Adapting to Global Privacy Laws: GDPR, CCPA, and Beyond in 2026

Two dates in the first quarter of 2026 decide how much of your inventory can still carry personalized ads. Three new United States state privacy laws took effect on January 1, 2026, and starting March 1, 2026, IAB Europe deems any TC string created without the disclosedVendor segment invalid. If your CMP has not shipped v2.3 string logic by the second date, EEA and UK traffic drops out of personalized demand overnight, because Google only serves personalized ads to traffic that a TCF certified CMP produced. We run consent plumbing for thousands of publishers across four regions, and the January audit always returns the same finding: the legal arguments settled last year. The engineering work did not.

The calendar to pin above the desk

Five dates govern the stack. Two sit in the past, two land this quarter, and one enforcement theme runs the full year. This is the working version:

• January 16, 2024: Google requires a CMP that holds TCF certification and integrates with the framework for personalized ads in the EEA and UK. Certification decides eligibility, integration alone does not.
• July 31, 2024: the same requirement extends to Switzerland.
• January 1, 2026: the Indiana, Kentucky and Rhode Island statutes take effect. As of January 2026, IAPP's tracker of United States state privacy legislation counts 19 enacted comprehensive state privacy laws, and a later industry tracker counts twenty states by including Florida's narrower law, so the two tallials disagree on where the line sits.
• February 28, 2026: the TCF v2.3 transition period ends. The framework arrived mid-2025, and the grace window closes here.
• March 1, 2026: any TC string created without the disclosedVendor segment turns invalid, regardless of what the user agreed to earlier.

Everything beyond those dates is enforcement pressure. The EDPB's Coordinated Enforcement Framework action for 2026 targets the GDPR obligations of transparency and information, which means national authorities will read privacy notices and CMP layers, not just bid logs. Publishers that clear these dates in January keep their personalized revenue intact.

Legitimate interest already left the TCF

The consent mechanics you must fix this quarter did not appear this quarter. TCF v2.2 removed the legitimate interest legal basis for advertising and content personalization, so vendors may only rely on consent for Purposes 3, 4, 5 and 6. A vendor can no longer claim it processed your users' data under a balancing test: either the user consented to that purpose, or the vendor must decline the impression.

That single change turns consent rate into a yield metric. When Purposes 3 through 6 depend on an explicit yes, the notice layout, the vendor list length and the per-purpose toggles all move revenue, not just paperwork. Watch three numbers weekly: consent rate by geography, vendor list length against consent decline, and the eCPM gap between personalized and non-personalized lines. If consent rate falls while the vendor list grows, the string is telling you something the dashboard is not.

Add a vendor audit to the quarterly rhythm. Ask each vendor on your list which purposes it actually reads, what it does when Purpose 3 consent is absent, and whether it falls back to contextual processing. Vendors that cannot answer in writing do not belong on the list, because each of them owns its own legal basis, and you inherit the reputational half of that risk.

What the Brussels appeal actually decided

On May 14, 2025, the Brussels Court of Appeal issued a judgment that closes the TCF's largest open legal question. The court found that IAB Europe failed to establish a valid legal basis under Article 6(1) GDPR, and it annulled the original 250,000 euro fine solely on procedural grounds while confirming the substance of the findings. The court also noted that TCF v2.2 did not come under review in the case, since the dispute concerned the earlier version.

Read correctly, the judgment tells you three things. First, the framework survives as market plumbing: no authority ordered publishers off the TCF. Second, a TC string transmits a claim, it does not discharge anyone's obligations, and each vendor still answers for its own legal basis. Third, your defense as a publisher is documentation: which CMP build ran on which date, which Global Vendor List version, which notice text, and where the consent logs live. Keep those four answers ready, and a supervisory authority letter becomes an afternoon of exports instead of an archaeology project.

The disclosedVendor segment, and what your CMP owes you

TCF v2.3 adds one structural change that touches every string you serve: the disclosedVendor segment records which vendor IDs the notice actually displayed at the moment of consent. The transition window opened with the framework's mid-2025 release and closes on February 28, 2026. From March 1, 2026, a string without that segment does not parse as valid, and buyers treat it as absence of consent for personalization. The official TCF v2.3 transition guide from IAB Europe covers the full migration mechanics, including how to handle consent that devices already hold from v2.2 strings.

Your CMP vendor owns most of the migration, but you own the verification. Work through this list in order:

• Confirm the production build generates v2.3 strings, then decode a sample from each geography rather than trusting release notes.
• Rebuild the vendor list so the notice discloses every vendor that actually receives data, including server-side paths, because the segment only covers what the notice showed.
• Plan for re-prompting where stored consent no longer maps to a valid string, and measure the consent dip against your non-personalized floor.
• Re-run the audit after the cutover on March 1, 2026, since CMP builds may roll out by region.

Google's gate on top of the framework

Google wrote the commercial enforcement layer on top of the TCF, and it works like a filter with two conditions. Since January 16, 2024, personalized ads in the EEA and UK require a CMP that holds TCF certification and integrates with the framework, and since July 31, 2024, the same rule covers Switzerland. Only traffic from a certified CMP qualifies for personalized ads, and Google's consent management requirements spell out the certification and integration conditions in full.

Two failure modes show up in practice. A CMP that integrates with the TCF but never obtained certification keeps your traffic out of personalized demand, no matter how cleanly it captures consent, so check the certification listing rather than the vendor's sales page. A certified CMP running an outdated build can also serve strings that fail downstream checks, which is why the version checks in the previous section matter. In Ad Manager, segment delivery by consent type: personalized, non-personalized, and unmatched consent. Treat growth in the unmatched bucket as a plumbing fault, not as user behavior.

The United States: nineteen laws, one signal

State privacy law stopped being a California-only problem this winter. The Indiana, Kentucky and Rhode Island statutes took effect on January 1, 2026, and as of that date IAPP's tracker counts 19 enacted comprehensive state privacy laws across the country. A later industry tracker counts twenty states by including Florida's narrower law, and the discrepancy is a feature of the patchwork rather than an error: states define the regulated conduct differently, so the same data flow can fall under one statute and skip its neighbor.

The one signal that cuts across the patchwork is Global Privacy Control. Under CCPA, businesses must treat a user-enabled GPC signal as a legally valid consumer request to opt out of the sale of their data, and the Global Privacy Control specification defines how a browser transmits it through the Sec-GPC header. States then differ on scope: some statutes cover the sale of data, others add sharing for cross-context targeted advertising, and the mapping between the signal and the obligation belongs to you, not to the browser vendor.

Operationally, handle GPC at three layers. At the edge, read Sec-GPC before any tag fires and treat an enabled signal as an opt-out under the scope of the user's state. At the sell side, carry the resulting signal into the bid request rather than stripping it, because buyers price the difference. At the CMP, keep the United States controls separate from the GDPR interface: the two regimes use opposite defaults, since GDPR consent starts from refusal while state opt-outs start from silence.

Consent in the bid request, on both sides

Buyers act on consent mechanically, not philosophically. A bid request that carries a valid v2.3 string with vendor consent draws full demand, a request with restrictions draws thinner bids, and a request with an invalid string draws whatever contextual demand remains. On the buy side of our house, buyers reach verified audiences over OpenRTB 2.6 through curated supply paths, and they bid on consent state explicitly, so a broken string costs a publisher twice: eligibility and bid density.

If you run Prebid, the wiring is short. The consentManagement module pulls the TC string from the CMP through the TCF API and attaches it to every outgoing request, and the same module carries the United States signals. Test it after every CMP upgrade, because the module reads whatever the CMP exposes, including a version it has never seen. On the reporting side, our ten minute reporting console puts consent rate next to fill and eCPM by geography, so a drop appears in the same view as the revenue it caused, and payment terms stay fixed at Net 30, CPM based.

Transparency is the 2026 enforcement theme

The EDPB's Coordinated Enforcement Framework action for 2026 targets the GDPR obligations of transparency and information, which moves the review from bid logs to the front of house. Expect authorities to check whether your notice matches reality: whether the vendor list in the CMP equals the vendors that receive data, whether the descriptions of Purposes 3 through 6 read like a person wrote them, and whether a user can identify the controllers behind each vendor ID from the first layer. Update the notice whenever the vendor list changes, not on a quarterly cycle, because transparency obligations attach to the current state of your stack.

Transparency extends to what you claim about the inventory itself. Every impression in our marketplace passes pre-bid screening and MFA filtering, aligned to the IAB Content Taxonomy, because a buyer who catches a mislabeled placement does not return with a bid. The same logic applies to agencies advising publishers: put consent rate, string validity and notice accuracy into every quarterly review next to fill and viewability, and treat any of the three slipping as a revenue event rather than a legal formality.

What we run, and why the plumbing pays

We are an ad network, an SSP and an agency in one company, and OnlyMedia pays publishers Net 30, CPM based, with no chasing and no sliding terms. We work with thousands of publishers, each above one million monthly pageviews, across North America, South America, EMEA and APAC, and our curated programmatic demand network exists because consent discipline and yield are one problem seen from two sides of the bid request. Clean strings, disclosed vendors and honest inventory labels raise what buyers pay for the same impressions, and broken plumbing lowers it faster than any market shift. Most publishers that fix consent infrastructure lift revenue without adding a single demand partner.

The Q1 audit, on one page

Run this as a single pass, in this order, and log every answer with a date:

1. CMP certification status for the EEA, UK and Switzerland, checked against the official listing.
2. TCF version the CMP serves in production, with the build date.
3. Equality between the notice vendor list and the vendors that receive data, including server-side paths.
4. GPC handling: whether the edge treats Sec-GPC as an opt-out under the correct state scope, and whether the signal survives into the bid request.
5. Consent rate by geography and CMP version, trended weekly against fill and eCPM.
6. The eCPM gap between personalized and non-personalized EEA lines, as the number you defend to finance.
7. Notice text against the current vendor list and purpose descriptions, ahead of the transparency-focused enforcement year.
8. A named owner and location for CMP versions, Global Vendor List versions, notice versions and consent logs.

If every line passes, February 28, 2026 is a non-event on your calendar. If any line fails, the order above is also the repair order, because each fix depends on the one before it.

The cost of waiting

From March 1, 2026, every string your CMP produced before the v2.3 cutover fails, and Google's eligibility rules already exclude uncertified CMP traffic in the EEA, UK and Switzerland. The United States carries its own asymmetry: GPC counts as a legally valid opt-out request under CCPA, so a stripped header equals an ignored request, with or without a complaint. The transparency action then runs all year, and the publishers who clear this in January price their inventory on data quality. The ones who wait until March price it on apology.