Short answer: your website needs the IAB Transparency and Consent Framework only if you monetise EEA or UK traffic with programmatic advertising - AdSense, Google Ad Manager, AdMob, or header bidding with SSPs that enforce the framework. If your site runs analytics, marketing pixels, and embedded media but sells no programmatic ad space, a standard consent banner with Google Consent Mode v2 is the right tool, and TCF registration adds cost and complexity without a compliance benefit.
What TCF actually is - and is not
The TCF is an industry framework for relaying consent through the advertising supply chain: the banner encodes choices into a TC string, and every downstream vendor decodes it. It is not a law, not a general GDPR requirement, and not a certification your business needs to be compliant. GDPR and ePrivacy compliance for a typical business website is achieved with informed, granular consent and proper blocking - the same obligations the TCF packages for the adtech ecosystem specifically.
You almost certainly need TCF if...
You serve Google ad products to EEA or UK visitors. Google requires publishers using AdSense, Ad Manager, or AdMob for those users to work with a Google-certified CMP operating under the TCF - the full context is in our AdSense cookie consent guide. That setup also brings Google Additional Consent into play for ad partners outside the framework.
You run header bidding or sell inventory programmatically. SSPs and exchanges participating in real-time bidding expect a valid TC string in bid requests; without one, EEA inventory is typically unsold or served non-personalised.
Your ad network contract says so. Many networks pass the requirement through their terms even for smaller publishers.
You almost certainly do NOT need TCF if...
Your site's third parties are analytics, conversion pixels, chat widgets, and embeds - the common stack of a SaaS, ecommerce shop, or company site. Run a free cookie scan to confirm what actually loads.
You advertise your own business on Google or Meta but do not sell ad space. Ad platforms need conversion signals (Consent Mode v2 for Google), not a TC string from your site.
Your monetisation is affiliate links, sponsorships, or direct-sold ads without programmatic delivery.
For that majority, the decision that matters is choosing a solid consent platform - our what is a CMP explainer and CMP comparison checklist cover it - and implementing Consent Mode v2 correctly. You can verify a live setup in minutes with the Consent Mode Checker.
Four scenarios, four answers
A recipe blog monetised with AdSense. Needs TCF. Google requires a certified CMP operating under the framework for EEA and UK ad serving, full stop. The banner must surface the GVL vendors and any selected ad technology providers, and the site also benefits from Consent Mode v2 for its analytics.
A SaaS marketing site running GA4, Google Ads conversion tracking, and a chat widget. No TCF. Nothing programmatic is sold; a category-based consent banner with Consent Mode v2 handles measurement and remarketing tags. Registering for TCF here would only add a heavier banner and a vendor list nobody needs.
A news publisher with direct-sold campaigns plus header bidding backfill. Needs TCF - the header-bidding SSPs expect a TC string in bid requests, and unsold EEA inventory is the immediate cost of not providing one. Direct-sold campaigns alone would not have triggered the requirement.
A mobile app showing AdMob ads. Needs TCF via an in-app CMP: the same Google certified-CMP requirement applies to apps, with the TC string carried through the app's consent SDK rather than a cookie.
If you drop programmatic, you can drop TCF
The requirement follows the monetisation, not the site. Publishers that move from programmatic to subscriptions, affiliate, or direct sponsorships can retire the TCF setup and fall back to a standard consent banner - simpler UX, faster pages, fewer vendors to disclose. The reverse is also true: adding AdSense to a previously ad-free site is the moment the TCF question re-opens.
The costs of TCF you should price in
TCF is not a checkbox. Registered CMPs must implement the full specification, surface hundreds of potential vendors from the Global Vendor List, keep pace with weekly list updates and framework version changes (v2.3 tightened vendor disclosure requirements and its transition ended in early 2026), and re-establish consent periodically. Publishers carry the UX cost of a heavier banner and the compliance duty to curate vendors rather than enable everything. If your revenue does not come from programmatic, that overhead buys you nothing.
A three-question test
Do EEA or UK visitors see programmatic ads on your site? No: skip TCF. Yes: continue.
Is any of that delivered by Google ad products or TCF-enforcing SSPs? Yes: you need a TCF-registered CMP.
Do you also run Google Analytics or Google Ads? Then you need Consent Mode v2 as well - the two signals coexist in one banner.
If you end up in TCF territory and want to sanity-check what your current banner produces, decode its output with the free TCF String Decoder, and keep our guide to TC string errors handy for the first debugging session.
