# TCF v2.4 Is Past Its Deadline. Check What Your CMP Actually Sends

Source: https://consentvigil.com/blog/2026-11-06-tcf-v24-deadline-cmp-check.html

[Home](../index.md) / [Blog](index.md) / TCF v2.4 Is Past Its Deadline. Check What Your CMP Actually Sends


Published 2026-11-06

Your consent banner looks the same as it did in September. The string it sends downstream is not supposed to be. TCF v2.4 specifications were published July 23, 2026, with a web implementation deadline of October 23, 2026, and legacy TCF v2.2 consent strings stopped working after February 1, 2026. If your CMP has not moved, vendors downstream may be rejecting valid consent, or accepting strings that no longer mean what they meant.

The version numbers are the boring part. The part that costs money is what happens when a vendor receives a string it cannot parse: it treats the user as unconsented, or it falls back to a default. Either way your ad revenue and your measurement change without anyone touching the banner. This post is the check that finds out which one is happening on your site.

## What changed between 2.2 and 2.4, in the order it bites

TCF 2.2, released May 2023 and mandatory by November 2023, removed legitimate interest as a legal basis for purposes 3, 4, 5 and 6, the advertising and personalization purposes. That was the big change, and most CMPs handled it. TCF v2.3 then became mandatory for all newly generated consent strings on February 28, 2026, refining publisher restrictions and vendor disclosures. TCF v2.4, published July 23, 2026, adds cross-device consent handling, new feature disclosures, and a simplified legitimate interest signal for special purposes, plus a renamed Special Feature 2: identify devices based on information actively requested.

None of that is visible in the banner. It is visible in the TC string, the base64 blob your CMP writes to the EUCONSENT-V2 cookie and exposes through the \_\_tcfapi interface. A v2.2 string has a different version field than a v2.4 string, and vendors that updated their parsers in October now read the version first. A CMP still writing v2.2 strings is writing a format the ecosystem has stopped accepting for new consent.

## The three checks that take ten minutes

First, open your site in a private window, accept everything, and read the EUCONSENT-V2 cookie. Decode the first bytes or ask the CMP's own debugging tool what version it reports. If it says 2.2, you have the problem. Second, check the vendor list count on the first layer of the banner. TCF 2.2 required CMPs to show the total number of vendors seeking access on the first screen; v2.4 keeps that and adds standardized text for features inside vendor detail blocks. A banner that still hides the vendor count behind three clicks is behind two versions, not one.

Third, test withdrawal. TCF 2.2 tightened the requirement that withdrawing consent be as easy as giving it, and the Belgian DPA's 2022 ruling against the TCF itself turned on whether consent obtained through a 900-plus vendor list could ever be freely given. Click through to preferences, switch a purpose off, and watch whether the TC string actually changes and whether the tags listening to it stop. A banner that records the click but leaves the string untouched is the most common failure in this whole chain, and it is invisible until you look at the string.

## What to do if your CMP is behind

Do not rebuild the banner. Ask the vendor, in writing, which TCF version its CMP writes today and when it moved to v2.4. If the answer is a date in the future, that is a vendor problem with a contract answer: the October 23 deadline applied to web CMPs, and mobile and connected TV follow on February 23, 2027. Get the date in the support ticket, because if a regulator asks, the ticket is the record that you noticed.

While you wait, check the Google side separately. Google's certified CMP requirement took effect January 16, 2024 for the EEA and UK and July 31, 2024 for Switzerland, and a CMP can be Google-certified and still behind on TCF. Certification confirms the CMP integrates correctly with Consent Mode and the TCF; it does not certify full GDPR compliance. Two checks, two answers, and neither substitutes for the other.

Keep reading: [The GPC Signal Is Not a Banner Setting. Test It Like a Request.](2026-11-05-gpc-opt-out-signal-test.md), [Withdrawing Consent Should Take One Click. Count Yours.](2026-11-05-withdraw-consent-one-click-test.md), and [Email Tracking Pixels Are a Consent Problem, Not a Privacy Footnote](2026-11-04-email-tracking-pixels-consent.md) cover the nearby cases in this series.

## Frequently asked questions

### What is the TCF v2.4 deadline for web CMPs?

October 23, 2026. The v2.4 specifications were published July 23, 2026, and web consent management platforms had to implement them by October 23. Mobile app and connected TV implementations follow on February 23, 2027.

### Do old TCF v2.2 consent strings still work?

No. Legacy v2.2 strings stopped working after February 1, 2026, when TCF v2.3 became mandatory for newly generated strings. A CMP still writing v2.2 strings is producing consent signals downstream vendors may reject.

### How do I check which TCF version my CMP writes?

Accept consent in a private browser window, then read the EUCONSENT-V2 cookie and check its version field, or use the CMP's debugging tool. You can also call the \_\_tcfapi interface and inspect the tcString it returns.

### Does Google CMP certification cover TCF v2.4?

No. Google certification confirms the CMP integrates correctly with Consent Mode and the TCF. It does not certify full GDPR compliance or a specific TCF version, so check the TCF version separately.