How the IAB Europe Transparency and Consent Framework can help your business with GDPR

Posted on: Wednesday 27 June 2018

Share this

What is it? 

The IAB Europe Transparency and Consent Framework is the global cross-industry effort to help publishers, technology vendors, agencies and advertisers meet the transparency and user choice requirements under GDPR.

It was developed by IAB Europe in collaboration with the digital advertising industry. It is designed to offer flexibility to comply with the law, and provide a way of collecting and transmitting signals of consent from an individual to third party vendors working with site and app operators. Here’s how it works:

  • Site/app operators disclose information to people about data processing and seek consent

  • They capture this information through a ‘consent management provider’ (CMP) and pass it through the supply chain in a piece of code

  • Registered third party ‘vendors’ (SSPs, DSPs, ad servers, etc. ) can see whether someone has received information and/or given consent, and serve ads (e.g. personalised or non-personalised ads) and use or access cookies, etc. on that basis

Why was the framework created?

It was a result of the EU General Data Protection Regulation (GDPR) which is the new legal framework governing the use of personal data across all EU markets. GDPR replaced existing national data protection laws and came into force from 25 May 2018.

As well as affecting your core business, GDPR matters for your advertising too. In a nutshell, you need a lawful basis to process personal data on your sites and apps (and anywhere else) for advertising purposes. There are six to choose from and the ones most likely to be relevant to digital advertising are ‘consent’ and ‘legitimate interest’.

Importantly, under existing legislation (the Privacy and Electronic Communications Regulations (PECR), sometimes known as the ‘cookie law’) you must have the individual’s consent to use cookies[1] or other similar technologies (including pixels, tags and device identifiers). The difference that the GDPR makes to the cookie law is that it re-defines what counts as ‘consent’. Consent needs to meet very high standards, for example:

  • it cannot be bundled with T&Cs

  • companies that are relying on consent have to be disclosed to the user

  • the user must give consent ‘unambiguously’ with an affirmative action

  • evidence that consent has been obtained needs to be recorded

If you’re using legitimate interest as your basis for processing personal data, you still need to tell people and give them the opportunity to opt out.

Who does it affect?

Where the GDPR or PECR applies, downstream partners such as DSPs, SSPs or DMPs will rely on ‘publishers’ (which includes advertisers if you have your own sites, apps, etc.) to provide transparency and gain individuals’ consent.

  • If you process personal data from one of your sites or mobile apps (or other entities) you need a way of making sure you disclose this to people and where necessary get their consent.

  • You also need to give people the opportunity to opt out of data processing.

  • If you want to store or access any information on a person’s device you need to get their consent first.

Where can I find out more about the IAB Europe Transparency and Consent Framework? 

We recommend that:

  • Site/app operators – including advertisers, where appropriate to you – implement a registered CMP to disclose information and capture/communicate consent. Some CMPs are free to use, and some charge, or you can build your own and register it with the Framework.

  • Third parties (SSPs, DSPs, ad servers, etc.) register as ‘vendors’ to be able to access the information communicated via the Framework.

Full details of the Framework including FAQs, training materials and technical specifications are available at www.advertisingconsent.eu (if you’re an advertiser, select ‘publisher’ as your profile at the top of the page – an advertiser-specific section is coming soon).

[1] With a few exceptions, such as cookies that are necessary for provision of the service requested by a user, e.g. shopping cart cookies

Related content

Stock

Guidance: Buying digital audio inventory when working with IAB Europe's TCF

We look at how to make your digital audio campaign effective when using IAB Europe's Transparency and Consent Framework

Learn more
Stock

Over 500 vendors & 70 CMPs will implement TCF v2.0

Ahead of the switchover deadline for the Transparency & Consent Framework version 2 on 15 August, IAB Europe announces market adoption figures

Learn more
Matthias Matthiesen

Plan for a smooth transition: TCF v2.0 is coming

With the deadline for transition to TCF v2.0 approaching, Quantcast’s Senior Privacy Counsel Matthias Matthiesen shares how companies can prepare

Learn more
IMAGE

Fact Check: 10 takeouts from commentary on ISBA’s ‘Supply Chain Study’

Learn more

Why digital advertising works

Discover why digital advertising is effective for reaching your customers and building brands.