Custom TCF first layer FAQ

A custom first layer is available to Premium and Corporate customers only. It isn't a self-service setting. You need to request it, and we evaluate each request case by case before we confirm whether it's possible for your setup.

To start a request, contact your dedicated Customer Success Executive and tell them about your use case. They will check that you are eligible. If you are, they will open a support request for you and copy you in, and we will take it from there.

With custom text, you keep the standard Usercentrics banner and change only the wording. With a custom first layer, you build the first layer yourself with our API or SDK. You then control the layout, the buttons and all required information.

IAB Europe sets strict rules for what the first layer of a TCF banner must show. If your text or design misses a rule, IAB Europe can mark your setup as non-compliant in an audit. This can affect how vendors and partners treat your consent signals.

IAB Europe audits live TCF implementations to check that CMPs comply with the TCF Policies. As a registered CMP, Usercentrics is responsible for making sure the consent banners and signals it delivers are compliant. This includes websites that use custom texts or a custom first layer.

How the IAB Europe enforcement process works: If an audit finds that a website using the Usercentrics CMP does not comply with the TCF Policies:

• IAB Europe informally tells Usercentrics about the issues and gives 5 business days to fix them.
• If the issues are still open after 5 business days, IAB Europe sends Usercentrics a formal suspension warning. Usercentrics then has 10 business days to fix them.
• If the issues are still open after that, IAB Europe suspends Usercentrics from the list of approved CMPs until they are fixed. During a suspension, the TC strings of all Usercentrics TCF customers are invalid.

Usercentrics requires every issue to be fixed before it leads to a formal warning.

What this means for websites with custom texts or a custom first layer: Customisation makes non-compliance more likely. A website that uses custom texts or a custom first layer must be ready to make changes at short notice.

When Usercentrics tells a customer about an audit finding, the customer must make the required changes within 3 business days. This leaves Usercentrics and IAB Europe time to validate the fix before the 5 business day deadline.

What happens if the issues are not fixed in time: Under the TCF Policies, Usercentrics is responsible for making sure its CMP complies, and must not apply customer settings that break the Policies. If the customer does not fix the issues in time, Usercentrics will take one of the following actions to restore compliance:

1. Replace the custom banner with the default, TCF-compliant Usercentrics banner.
2. If that is not possible, deactivate TCF on the affected website. The CMP will then stop generating TC strings for that website, and ad tech vendors that rely on the TCF will not receive a valid consent signal.

The measure stays in place until the issues are fixed and approved.

Your text must still cover the points the standard banner would otherwise handle for you. It must:

• State that third-party vendors process personal data, and give at least one example, such as browsing data or cookies.
• Show the number of vendors.
• State that your privacy choices apply only to this digital property.
• State that users can change or withdraw their consent at any time, and explain how.
• Tell users that some vendors process personal data based on legitimate interest, and that users have a right to object. Explain how they can object. If this isn't in the first layer, it must appear in the second layer.

Example: "We and our %VENDOR_COUNT% vendors process your personal data (e.g. browsing data) using technologies such as cookies."

Build a custom first layer only after a thorough review of the IAB Europe Controls Catalogue. Nothing is added for you. Your first layer must meet every IAB first-layer requirement. It must include all the text points above and also:

• Be prominently displayed, cover most of the page content, and appear separately from your terms and privacy policy.
• Name the storage and access of information on a device (Purpose 1), for example "Store and/or access information on a device".
• Link directly to the full list of vendors.
• List the purposes and special features that vendors use, using the exact wording IAB Europe specifies.
• Include an accept button and a reject button or a button to customize choices, such as "Manage options".
• Give both buttons matching font, size and style, with a contrast ratio of at least 5:1.

You may need to register with IAB Europe as a private consent management platform (CMP) yourself. In that case, you can't use the default Usercentrics CMP ID. Check IAB Europe's current requirements before you launch. If you build with the SDK, see the Usercentrics CMP Browser SDK documentation.

We can review your setup as part of the evaluation. This review is guidance only. It doesn't guarantee that your setup will pass an IAB audit or meet the requirements of your local data protection authority (DPA).

The IAB Europe Controls Catalogue is the official reference. You can find the latest version on the IAB Europe TCF Supporting Resources page. All requirements are subject to the IAB Europe Transparency & Consent Framework Policies.