Skip to main content

TCF in EU/EEA + UK + CH: Best Practices for Web & Apps / Mobile Games

Updated

The most common scenario for TCF is covering EEA + UK, sometimes also Switzerland. Currently, the best practice is using geolocation rulesets - this is applicable for both web and app implementations.

None of the following is to be considered legal advice. In which regions you show which consent banner is ultimately your legal decision to make. Below you can find our recommendations and best practices based on our experience with existing customer implementations.

Please also review the Geo Rules technical documentation.

General Approach for Web & Apps / Mobile Games:

We recommend following the setup example below as a general best practices recommendation.

  • Global Rule setup (acts as fallback rule):

    • TCF configuration with the setting “Apply GDPR only to EU and EEA users” enabled
      (on the configuration level, go to Configuration → Legal Specifications tab to enable this setting)

    • Enable the setting "Do not display CMP layer" if you do not wish to show any banner in the global / fallback rule.

  • Regional Rule:

    • TCF configuration with the setting “Apply GDPR only to EU and EEA users” disabled

    • Specify the region for this rule as required, for example by adding EEA, UK and Switzerland

    • Added note: you are free to specify the regions as you see fit. The most common setup is  EEA + UK, however EEA + UK + Switzerland would more closely follow Google’s recommendations in a Google Consent Mode context.

  • Optional: Further Regional Rule(s) that cover other countries or legislations

Alternative Approach for Apps / Mobile Games

This is only applicable to apps configurations (see Geolocation Ruleset constraints), a different setup possibility is described below. This also makes use of the geolocation rulesets system.

  • Global Rule setup (acts as fallback rule):

    • Non-TCF (i.e. GDPR or CPRA) configuration.

      Enable the setting "Do not display CMP layer" if you do not wish to show any banner in the global / fallback rule.
    • Important: For the above to be feasible, it requires that none of your SDKs or APIs are waiting for a consent signal, i.e. gdprApplies being set in some way for TCF.

  • Regional Rule:

    • TCF configuration with the setting “Apply GDPR only to EU and EEA users” disabled

    • Specify the region for this rule as required, for example by adding EEA, UK and Switzerland

    • Added note: you are free to specify the regions as you see fit. The most common setup is  EEA + UK, however EEA + UK + Switzerland would more closely follow Google’s recommendations in a Google Consent Mode context.

    • Optional: Further Regional Rule(s) that cover other countries or legislations

We strongly recommend testing any setup before going live with it.