To assist stakeholders in the online ecosystem in meeting the requirements of the ePrivacy Directive and the General Data Protection Regulation (GDPR), the Interactive Advertising Bureau IAB, has adopted a revised version of the industry standard known as the “Transparency & Consent Framework” (TCF), referred to as TCF 2.2. A working group consisting of representatives from participating businesses has worked intensively on standardising the mandatory information and options provided to users before their data is processed, as well as how user decisions based on these choices must be implemented.
The goal of the changes is to align the TCF industry standard with the requirements of recent case law and guidance from European data protection authorities. Therefore, the IAB wants to enable market participants to comply with these rules by adhering to the Transparency & Consent Framework 2.2. TCF 2.2 will already come into effect on May 16, 2023, and implementation deadlines for affected businesses are extremely tight. The most important changes introduced by the TCF 2.2 are as follows:
- Elimination of legitimate interest as a legal basis for personalising online advertising and content: Businesses can now process pseudonymous data for individualised advertising and content delivery only based on the user’s effective consent.
- Additional information for users about the processing purposes: The information provided in the consent request regarding the purposes for which the data may be used has been revised. The updated information is expected to be more comprehensible and has been supplemented with specific examples.
- Expanded information for users regarding data recipients: Additional information is provided about the recipients of user data, including:
- specific data categories collected by each data recipient,
- storage periods for the collected data for each data recipient, and
- If applicable, the data recipient’s legitimate interests for data processing.
- Transparency about the number of data recipients: The consent request must disclose the total number of data recipients already in the first layer.
- New requirements for users to revoke their consent: Users must be able to revisit the consent request and withdraw their consent through a specific button.
If you have any questions about how to implement the TCF 2.2 for your business, please feel free to contact us directly.
(Dr. Frank Eickmeier, UNVERZAGT Rechtsanwälte)