TCF 2.2 consent setup for GDPR and KVKK publishers

A TCF 2.2 banner built honestly lands consent between 70 and 88 percent on editorial traffic in Turkey and Western Europe. If your CMP reports 95 percent, the banner is almost certainly non-conforming, and the number you are proud of is the number that will be quoted back at you. TCF 2.2 removed legitimate interest as an available legal basis for Purposes 3 through 6, the personalisation and profiling purposes. Any vendor still passing legitimate interest for ad personalisation in your string is passing a signal buyers discard. The specification also requires the first layer to state the number of vendors, to name purposes in plain language rather than the old legal phrasing, to publish retention periods, and to make withdrawal as reachable as consent. Most banners we inherit fail on the last one: accepting takes one tap, withdrawing takes a footer link, a modal and a scroll. The migration itself: We work with Sourcepoint, Didomi, Usercentrics and InMobi Choice, and we will tell you which one fits before you sign anything. The answer turns on whether you need server-side consent retrieval, how many domains share a consent scope, and whether you genuinely intend to operate a paid alternative. We cut the vendor list down from the full Global Vendor List, because a publisher declaring eight hundred vendors is asking a reader to accept a supply chain the publisher cannot itself describe. Consent Mode v2 is wired so that ad_user_data and ad_personalization derive from the TC string rather than from a second, contradictory source, and we handle Google's Additional Consent string for ad technology providers, which sits outside TCF and is routinely missed. Where the revenue actually leaks: Timing. Prebid's consent module ships with a timeout longer than any auction is willing to wait, and the usual failure is not legal, it is that the CMP resolves after the auction starts and bids arrive with no string attached. We set the auction delay and the timeout against your measured CMP resolution at the 95th percentile, not against a default, and we instrument the miss rate so it appears in your reporting instead of surfacing months later as unexplained fill loss. Purpose 1 enforcement also drops bidders lacking storage consent, which is correct behaviour and needs to be visible rather than mysterious. KVKK, for Turkish inventory: Turkish law asks for acik riza, explicit, informed, freely given and purpose-specific. The Board's guidance on cookies treats non-essential storage the same way. A TCF banner covers most of it, but the Turkish layer has to be a real translation of the purposes rather than the English strings put through a machine, and the data controller identity has to match your registered entity. We write that layer ourselves, in Turkish, and we would rather argue with you about a phrase than ship a translation neither of us can defend. What we refuse to build: A banner engineered to fail. No reject button placed a click deeper than accept, no pre-ticked switches, no interface where the prominent action is consent and the quiet action is also consent. If you want a consent wall, it needs a real paid alternative at a defensible price, and we will build that. We will not build the version where the alternative exists on paper. We are not lawyers. We do not review your processing agreements, we do not sign off on your records, and we will never tell you a configuration is legal. We tell you what the specification requires, what your buyers check, and what we would deploy on a property of our own. This is the wrong engagement if the plan is to keep a legacy banner and bolt a TC string onto it. That combination passes automated conformance and fails the first complaint.