TCF Vendor Lists: Why 900 Vendors on Your Banner Is a Liability
Open your consent banner's vendor list and count. The IAB Transparency and Consent Framework's Global Vendor List now runs past 900 vendors, and your banner offers the visitor a choice across all of them, one toggle at a time, in a list nobody has ever read to the end. That is not transparency. It is a liability, and the Belgian data protection authority said so in 2022, when it ruled that the TCF mechanism itself violated GDPR, specifically because consent obtained through a list that long could not be freely given.
The ruling did not kill the TCF. The IAB settled with the Belgian authority and released TCF 2.2, which removed legitimate interest for advertising purposes and tightened the withdrawal and disclosure rules. But the underlying tension never went away, and it is the first thing a regulator looks at when a banner is challenged: can a real visitor make a real choice here, or is the list itself the dark pattern.
What the Belgian ruling actually said
In 2022 the Belgian DPA, the APD, ruled that the IAB TCF mechanism violated GDPR. The core finding was about informed consent: a consent string built from a vendor list of more than 900 entries, with purposes described in legal language, does not produce a freely given, specific, informed choice, because no visitor can evaluate 900 vendors. The European Data Protection Board supported that view, and the IAB's settlement produced TCF 2.2, with its removal of legitimate interest for purposes 3 through 6, its requirement that CMPs show the total vendor count on the first layer, and its tighter rules on withdrawing consent.
TCF 2.2 also added a requirement that matters for this post: CMPs must display vendor names, purposes, and data retention periods more prominently, and users must be able to object to legitimate interest processing directly from the first layer of the interface. The direction of travel is clear. Every version since the ruling has pushed the vendor list toward the surface, and every version has made it harder to hide the list behind three clicks.
What your vendor list should look like
Start with the count on the first layer. TCF 2.2 requires it, and a banner that hides the number is behind the current version. Then check what the list contains. Most sites show every vendor in the Global Vendor List, including hundreds the site has never used, because the CMP defaults to the full list. The fix is publisher restrictions: the TCF mechanism lets a publisher restrict which vendors can process data on its properties, and a site that restricts the list to the vendors it actually uses turns a 900-line list into a 20-line one. The consent becomes more informed, and the banner becomes shorter, in the same change.
Then check the purposes. TCF defines 11 standard purposes, and each vendor declares which purposes it relies on and whether it uses consent or legitimate interest. Under TCF 2.2, legitimate interest is no longer available for purposes 3, 4, 5, and 6, the advertising and personalization purposes. A vendor still claiming legitimate interest for those purposes is running an old configuration, and the string it writes is the evidence.
The check to run this week
Open the banner, count the vendors on the first layer, and compare that number to the vendors your site actually uses. The gap between those two numbers is the size of your liability, and it is also the size of the fix. Apply publisher restrictions, re-test the banner, and check that the TC string changes when a purpose is switched off. A banner that records the click but leaves the string untouched is the most common failure in this whole chain, and it is invisible until you look at the string.
And check the version. TCF v2.3 became mandatory for newly generated strings on February 28, 2026, and TCF v2.4 specifications were published July 23, 2026, with a web deadline of October 23, 2026. A CMP still writing v2.2 strings is behind two versions, and the vendor list it shows is the least of its problems.
Keep reading: The Best OneTrust Alternatives for 2026, Test the Denied State. That Is Where Consent Actually Lives., and One Brand, Several Domains: Keeping Consent State Coherent Across Subdomains cover the nearby cases in this series.
Frequently asked questions
How many vendors are on the IAB TCF Global Vendor List?
More than 900. The list has grown past 900 vendors, which is why the Belgian DPA ruled that consent obtained through the full list could not be freely given or informed.
What did the Belgian DPA rule about the TCF?
In 2022 it ruled the TCF mechanism itself violated GDPR, because consent through a 900-plus vendor list could not be freely given. The IAB settled and released TCF 2.2, which removed legitimate interest for advertising purposes and tightened disclosure rules.
Can I limit which vendors appear on my banner?
Yes, through publisher restrictions. The TCF lets a publisher restrict which vendors can process data on its properties. Restricting the list to vendors you actually use turns a 900-line list into a short one and makes consent more informed.
Does TCF 2.2 still allow legitimate interest for advertising?
No. Under TCF 2.2, legitimate interest is no longer available as a legal basis for purposes 3, 4, 5, and 6, the advertising and content personalization purposes. Those require explicit consent.