IAB TCF Canada
The IAB Transparency and Consent Framework, originally started to support GDPR, is now expanding to Canada in order to support signaling consent for PIPEDA / CPPA. Mid February 2021 IAB Canada published its first draft for the IAB Canada Transparency and Consent Framework Policies (IAB Canada TCF) for public comment. An overview.
Similarities IAB (Europe) TCF and IAB (Canada) TCF
The IAB TCF for Canada is very similar to the european brother. Most of the policy is a 1:1 copy of the IAB EU TCF policy. Similar to Europe, IAB Canada defines CMPs, Publishers and Vendors and their roles in generating, sending and using signals for consent:
A CMP is the provider that is responsible for displaying the consent layer, informing the visitor and collecting the consent information. It will then encode (“pack”) the data into a so called TCString and make it available to third parties on the website via APIs. Similar to TCF Europe, only CMPs that are registered with the IAB Canada are allowed to create those TCStrings. Each CMP will receive a unique CMP-ID that is included in the TCString in order to signal which CMP has created it.
A vendor is an advertiser, adtech tool or any other party in the ecosystem that plans to process personal data and wants to use the IAB Canada TCF. Each vendor must register with the IAB Canda and will receive a unique vendor ID. All vendors will be listed in the GVL (“global vendor list”). This again is very similar to TCF Europe.
A publisher is a website or app owner. The policies for publishers are also very similar to the European policies: Publishers define which purposes, features and vendors may be used on its website or app.
Differences between IAB Europe TCF and IAB Canada TCF
Due to the fact that consent for cookies (“Device access”) is not necessary under PIPEDA, the IAB Canada TCF defines less purposes than TCF Europe:
Missing purpose 1
In IAB (Europe) TCF a purpose 1 is defined as “Store and/or access information on a device”. Is is usually used to ask for consent to read and write cookies and similar technologies. Since the canadian law is less strict regarding accessing devices, the TCF is missing this purpose. Instead Canada TCF starts with purpose 2. Purposes 2 – 10 are similar to the ones in Europe.
A stack is a “group” of purposes that are bundled together. The goal is to make it easier for a visitor to choose. While IAB TCF Europe contains 42 Stacks (different combinatios of purposes), IAB TCF Canada currently only defines 37 Stacks
IAB TCF Canada adds some new interface requirements. For example, the CMP must display information on whether personal information is stored outside of Canada and what risks can be caused by this.
At the same time, some requirements are less strict compared to TCF Europe: For example since “legitimate interest” does not exist under PEPIDA, the UI does not need to show two toggles or inform the visitor on whether data is processed on this legal basis.
Also the second layer does not need to contain as much information as a “European-Layer” would contain.
consentmanager & IAB Canada TCF
Once the IAB Canda TCF is final, consentmanager will register as an official CMP and automatically add support for IAB Canada TCF. Publishers will not need to perform changes on their website – all additional settings can be applied directly within our system.
Further reading: IAB Canada TCF Policy