In such a busy month with everyone focused on the latest with the EU AI Act, you may not have spotted that IAB Europe has launched its Transparency and Consent Framework 2.2.

Readers will remember (read here to refresh your memory) that, back in February of last year, the adtech industry was rocked by a decision from the Belgian data protection regulator and many have been waiting to see what resulting changes this would bring. This announcement will therefore be of interest to many given that the TCF is used by huge numbers of websites and other digital services to explain to and give users controls around how their data is used and informs many of the pop up notices we see.

What are the key changes?

- It won't be a surprise that, for certain processing categories, it won't be possible to rely on legitimate interests anymore and consent will be the only acceptable legal basis. This includes use for creating profiles for personalised advertising and personalised content and using profiles for selecting personalised advertising and personalised content. Note that legitimate interests won't disappear entirely however.

- Data subjects will need to be given even more information with some of the descriptions for different processing activities being changes to make it clearer, more user friendly and standardised. Users will now need to be told what the retention period is for each purpose (in days), more granular descriptions around the data collected (IP address, device identifier etc). Data subjects will also be informed about the total number of vendors seeking to establish a legal basis on the first layer of any consent management platform.

- The ability to withdraw consent will be made simpler.

When do they take place?

Vendors using TCF won’t have long to make submit new information and registrations by as the deadline is 30 June and the deadline for submission of vendor assessments is 31 July. The implementation period for changes and compliance with the new policies is 30 September.