Cookiebot and the IAB Consent Framework

PLEASE NOTE: The IAB Transparency and Consent Framework (TCF) is currently being upgraded from version 1.1 to version 2. The Cookiebot integration to IAB TCF 2.0 is in beta until May 1st, 2020. On this date, any IAB-integration in Cookiebot will automatically migrate from v.1.1 to v.2.0. As the two versions are incompatible, your users will automatically be asked for new consent when entering your site the first time after the transition.

As a Cookiebot customer already using our IAB integration you do not need to do anything to complete the transition.

UPDATE May 14, 2020: The TCF Steering Group has decided to extend technical support for TCF v1.1 beyond the previously announced date of 30 June to a new date of 15th August 2020. According to the steering group, the extension of technical support for v1.1 does not impact companies’ ability to implement TCF v2.0 before the new and final cut-off date of 15th August 2020.
Publishers can roll back from TCF version 2 to version 1.1 in Cookiebot (e.g. if not all ad tech vendors are ready for v. 2) by using the value "IAB1" in the Cookiebot tag-attribute 'data-framework' as described below. On August 15, 2020, this implementation will automatically migrate from v.1.1. to v. 2.

UPDATE June 21, 2020: Google have introduced "Additional Consent Mode" (Google AC) as a bridge for vendors who are not yet registered on the IAB Europe Global Vendor List (GVL). Google AC is supported by Cookiebot as of June 21, 2020. Learn more about this integration below.

To support publishers, technology vendors and advertisers in meeting the transparency and user consent requirements of the GDPR and ePrivacy Directive, IAB Europe (Interactive Advertising Bureau) has created the GDPR Transparency and Consent Framework.

As the framework is widely supported by the online advertising industry, Cookiebot is registered with IAB as a consent management provider (CMP) and has adopted the framework as an optional supplement to the core consent framework already included in the Cookiebot solution.

Concept

IAB’s consent model is fundamentally different from Cookiebot’s core consent model. In general, IAB’s model puts control in the hands of advertisers and vendors by signaling the user's consent to advertising vendors, whereas Cookiebot can block non-consented vendors and thereby gives control to the publisher, who is liable for all tracking performed by third parties on the publisher’s website. Nevertheless, the two consent models can co-exist on a single website.

When using the Cookiebot integration with IAB TCF, an extra panel with the title "Ad Settings" will be available to the end user on the cookie banner's details-layer:

To ensure that vendors honor the user’s consent, Cookiebot’s scanner monitors all cookies and similar trackers used on the website. If an IAB-vendor does not honor the user’s consent, cookies set by the vendor will be marked up in the scan report with “Prior consent enabled: No”.

Implementation

Enabling the IAB framework with Cookiebot is straightforward: Just add the attribute “data-framework” to your existing Cookiebot tag with the value “IAB”, e.g.:

<script id="Cookiebot" src="https://consent.cookiebot.com/uc.js" data-cbid="00000000-0000-0000-0000-000000000000" data-framework="IAB" type="text/javascript" async></script>

If you are using Cookiebot with a tag manager, e.g. Google Tag Manager (GTM), which automatically strips all attributes but "src" from the script tag, you can enable the IAB framework by including the URL query "framework=IAB" in the tag src-attribute, e.g. "https://consent.cookiebot.com/uc.js?cdid=00000000-0000-0000-0000-000000000000&framework=IAB"

From there, Cookiebot will automatically signal consent to any vendor using the IAB framework on your website.

Publisher restrictions

<script id="CookiebotConfiguration" type="application/json" data-cookieconsent="ignore">
    {
        "Frameworks": {
        "IABTCF2": {
            "AllowedVendors": [2, 6, 8],
            "AllowedGoogleACVendors": []
            "AllowedPurposes": [1,2],
            "AllowedSpecialPurposes": [],
            "AllowedFeatures": [1],
            "AllowedSpecialFeatures": [1],
            "VendorRestrictions": [
            {
                "VendorId":  2,
                "DisallowPurposes": [2,3,4]
            }
            ]
        }
        }
    }
</script>

For IAB Vendors

__tcfapi('getTCData', 2, (tcData, success) => { if(success) { console.log(tcData) }});

__tcfapi('addEventListener', 2, (tcData, success) => { if(success) { console.log(tcData) }});

The Google AC string is included in the tcData object with the property name "addtlConsent" as suggested by Google on https://support.google.com/admanager/answer/9681920.

Other resources

Using IAB TCF in a Custom Banner