Consent Management: IAB TCF Explained
IAB TCF may be primarily thought of as a requirement for consent in Europe under the GDPR, however IAB Canada has established a separate version of TCF to support the specific requirements of Canadian Personal Information Protection and Electronic Documents Act (PIPEDA).
Compared to IAB Europe TCF, there are a few differences in the IAB Canada TCF:
- IAB TCF Canada does not provide the purpose of “storing and/or accessing information on a device” where IAB TCF Europe does.
- IAB TCF Canada does not support legitimate interest as a lawful basis, or reason, to process data.
- IAB TCF Canada changes “opt-in consent” in IAB TCF Europe to “express consent”.
- IAB TCF Canada allows “implicit consent” if the consumer has had adequate information and policies provided to them and no * explicit object or opt-out request has been received.
- IAB TCF Canada extends the re-consent timeline beyond the 13 month limit that IAB TCF Europe imposes.
- If no permission has been given under IAB Canada TCF, then it must be interpreted as an explicit objection / opt-out signal.
- In Canadian TCF a vendor must be able to demonstrate permission, where as in European TCF, a vendor must be maintain a record of consent for the user.