# IAB TCF v2.3: The Cutover Your CMP Has to Make

Source: https://cookiecitadel.com/blog/2026-11-08-tcf-v23-cutover-cmp.html

[Home](../index.md) / [Blog](index.md) / The Cookie Banner Keyboard Trap: Test Yours With Tab Alone / IAB TCF v2.3: The Cutover Your CMP Has to Make


Published 2026-11-08

TCF v2.3 became mandatory in March 2026. New consent strings must contain the mandatory disclosedVendors segment, or they are invalid under the framework. If your CMP has not cut over, the strings it sends are not just old. They are broken in a way vendors are now allowed to reject.

The Transparency and Consent Framework is the plumbing underneath programmatic advertising in Europe. The consent string is the encoded message that tells a vendor which purposes and vendors a visitor agreed to. Version 2.2 did that job for years. Version 2.3 changes what the string has to contain, and the change is not cosmetic: the disclosedVendors segment names the vendors the publisher disclosed to the visitor, and a string without it does not describe a real disclosure.

## What changed, in one paragraph

Under v2.2, the string carried purposes, vendors, and legitimate interest signals. Under v2.3, it also has to carry the disclosed vendors: the list the visitor actually saw. A vendor that receives a string without that segment cannot confirm the visitor was told about it, and the framework says to treat the string as invalid. The practical result is the same as a denial for that vendor: no lawful basis to process, no bid, no revenue from that impression.

The cutover also tightened the rules on what counts as a valid string. CMPs had to update their encoding, their vendor list handling, and the way they pass the string downstream. A CMP still sending v2.2 strings after the deadline is not grandfathered. It is sending strings the ecosystem no longer accepts.

## The check that takes ten minutes

Open your own site, accept everything, and read the consent string your CMP produces. Decode it with a TCF decoder and look for the disclosedVendors segment. Then reject everything and check the string again: the purposes should be off, the vendors should be off, and the string should still be well formed. Then check the version number in the string itself. If it says 2.2, your CMP has not cut over, and every vendor downstream is making its own decision about whether to trust it.

Ask your CMP vendor directly: when did you ship v2.3, and what version does my site send today. Do not accept a roadmap answer. The deadline was March 2026, and a CMP still promising the cutover is a CMP that missed it.

Keep reading: [Reading the TCF Consent String: What Each Segment Tells You](https://cookiecitadel.com/blog/2026-11-07-tcf-consent-string-read.md), [When Your CMP Changes Subprocessors, Your Records Have to Change Too](https://cookiecitadel.com/blog/2026-11-06-cmp-subprocessor-change-records.md), and [Consent Version History: The Evidence Trail Nobody Keeps](https://cookiecitadel.com/blog/2026-11-05-consent-version-history-evidence.md) cover the nearby cases in this series.

## Frequently asked questions

### What is the disclosedVendors segment in TCF v2.3?

It names the vendors the publisher actually disclosed to the visitor. A v2.3 consent string without it is invalid under the framework, because the vendor cannot confirm the visitor was told about it.

### When did TCF v2.3 become mandatory?

March 2026. New consent strings must contain the mandatory disclosedVendors segment from that date. CMPs still sending v2.2 strings are sending strings the ecosystem no longer has to accept.

### How do I check which TCF version my site sends?

Accept everything on your own site, capture the consent string, and decode it with a TCF decoder. The version number is in the string itself, and the disclosedVendors segment should be present in a v2.3 string.

### What happens to a vendor that gets an invalid string?

It has no lawful basis to process for the purposes in the string, so it treats the visitor as unconsented. In programmatic advertising that means no bid on the impression.