Skip to content
Start for free

Blog

Guides

IAB TCF 2.4: what changed, what to do and how c15t handles it

The IAB TCF 2.4 web deadline passed on October 23, 2026. Here is what changed, what each CMP needs from you and how to upgrade c15t without re-consent.

Christopher BurnsFounder7 min read

IAB Europe's TCF 2.4 deadline for websites was October 23, 2026. IAB Europe didn't announce an extension.

Since that date, every registered CMP has to show the new disclosures on the web. Your consent strings stay valid and nobody needs to consent again. The next deadline is February 23, 2027, for mobile apps and connected TV.

For most teams, TCF 2.4 is a dependency bump, not a migration. Here's what changed, what your CMP needs from you and how c15t handles it.

What TCF 2.4 is

The TCF (Transparency and Consent Framework) is IAB Europe's standard for collecting ad consent and passing it to vendors as a TC string.

"TCF 2.4" is the name of the technical specification. The policy that goes with it is TCF Policies v5.0.b.

The dates:

  1. July 23, 2026: IAB published the v2.4 specification and the matching Global Vendor List (GVL) update.
  2. October 23, 2026: deadline for CMPs to implement the new disclosures on the web.
  3. February 23, 2027: deadline for mobile apps and connected TV (CTV).

A CMP (consent management platform) is the software that shows the consent banner and writes the TC string. The GVL is IAB's public list of vendors, purposes and features that every CMP reads.

What changed

There are four changes you or your users can see:

  • Features: CMPs must show IAB's standard explanation text and an illustration for each Feature, and Features can no longer sit next to a toggle. Users can't switch Features off, so the UI must not suggest they can.
  • Special Feature 2: renamed from "Actively scan device characteristics for identification" to "Identify devices based on information actively requested". IAB added vendor guidance on Client Hints used to identify devices.
  • Multi-device consent: if you carry a user's choices across devices (for example after they log in), you must tell them that in the notice.
  • Example stacks: example stack 3 (advertisers) was corrected and no longer includes Purposes 2, 3 and 4.

The standard text and the new name come from the GVL, in a new standardTexts field and the updated Special Feature 2 entry.

What didn't change

  • The TC string format.
  • The CMP API (__tcfapi).
  • The policy version in the GVL, which is still 5.

That last point matters most. A CMP only has to ask again when the policy version in the GVL differs from the one in the stored TC string. Both say 5, so existing consents stay valid and there is no re-consent.

Is your CMP ready?

Every registered CMP had to ship the same IAB change. Here's what each one says, as of October 30, 2026:

CMPWhat they've saidWhat you do
UsercentricsWeb SDK customers had to update to version 4.64.0 before October 23. Consent on older versions "may fall out of compliance after the deadline".Web SDK users: update to 4.64.0 or later
CookiebotThe changes don't affect the consent signal, the CMP API or existing strings. No banner resurfacing is required.Nothing
OneTrustThe existing TCF template is updated for 2.4. No separate template needed.Review any custom TCF text
DidomiManual migration from October 6. Automatic migration of all web notices on October 21.Check that your notices migrated
CookieYesA "Support IAB TCF v2.4" setting on plans with TCF.Turn on the setting
OsanoBanners updated on September 16. Changes apply after a configuration is republished.Republish
KetchWe couldn't find a public TCF 2.4 notice.Ask your account contact
c15tShipped in @c15t/iab 2.3.0 on October 2. In every later 2.x and 3.x release.Be on 2.3.0 or later (see below)

If you're not sure that your CMP made the change, ask them. The deadline belongs to IAB, so the answer should be short.

How c15t handles TCF 2.4

TCF 2.4 support shipped in @c15t/iab 2.3.0 on October 2, 2026, three weeks before the web deadline. It's in every later release too: 2.4.0 on the 2.x line and every 3.x release, up to the current 3.2.0 (October 29, 2026).

The stock IAB preference centers in React, Next.js, Vue, Svelte, Astro and the script tag now:

  • show Features in their own section, after the special purposes
  • show IAB's standard Feature text from the GVL's standardTexts.features
  • show each Feature's name, description, illustrations and the vendors that use it
  • render Features with no switch, lock or vendor toggle
  • use the new Special Feature 2 name, which comes straight from the GVL

Under the hood, it follows the rest of the spec:

  • __tcfapi TC data includes the Disclosed Vendors segment.
  • Every TC string sets IsServiceSpecific to 1.
  • Vendors that declare only special purposes no longer get a legitimate interest bit.

If you build your own preference UI, resolveIABDialogDisplayModel in @c15t/iab/headless gives you the same rows. featureRows come back with toggle: 'none', so you render them without a control. See how the preference center shows features.

c15t is open source. You don't have to take our word for any of this: you can read exactly how the TC string is built.

What to do on c15t

GVL content (the standard text, illustrations and the new Special Feature 2 name) reaches you through the vendor list with no code change.

The UI changes live in the package, though. If you're on @c15t/iab 2.2.x or older, you need to upgrade. The web deadline was October 23, so do it now.

1. Check your version

npm ls @c15t/iab

If it shows 2.3.0 or later, or any 3.x release, you're done.

2. Upgrade

The smallest step is the latest 2.x release:

npm install @c15t/iab@^2.3.0

Keep @c15t/iab on the same release as your other c15t packages, and upgrade them together.

If you're already planning the move to 3.x, that works too. Every 3.x release includes TCF 2.4. Read the v3 upgrade guide first, because the IAB setup changed in React, Next.js and TanStack Start.

3. Check the result

Open the preference center and confirm Features have their own section with no toggles. Then check what vendors see:

window.__tcfapi('getTCData', 2, (data, success) => {
	if (!success) return;
	console.log(data.tcfPolicyVersion); // 5
	console.log(data.tcString);
});

Your users' stored choices carry over. Nobody sees the banner again because of this upgrade.

Multi-device consent

c15t stores TCF choices per site and browser, and doesn't sync TC strings across devices. So there's nothing extra to disclose.

If you use your own account data to skip the TCF banner on another device, that becomes multi-device scope. TCF 2.4 requires you to disclose that, and c15t doesn't show the disclosure. Don't do it.

A note on CMP IDs

Every TC string names the CMP that wrote it, using a CMP ID. IAB Europe assigns a CMP ID when a company registers as a CMP.

IAB registers CMPs. It doesn't certify them.

On Inth, Consent Pro and Enterprise include IAB TCF. Those projects use Inth's managed, registered CMP ID, which is 490.

The hosted /init response includes the vendor list and the CMP ID. See IAB TCF on Inth for the plan requirements and setup.

Never copy another company's CMP ID or use a placeholder: it attributes your users' consent records to someone else. If you don't set a valid CMP ID, c15t doesn't mount the IAB add-on and writes no TC string.

For Google AdSense, Ad Manager or AdMob ads in the EEA, the UK or Switzerland, Google requires a CMP on its certified CMP list. Check that your CMP is on it before you rely on it for those ads.

Some Google ad tech providers aren't on the GVL, so the TC string can't name them. Since version 3.1.0, c15t can also ask for consent for those providers with Google's Additional Consent string.

Get started

TCF will keep changing. Your upgrade path should stay a version bump.