IAB TCF 2.4 FAQ

IAB TCF v2.4 is a targeted update to the Transparency and Consent Framework. It introduces updated requirements for:

The applicable compliance deadlines are as follows:

• Web environments: October 23, 2026.

• Native application environments, including mobile and CTV: February 23, 2027.

Customers should complete implementation reviews and testing before the deadline applicable to each environment.

An upcoming OneTrust product update will make the previously optional Disclosed Vendors segment in the TC string mandatory.

This update provides vendors with a clear binary signal:

• 1 = disclosed to the user

• 0 = not disclosed

Going forward, when the TC string is generated, there will be a dedicated section for disclosedVendors. Refer to the OneTrust Release Notes for updates on when this change will be fully adopted across OneTrust Consent Management Platform (CMP) products.

Examples:

• 2.2 string without the disclosedVendors section:

  CODECopy

  CQZynXAQZynXAAcABBDECCFgAP_AAEPAAChQF5wAQF5gXnABAXmAAAAA.f_gACHgAAAAA

  CQZynXAQZynXAAcABBDECCFgAP_AAEPAAChQF5wAQF5gXnABAXmAAAAA.f_gACHgAAAAA

• 2.3 string containing the disclosedVendors section:

  CODECopy

  CQZynXAQZynXAAcABBDECCFgAP_AAEPAAChQF5wAQF5gXnABAXmAAAAA.f_gACHgAAAAA.IF5wAQF5gAAA

  CQZynXAQZynXAAcABBDECCFgAP_AAEPAAChQF5wAQF5gXnABAXmAAAAA.f_gACHgAAAAA.IF5wAQF5gAAA

No. OneTrust is updating the existing TCF template rather than creating a separate template. Customers do not need to select a new template or recreate their existing implementation. The update will be delivered through changes to the existing template content, framework metadata, translations, and user-interface presentation.

The TCF 2.4 template updates are planned for OneTrust 202609.2.0 (September 25, 2026).

Customers should review the OneTrust release schedule and release notes for availability in their environment. Release deployment can vary by environment.

The existing template will be updated for TCF 2.4. OneTrust will also update applicable framework-driven content, including the following:

• Feature explanations.
• Feature illustrations and translations supplied through the Global Vendor List.
• The name and guidance for Special Feature 2.
• The applicable TCF policy version.
• Template and framework references to TCF 2.4.

These updates use the existing TCF user interface and framework-data ingestion process.

Special Feature 2 is being renamed as follows:

• Previous name: Actively scan device characteristics for identification
• Updated name: Identify devices based on information actively requested

The associated vendor guidance is also being updated to reflect the active request of Client Hints for the purpose of creating a fingerprint.

This is primarily a metadata, translation, guidance, and display-text change. It does not introduce a new consent signal category.

When users review Features in the applicable layer of the consent experience, the following information must be provided:

• The standard Feature name.
• The full standard user-friendly text.
• The standard Feature explanation.
• The applicable illustration, where supplied through the framework data.

Features should not be displayed with controls that suggest users can independently disable them when they cannot be independently disabled.

If an organization persists a user's TCF privacy choices across multiple devices or end-user agents, the organization must explain the scope of those choices to the user before the user makes a choice.

For example, this may apply when a user signs in to an account and privacy preferences associated with the account are applied to another device.

Organizations must also define how they resolve differences between

• A choice made on a device before the user signs in.
• A preference already associated with the user's account.

The organization may prioritize the most recent device choice or the preferences already saved to the user's account. The resulting behavior must be clearly communicated to the user, including how the user can modify their choices.

No

Multi-device consent concerns privacy choices that apply across multiple devices or end-user agents, such as a mobile device, tablet, or desktop browser.

Group-specific consent concerns privacy choices that apply across a defined group of websites, applications, services, or other digital properties.

If an implementation applies choices across both multiple devices and multiple digital properties, the notice should accurately explain both scopes.

Customers using the standard OneTrust TCF content will receive the applicable framework-language updates through the existing template and Global Vendor List ingestion process.

Customers should test and validate the updated content, translations, illustrations, Feature presentation, and Special Feature 2 wording in a staging or lower environment before publishing the update to production.

Customers using custom TCF text should review their wording to determine whether it accurately describes how privacy choices are applied.

In particular, customers should review if their implementation performs the following:

• Persists choices across multiple devices or end-user agents.
• Applies choices across a defined group of websites or applications.
• Applies choices across both multiple devices and multiple digital properties.
• Uses an authenticated account to synchronize privacy choices.
• Has a defined process for resolving account-level and device-level preference conflicts.

If an implementation persists choices across devices, its custom wording should clearly explain the device scope. Organizations that keep choices within a single device are not affected by this specific multi-device disclosure requirement.

The available [CONSENT_SCOPE] values include the following:

• Application
• Branded websites
• Digital services
• Digital properties
• Group of websites
• Website
• Website and application

The [CONSENT_SCOPE] value describes the websites, applications, services, or properties across which the user's privacy choices apply.

For example, if the selected consent scope is Group of websites

• website-a.com
• website-b.com
• website-c.com

The actual websites included in the group should be accurately identified or made available to the user through an appropriate notice or link.

[INSERT_DEVICE(S)_SCOPE] is a placeholder that customers using custom TCF text can replace with an accurate description of the browsers, devices, or authenticated experiences affected by the user's choice.

It is not a separate, predefined OneTrust configuration value.

Examples include the following:

• The browser and device you are currently using.
• All browsers and devices associated with your account.
• Your mobile application and authenticated web browsers.
• Your mobile device, tablet, and desktop browser.
• All supported devices on which you sign in to your account.

The wording should reflect the customer's actual consent persistence and synchronization behavior.

The following structure can be used in custom TCF text:

Your choices will have effect within our [CONSENT_SCOPE] and will affect [INSERT_DEVICE(S)_SCOPE].

The two placeholders communicate different but related information:

• [CONSENT_SCOPE] identifies the websites, applications, services, or digital properties across which the choice applies.
• [INSERT_DEVICE(S)_SCOPE] identifies the browsers, devices, or authenticated experiences affected by the choice.

For example:

Your choices will have effect within our Group of Websites, which includes website-a.com, website-b.com, and website-c.com, and will affect all browsers and devices associated with your account.

In this example:

• Group of Websites is the selected consent scope.
• website-a.com, website-b.com, and website-c.com identify the websites included within that group.
• All browsers and devices associated with your account explains the device scope.

For a consent experience where choices apply only to the current website, browser, and device, customers using custom text may use wording similar to:

Your choices will have effect within this website only and will affect only the browser and device you are currently using. For more details, refer to our Privacy Policy.

The additional multi-device disclosure is not required solely because of TCF 2.4 if the organization does not persist choices across multiple devices or end-user agents.

If consent is shared across a defined group of websites but remains limited to the current browser and device, customers may use wording similar to:

Your choices will have effect within our Group of Websites, which includes website-a.com, website-b.com, and website-c.com, and will affect only the browser and device you are currently using.

If consent is shared across the same group of websites and synchronized across authenticated devices, customers may use wording similar to:

Your choices will have effect within our Group of Websites, which includes website-a.com, website-b.com, and website-c.com, and will affect all browsers and devices associated with your account.

The wording selected should accurately reflect how the customer's implementation applies and synchronizes privacy choices.

If consent applies across multiple applications but remains limited to the current device, customers may use wording similar to:

Your choices will have effect within our Group of Applications, which includes Application A, Application B, and Application C, and will affect only the device you are currently using.

If consent is synchronized across authenticated devices, customers may use wording similar to:

Your choices will have effect within our Group of Applications, which includes Application A, Application B, and Application C, and will affect all supported devices associated with your account.

Customers using authenticated consent or another multi-device consent mechanism may use wording similar to:

Your choices will have effect within our Digital Services and will affect the devices associated with your account, including your mobile application, tablet, and desktop browser.

Customers should only use multi-device language when their implementation applies or synchronizes choices across those devices.

A conflict may occur when a user makes one choice on a device before signing in, but the user's account already contains a different privacy preference.

An organization may

• Give priority to the user's most recent choice made before signing in.
• Give priority to the privacy preferences already saved to the user's account.

Once the user is authenticated, the user must be clearly informed when the choice made on the device differs from the choice already associated with the account. The user must also be informed how to review or modify the applied preferences.

TCF 2.4 updates the applicable TCF policy version and supporting framework metadata. However, it does not introduce a new consent signal category or a new set of Purposes.

The update is primarily focused on transparency, framework content, metadata, translations, and how information is presented to users.

TCF 2.4 does not, by itself, require customers to ask all existing users for consent again.

Existing OneTrust reconsent controls and conditions continue to apply. For example, reconsent may still occur if a customer separately configures a published change to resurface the consent experience or if another existing reconsent condition is met.

However, consent collected before an organization implements multi-device consent cannot automatically be treated as valid for additional devices if the user was not originally informed that their choice would have a multi-device scope. Organizations introducing multi-device consent should therefore review how previously collected choices are handled before applying them to other devices or services.

Web CMP customers should:

1. Confirm when OneTrust 202609.2.0 is available in their environment.
2. Determine whether they use standard or custom TCF text.
3. Determine whether privacy choices remain within one device or persist across multiple devices.
4. Review how the consent scope and device scope are communicated.
5. Test the updated TCF experience in a staging or lower environment.
6. Validate Feature names, explanations, illustrations, translations, and Special Feature 2 content.
7. Republish the applicable TCF template before the web compliance deadline.

Mobile and CTV customers should:

1. Review their current TCF implementation and consent-synchronization behavior.
2. Determine whether privacy choices persist across applications, devices, or authenticated accounts.
3. Review custom text where multi-device consent is used.
4. Test the updated Feature content, illustrations, translations, Special Feature 2 name, and applicable policy version after the TCF 2.4 update is available.
5. Complete implementation and validation before the native application compliance deadline.

TCF 2.4 primarily updates framework content, metadata, and presentation requirements. It does not introduce a separate TCF template or a new consent signal category.

Customers using CMP APIs or custom application experiences should still validate the following:

• The updated TCF policy version is returned as expected.
• Updated Feature and Special Feature content is displayed where applicable.
• Custom implementations accurately communicate the consent scope and applicable device scope.
• Features are not presented as independently controllable when they cannot be independently disabled.

All customers:

• Identify whether you use standard OneTrust TCF content or custom TCF text.
• Confirm whether choices remain within one device or persist across multiple devices.
• Confirm whether choices apply to one digital property or a defined group of properties.
• Review how account-level and device-level preference conflicts are resolved.
• Plan testing before the applicable web or native deadline.

Web customers:

• Test and republish using an applicable version after OneTrust 202609.2.0 becomes available.
• Complete validation before October 23, 2026.

Mobile and CTV customers

• Test the updated native implementation and framework content.
• Complete validation before February 23, 2027.

Customers using custom TCF text

• Ensure the consent scope and, where applicable, device scope are clearly explained.
• Identify the websites, applications, or services included in a group-specific consent scope.
• Confirm that the wording reflects the actual implementation.
• Do not imply that choices apply across websites, applications, browsers, or devices if that behavior is not implemented.