Microsoft TCF v2.3 update

Recently, many businesses received an email from Microsoft about implementing TCF v2.3 before February 28, 2026.

The message sounds urgent. Because of that, a lot of companies now believe they must have an IAB TCF certification.

In most cases, that is not true. Let’s break this down clearly.

TCF stands for Transparency and Consent Framework. It was created by IAB Europe.

It is a technical standard that allows websites to pass user consent signals to advertising vendors through something called a TC string.

Version 2.3 introduces a required section called:

• Disclosed vendors

This change mainly affects companies operating in the programmatic advertising ecosystem. Important: TCF is not a law. It is just one technical framework for managing consent.

No.

What is legally required under GDPR:

• You must collect valid user consent for cookies
• You must clearly explain how data is processed
• You must remain compliant with privacy regulations

TCF is simply one method to manage this technically. You can run a fully compliant website without being IAB TCF certified.

You may need TCF if your website:

• Displays third party ads such as Google AdSense
• Sells advertising space
• Runs programmatic advertising setups
• Operates as a publisher or media platform
• Works with ad partners that explicitly require IAB TCF

In these cases, the TC string communicates consent to multiple advertising vendors. This is the ecosystem TCF was built for.

Most standard businesses fall into this category.

You likely do not need TCF if you:

• Run an ecommerce store
• Run a lead generation website
• Only advertise your own business using Google Ads, Microsoft Ads, or Google Shopping
• Do not display third party ads on your website
• Do not monetize your traffic through ad networks

Important distinction: running ads is not the same as showing ads.

If you use Google Shopping to drive traffic to your store, that does not mean you need TCF. If you show Google AdSense ads on your website, that is different.

Microsoft sent this communication broadly to companies that may be using TCF.

That does not automatically mean you need to take action.

Many businesses received the email even though TCF does not apply to their setup. If you do not display third party ads, this likely does not apply to you.

We are a GDPR compliant Consent Management Platform.

We are not IAB TCF certified.

For the vast majority of:

• Ecommerce websites
• Corporate websites
• SaaS companies
• Lead generation websites

TCF certification is not required.

If your business operates inside the programmatic advertising ecosystem and explicitly requires IAB TCF support, you should confirm those requirements directly with your advertising partners.

Ask yourself one simple question:

Does my website display third party ads? If yes, you may need TCF. If no, you likely do not.

If you are unsure, contact our support team and we will help you review your setup.