GDPR-Transparency-and-Consent-Framework

Just to clarify... the IAB does not provide cookie popups. It does however provide a spec [0] for how these are supposed to operate. Website publishers then choose which popup vendor to use. [0] https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa...

There used be the option of using a global cookie but website no used it. It was then deprecated. See the field 'IsServiceSpecific' in [0] [0] https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa...

> All data collected through the TCF there is no data collected via TCF: https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa... CMPs are the popups that save the preferences and thus enable the collection of the data. IAB only provides a spec.

I don't understand the findings. The TCF system doesn't collect personal information. The spec is at [0]. CMPs are the popups responsible for creating the TCF string. The IAB provides a spec for how these should operate, but does not supply one of its own. These can absolutely misbehave, and the IAB has previously notified the adtech industry about known misbehaving CMPs. [0] https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa...

In theory it can: How should a Transparency & Consent String be stored? In version 1 of the TCF Specifications the consent string was specified to be stored as either a 1st party cookie for service-specific consent or a 3rd party cookie for global consent. In version 2 of the TCF Specifications, the storage mechanism used for service-specific TC Strings is up to a CMP, including any non-cookie storage mechanism. However, global TC Strings must still be stored as cookies under the consensu.org domain.[0] Pretty much no website uses it. [0] https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa...

Good question. The downvotes are undeserved. The reason is that if it's done in the browser then a person's preferences will apply to every website they use with that browser. Publishers will not want that as they hope that users will give them more consent than other web sites (I certainly do give some websites full permissions if I like them, others are a 'reject all' and 'object all') Also, your consent preferences are stored under that website's cookie. There is the option of a global cookie but nobody uses it. This cookie data is then sent to everyone involved in the adtech chain (which is causing issues since it can be multiple KB's in size). It's format is described in [0] [0] https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa...

It's the official solution created by Interactive Advertising Bureau and as the standard way to opt-out for all the companies in this organization: https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa... There are serious doubts if this is a complaint way to handle cookie consent.

IAB Tech Lab and their Consent Management Platform: https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa... and their other projects.