (“TCF”) has evolved from v2.0 through v2.2 to v2.3 in response to increasing regulatory scrutiny and market expectations, introducing targeted but significant changes to enhance transparency, standardise consent practices, and better align with the requirements of the GDPR and supervisory authority guidance.

The table below summarises these developments, highlighting the framework’s progressive shift towards stricter consent requirements, reduced reliance on legitimate interest, and increased accountability for vendors and CMPs, as well as the practical implications for implementation and compliance.

To date, Marfeel continues to be listed as a vendor on the Global Vendor List under ID 943.

Topic	TCF 2.0	New / changed in TCF 2.2	New / changed in TCF 2.2	What this means for an analytics vendor / processor
Overall structure	v2.0 introduced the modern TCF model: GVL registration, standardised purposes/features/stacks, TC String signalling, publisher controls and vendor compliance duties.	v2.2 was launched on 16 May 2023 to respond to regulator feedback and the Belgian APD action plan.	v2.3 was released on 19 June 2025; transition ended 28 February 2026 and TC Strings created from 1 March 2026 must comply.	Check which version our publishers/CMPs are using and whether our signal handling logic is still aligned.
Legal bases by purpose	v2.0 allowed flexible legal bases for some purposes and let publishers apply publisher restrictions / switch default legal basis where the vendor allowed it. It also supported LI objection signalling.	Big change: within the TCF, vendors can no longer rely on legitimate interest for Purposes 3, 4, 5 and 6 (personalised advertising/content). Those must be consent-based in TCF 2.2. LI remains available for some other purposes, including 2, 7, 8, 9, 10 and 11 where applicable.	No headline change to the purpose legal-basis matrix in the 2.3 release itself; 2.3 mainly addresses signalling ambiguity.	This mainly matters if we had declared anything beyond pure measurement / audience research / service improvement. Typical analytics mappings are more often around Purposes 7/8/9/10 than 3–6, but your GVL declarations should be checked carefully.
Vendor disclosures in GVL	v2.0 required vendors to be on the GVL with purposes, legal bases, features and privacy-policy link.	Vendors must now provide more granular disclosures: categories of data collected, retention periods per purpose, legitimate interests at stake where relevant, and multilingual URL support for privacy information. The GVL moved to v3 to support this.	2.3 did not introduce a comparable new bundle of vendor-registration fields; its main change is the mandatory disclosed-vendors signal in the TC String.	Our GVL registration and privacy documentation need to match our actual analytics data flows, retention and Legitimate Interest explanations.
User-facing wording / transparency	v2.0 standardised purposes, features and stacks, and required CMPs to use standard terminology.	Purpose/feature names and descriptions were revised; legalistic text was replaced with more user-friendly descriptions and illustrations/examples.	No major equivalent wording overhaul announced as part of 2.3.	We should make sure our privacy policy and any supporting CMP copy do not conflict with the revised TCF labels.
Vendor count disclosure	Not a core v2.0 first-layer requirement in the same way.	CMPs must disclose the total number of vendors seeking to establish a legal basis on the first layer of the CMP UI; the secondary layer must show vendor numbers per purpose.	No comparable new 2.3 requirement.	Mostly a CMP/publisher obligation, but it can affect whether publishers keep processor in their vendor list because overall vendor count is now more visible to users.