The TCF Vendor List: The Thousand-Vendor Problem on Your First Layer

A visitor opens the consent banner, taps the vendor list, and finds a thousand names. A thousand vendors, each with a purpose, a legal basis, and a privacy policy link, and the visitor is supposed to read the list and make an informed choice. Nobody reads a thousand vendors. The list is the problem, and the count is the story.

The count is the story

The IAB Transparency and Consent Framework, TCF, maintains a global vendor list, and the list has grown past a thousand vendors. Each vendor registers its purposes and legal bases, and each CMP pulls the list and shows it to the visitor. The growth is structural: every ad tech company that wants to operate under the framework registers, and the registration is open, so the list only grows. The visitor sees the result: a list no human can read, presented as the basis for an informed choice.

TCF 2.2 changed the display rules: the vendor count has to appear on the first layer, so the visitor sees the number before they tap through. TCF 2.3 went further and made disclosed vendors mandatory, so the CMP has to show which vendors are actually present, not just the ones that registered. The TCF 2.2 and 2.3 post covers the legitimate interest change: purposes 3 to 6 can no longer rely on it, and the vendor count is now on the first layer where the visitor cannot miss it.

The count matters because it is the only number on the first layer that tells the truth about the scale of the data sharing. A banner that says a thousand vendors is a banner that admits the visitor's data goes to a thousand companies. The honesty is the point, and it is also the problem: a visitor who sees the number is less likely to accept, and the CMP that hides the number is non-compliant.

Why the list got that long

The list got long because the framework is open and the ecosystem is large. Every company in the ad tech chain, from the demand-side platform to the data broker to the measurement vendor, registers, because registration is the price of operating under the framework. The CMP shows all of them, because the framework requires the full list to be available, and the visitor is expected to choose among them, purpose by purpose, vendor by vendor.

The choice is fictional. No visitor reads a thousand vendors, and no visitor makes a purpose-by-purpose decision across a thousand companies. The real choice the visitor makes is accept all or reject all, and the vendor list is the documentation of a choice nobody makes. The accept-all and reject-all parity post is the same problem from the banner side: the choice that matters is the binary one, and the granularity is theatre.

The CMP vendors know this, and the better ones have started to group the list: by purpose, by category, by the vendors actually present on the page. The grouping is the honest version of the list, because it shows the visitor the vendors that will actually receive their data, not the thousand that registered.

The three cuts that make it readable

First, show only the vendors actually present on the page. The TCF 2.3 disclosed-vendors rule requires it, and the list drops from a thousand to the dozens that are actually there. The opt-in rate benchmark post shows why this matters: a shorter list is a list the visitor might actually read, and a list the visitor reads is a list that supports a real choice.

Second, group by purpose, not by vendor. The visitor cares whether their data is used for personalised ads, not whether vendor 842 or vendor 913 does it. The purpose is the decision. The vendor is the detail.

Third, put the count on the first layer and stop apologising for it. The count is the honest number, and the visitor who sees it and accepts has made an informed choice. The visitor who sees it and rejects has also made an informed choice. Either way the consent is real, and the record will show it.

Frequently asked questions

How many vendors are on the IAB TCF global vendor list?

More than a thousand. Every ad tech company that wants to operate under the framework registers, and registration is open, so the list only grows. The visitor sees the result as a list no human can read.

What changed in TCF 2.2 and 2.3 about vendor disclosure?

TCF 2.2 put the vendor count on the first layer, so the visitor sees the number before tapping through. TCF 2.3 made disclosed vendors mandatory, so the CMP has to show which vendors are actually present on the page. TCF 2.2 also removed legitimate interest as a legal basis for purposes 3 to 6.

Do visitors actually read the vendor list?

No. Nobody reads a thousand vendors. The real choice the visitor makes is accept all or reject all, and the vendor list is documentation of a choice nobody makes purpose by purpose. Grouping by purpose, and showing only the vendors actually present, makes the list readable.

Should my CMP show all TCF vendors or only the ones on my site?

Only the ones actually present. TCF 2.3 requires disclosed vendors, and the list drops from a thousand to the dozens that are actually there. A shorter list is one the visitor might read, and a list the visitor reads supports a real choice.