# TCF 2.2 and 2.3: Legitimate Interest Is Gone for Purposes 3 to 6, and the Vendor Count Is Now on the First Layer

Source: https://consentfort.com/blog/2026-11-10-tcf-2-2-2-3-legitimate-interest-vendor-count.html

Your CMP offers legitimate interest as the legal basis for personalised ads. It should not. TCF 2.2 removed legitimate interest for purposes 3 to 6, and if your consent interface still lists it, your CMP is running a version of the framework that no longer exists. The vendor count on the first layer is the visible part. The legal basis change is the part that matters.

## Legitimate interest is gone for advertising

The IAB Transparency and Consent Framework, TCF, is the standard most of European programmatic advertising runs on, and version 2.2 changed the legal basis rules in a way that breaks older setups. Legitimate interest was removed as an available legal basis for purposes 3 to 6: personalised advertising, personalised content, advertising measurement, and content measurement. Consent is the only basis for those purposes now. Legitimate interest remains for the security and technical purposes, purposes 1 and 2, which is where it always belonged. A publisher whose CMP still shows legitimate interest as an option for advertising purposes is not making a choice between two valid bases. It is running a framework version that the IAB retired, and the consent strings it generates do not mean what the vendors receiving them think they mean.

The change was not a surprise. The Belgian Data Protection Authority's ruling on the TCF, and the IAB's own action plan that followed it, made the direction clear well before 2.2 shipped: the framework had to stop letting publishers claim a legitimate interest in showing a visitor personalised ads. The vendors that process data under TCF read the consent string, not your privacy policy, and a string that claims legitimate interest for purpose 3 will be treated as a valid signal by a vendor that has not updated its own parsing. The mismatch is the liability: your CMP says one thing, the vendor does another, and the regulator reads the string.

## The vendor count moves to the first layer

TCF 2.2 also requires the number of vendors a publisher works with to appear on the first layer of the consent interface. That number is the fact that changes the decision. A banner that says we work with partners, with the count buried two clicks deep behind a settings link, does not inform the visitor. A banner that says we share data with 412 vendors does, even if the visitor never reads the list. The count is the scale of the sharing, and the scale is what the visitor is actually consenting to. Publishers who fought this requirement understood it perfectly: the count is the one number that makes people pause, and that is exactly why it belongs on the first layer. Alongside it, TCF 2.2 deprecated the getTCData API, the old way vendors read the consent state, in favour of the newer signal APIs. A vendor integration that still calls getTCData is reading a deprecated interface, and the CMP that still serves it is behind.

TCF 2.3, which followed, made the disclosedVendors field mandatory from March 1, 2026. Publishers must disclose the vendors they share data with, not just count them. A CMP running 2.2 without the 2.3 disclosure is behind the current standard, and the gap is not cosmetic: disclosed vendors is the field that lets a visitor, a regulator, or an auditor verify who actually received their data, rather than taking the publisher's word for it.

## The check that takes an afternoon

Open your consent interface, reject everything, and read the consent string your CMP generates. Check which legal basis it claims for purposes 3 to 6. If it says legitimate interest, your CMP needs an update, not a configuration change. Check the first layer for the vendor count. If the count is missing, or the count is there but the vendor list is two clicks away, the interface does not meet 2.2. Check whether disclosedVendors is populated. If it is empty, you are not on 2.3. And check which API your vendors call to read the state. If any of them still call getTCData, they are reading a deprecated interface and their integration needs updating. None of this is a redesign. It is a version check, a string read, and a first layer read. The framework changed. The question is whether your CMP changed with it.

Keep reading: [Accept All and Reject All: Parity Is Not Optional Anymore](2026-11-08-consent-banner-accept-all-reject-all-parity.md), [Consent Opt-In Rates: What a Good Number Looks Like, and What It Hides](2026-11-07-consent-opt-in-rate-benchmark.md), [Consent receipts: what to store and for how long](2026-11-06-consent-receipts-what-to-store-how-long.md).

## Frequently asked questions

### What changed in TCF 2.2?

Three things. Legitimate interest was removed as a legal basis for purposes 3 to 6, which cover personalised ads and content, ad measurement, and content measurement. The number of vendors a publisher works with must appear on the first layer of the consent interface. And the getTCData API was deprecated in favour of the newer consent signal APIs.

### What does TCF 2.3 add?

TCF 2.3 made the disclosedVendors field mandatory from March 1, 2026. Publishers must disclose the vendors they share data with, and the framework tightened the requirements around how vendor information is presented. A CMP running 2.2 without the 2.3 disclosure is behind the current standard.

### Can I still use legitimate interest for advertising under TCF?

No. Under TCF 2.2, legitimate interest is no longer an available legal basis for purposes 3, 4, 5, and 6, which are the advertising purposes. Consent is the only basis for those purposes now. Legitimate interest remains available for the security and technical purposes, which is where it always belonged.

### Why does the vendor count have to be on the first layer?

Because the number of vendors is the fact that changes the decision. A banner that says we work with partners, with the count buried two clicks deep, does not inform the visitor. TCF 2.2 requires the count on the first layer so the visitor sees the scale of the sharing before they choose.