This article describes requirements and potential differences in the Cookiebot consent banner configured in your account and the version shown on your website. If you are looking for instructions on how to setup and implement the Cookiebot consent banner with the IAB TCF v2.0 integration enabled, please see our article on this subject here.
Please note that any mentioning of compliance in this article strictly relates to compliance with IAB policies and should not be mistaken for GDPR compliance.
When using Cookiebot with the IAB TCF v2.0 integration framework enabled, a number of IAB compliance policy rules are enforced on the banner that will be shown to your visitors.
This can result in a difference in the appearance of the consent banner configured in your Cookiebot account and the consent banner shown to visitors on your website.
1. Required banner text
Below screenshot shows the mandatory text content that must be shown on banners with IAB TCF integration enabled. This text is automatically inserted into the banner and cannot be altered.
The middle section describing collection of geo-location data and fingerprinting is shown dynamically if IAB "Special Features" is enabled. This is enabled in the banner by default. To disable special features please follow instructions found here.
With "Special Features" disabled the default text in the banner will be shown like this:
The mandatory text will be added in the same language as the language defined for the banner, if this is one of the 29 other languages supported by the IAB framework (With the exception of Serbian in cyrillic). If a different language is used in the banner, the text will be inserted in English.
2. Required opt-out button
Your banner must present an option to opt out for the user. This option is currently available on the following banner types:
[Accept / Decline]
[Multilevel] with the button option [ Allow all/selection ] (Example shown above)
[Multilevel] with the button option [ Reject All / Selection / Allow All ]
If your banner configuration is not compliant with the opt-out button requirement, our solution will automatically overwrite the banner output shown to the visitor to comply with the IAB TCF v2.0 policies. This means that we will show the banner type [Multilevel] with the button option [Allow all/selection] on your website. This is the banner type displayed in the screen shot above.
If the non-compliant banner type configuration chosen in your account makes use of pre-ticked checkboxes, the automatic overwrite will preserve your choice with regards to the pre-selected categories.
If the non-compliant banner type configuration chosen in your account does not contain checkboxes, the automatic overwrite will show empty checkboxes for the three selectable categories in accordance with GDPR requirements.
3. Custom text option
If you'd like you may add your own custom text below the mandatory text content in the consent banner.
You can do so by adding text in the "Dialog body text" field under "Content" in "Settings" on your Cookiebot account.
Any text you define here will be added below the mandatory text as shown below.
If you wish you may also edit the text on any of the buttons shown on the consent banner. To do so you must choose one of the three banner configurations mentioned in section 2 of this article. You will then be able to change the text in the "Content" pane.
4. Why is this necessary, what if I don't want this in my banner?
As an IAB CMP we are required to ensure compliance with the IAB TCF v2.0 policies on usage and implementation across all our customers’ banners.
In the words of the IAB:
“Non-compliant CMP implementations undermine the reputation of the TCF and expose participating organisations to serious legal risks. As the only visible point of contact with the user and authorities, CMPs have a responsibility and obligation under TCF policies to ensure that the market implements compliant versions of the UI.” (IAB TCF v2.0 policies)
Failure to comply with the IAB policies has severe consequences as this will result in expulsion of the CMP as an IAB TCF v2.0 CMP.
The IAB is continuously assessing all CMP solutions and checking them for policy compliance.
Our solution passed IAB verification and certification for TCF v2.0 on all technical aspects in April 2020. However, IAB since then found that the wording of the banner content in some cases did not meet the requirements of the IAB compliance policy. This happened despite our best efforts to guide our customers and therefore we were forced to take the above measures to force compliance on our IAB integration solutions. We do this in order to ensure that we can keep this integration running for all of our customers requiring it. The measures will be implemented on 13 August 2020.
You can operate your website with ads without making use of the IAB framework with Cookiebot. The Cookiebot consent solution allows you to integrate ad solutions the exact same way you do today, without the IAB framework integration activated. The Cookiebot solution will run scripts and ad integrations as the submitted consent allows, making sure ad vendors get activated as intended. The only difference will be that the adtech vendors will not receive a signal through the TCF but can instead assume that full consent has been given when their tag is loaded and active on the website. This does not stop any vendor from serving the right ads in the cases where the visitor opts in as the use of the IAB framework is not a requirement to obtain the users’ consent values. With Cookiebot these are readily accessible to any ad vendor through our SDK, documented on our website.
By running the banner without the IAB framework integration you are free to design the visual appearance of your consent banner beyond the IAB policies.