What is an IAB approved CMP?

IAB Europe does not endorse CMPs, but it does register them. A CMP that signs up to the TCF and passes IAB Europe's validation receives a CMP ID and appears on the public CMP list. That listing is what people usually mean by an IAB approved or IAB compliant CMP. Google certification for its ad products is a separate programme.

Where can I find the IAB CMP list?

IAB Europe publishes the list of registered CMPs, with their CMP IDs, in the Transparency and Consent Framework section of its website. Check a vendor there before you sign.

What is the Global Vendor List?

The Global Vendor List is IAB Europe's register of ad tech vendors taking part in the TCF. Each entry records the vendor's purposes, legal bases and, since TCF 2.2, its data categories and retention periods. Your CMP shows visitors the vendors you selected from it.

Do I need IAB TCF if I only use Google Analytics?

No. TCF exists to pass consent to third-party ad tech vendors. If you run analytics only and no programmatic ads, a standard consent banner is enough. You will still want Google Consent Mode v2 if you use Google Ads or link GA4 to it.

Does TCF replace Google Consent Mode v2?

No. TCF passes consent to ad tech vendors on the Global Vendor List. Consent Mode v2 passes consent to Google tags such as GA4 and Google Ads. A publisher running both on EEA traffic usually needs both, fed by one CMP.

IAB TCF: what it is and who needs it

The IAB TCF (Transparency and Consent Framework) is the standard ad-funded sites use to pass consent to ad tech vendors. If you sell ad inventory to EEA or UK visitors, you probably need a CMP registered with it. If you only run your own analytics, you probably do not.

What the framework is

The Transparency and Consent Framework is run by IAB Europe, the European trade body for digital advertising. It gives publishers, consent management platforms (CMPs) and ad tech vendors a shared format for recording what a visitor agreed to, and a shared list of the purposes that consent covers.

It standardises how a consent decision is described and passed along the ad supply chain, so every vendor on a page reads the same answer.

What changed in TCF 2.2 and 2.3

IAB Europe launched TCF 2.2 in May 2023. According to IAB Europe's announcement, the main changes were:

Vendors can only register consent, not legitimate interest, as the legal basis for purposes 3 to 6, which cover building and using advertising and content personalisation profiles.
Purpose names and descriptions were rewritten in plain language, with examples, replacing the previous legal text.
The first layer of the banner must show how many vendors are seeking a legal basis.
Visitors must be able to reopen the banner and withdraw consent easily.
Vendors must disclose data categories and retention periods per purpose.

TCF 2.3 followed in June 2025. It makes a disclosedVendors segment in the TC String mandatory, so vendors can tell whether they were actually shown to the visitor. IAB Europe set the end of the transition at 28 February 2026, so any TCF setup running today should be producing 2.3 strings. Ask your CMP to confirm it.

Who needs it

You monetise with AdSense, Google Ad Manager or AdMob and have EEA or UK users. Google's AdSense help documentation requires a Google-certified CMP integrated with the TCF to serve personalised ads to EEA and UK users since 16 January 2024, and to Swiss users since 31 July 2024; without one, that traffic is limited to non-personalised or limited ads.
You run programmatic advertising through SSPs or a header-bidding stack. The vendors in that chain are built to read a TC String for EEA and UK traffic.
A demand partner or ad network asks for a TC String in its contract or integration guide.

Who does not

You run no ad tech: a shop, a SaaS marketing site or a services business with no ad inventory.
You use first-party analytics only, or Google Analytics and Google Ads as an advertiser. For Google's advertiser tags, Consent Mode v2 is the relevant mechanism.

Our take: a TCF banner is longer and harder to read than a standard one. Adding it without ad revenue to protect costs you consent rate for nothing.

How the TC String, CMP list and vendor list work

The TC String is an encoded record of the visitor's choices: which purposes and which vendors they consented to or objected to, plus the CMP that recorded them. The CMP stores it and exposes it to scripts on the page through a standard JavaScript API, so ad tags and bidders read the same value.

The CMP list is IAB Europe's register of CMPs that have passed its validation. Each gets a CMP ID, which is written into every TC String it creates. Vendors use it to check that a string came from a registered CMP.

The Global Vendor List is the register of participating ad tech vendors, with each one's purposes, legal bases and disclosures. You select the vendors you work with, and your CMP shows them to visitors.

Choosing a registered CMP

Confirm any vendor on IAB Europe's CMP list, and on Google's certified CMP list if you use Google ad products. Among the platforms in our dataset:

Cookiebot is recorded with IAB TCF support and lists publishers needing TCF among its best fits, alongside automated cookie scanning.
Usercentrics is recorded with IAB TCF support and is aimed at large publishers with programmatic ads and teams that need white-label options.
iubenda is recorded with IAB TCF support on its paid plans and bundles its consent banner with privacy policy and terms generators, which suits businesses that want consent and legal documents in one tool.

Implementation steps

List every ad partner and the TCF purposes each needs.
Choose a registered CMP and confirm it produces TCF 2.3 strings.
Select only the vendors you work with from the Global Vendor List. The count appears on the first layer.
Load the CMP before any ad tag and configure your ad server and bidders to read the TC String.
Show the TCF banner to EEA and UK visitors and decide separately what other regions see.
Test accept all, reject all and withdrawal, and decode the resulting TC Strings to confirm they match.

Caveats

Using TCF does not make a site GDPR compliant. Whether the consent itself is valid still depends on your banner design, your vendor choices and what the vendors do with the data.

The framework has also faced regulatory action. In February 2022 the Belgian Data Protection Authority found that IAB Europe had infringed GDPR in relation to the TCF, fined it 250,000 euros and ordered an action plan. IAB Europe appealed. In March 2024 the Court of Justice of the EU ruled on questions referred in that case, including whether a TC String can be personal data. In May 2025 the Belgian Market Court upheld the infringements and the fine, while limiting IAB Europe's joint controllership to the creation and use of TC Strings. IAB Europe has since revised the framework through versions 2.2 and 2.3.

Frequently Asked Questions

What is an IAB approved CMP?: IAB Europe does not endorse CMPs, but it does register them. A CMP that signs up to the TCF and passes IAB Europe's validation receives a CMP ID and appears on the public CMP list. That listing is what people usually mean by an IAB approved or IAB compliant CMP. Google certification for its ad products is a separate programme.
Where can I find the IAB CMP list?: IAB Europe publishes the list of registered CMPs, with their CMP IDs, in the Transparency and Consent Framework section of its website. Check a vendor there before you sign.
What is the Global Vendor List?: The Global Vendor List is IAB Europe's register of ad tech vendors taking part in the TCF. Each entry records the vendor's purposes, legal bases and, since TCF 2.2, its data categories and retention periods. Your CMP shows visitors the vendors you selected from it.
Do I need IAB TCF if I only use Google Analytics?: No. TCF exists to pass consent to third-party ad tech vendors. If you run analytics only and no programmatic ads, a standard consent banner is enough. You will still want Google Consent Mode v2 if you use Google Ads or link GA4 to it.
Does TCF replace Google Consent Mode v2?: No. TCF passes consent to ad tech vendors on the Global Vendor List. Consent Mode v2 passes consent to Google tags such as GA4 and Google Ads. A publisher running both on EEA traffic usually needs both, fed by one CMP.

Related Resources

Guide