Lacuna, a programmatic advertising technology company headquartered in Singapore, today said it has registered as a vendor in IAB Europe's Transparency & Consent Framework and is listed on the Global Vendor List under Vendor ID 1648. The registration gives consent banners on European websites and apps a standard way to name the company and record whether users accept or object to its data processing.

In Short

Lacuna, an ad tech company from Singapore, has signed up to the industry rulebook that European websites use to ask visitors for permission before ads track them, and it now has its own number, 1648, on the shared list of ad companies. That number is how a website's cookie banner tells Lacuna whether you said yes or no. Being on the list does not prove a company follows European privacy law, but it does put Lacuna under IAB Europe's own checks, which can suspend vendors that break the rules.

What Lacuna registered as

Lacuna distributed the announcement today with a Singapore dateline. According to the company, the company joined the framework "as a registered vendor" and now appears on the Global Vendor List (GVL) under ID 1648. That distinction matters. The framework has two categories of participant: vendors, which are the ad tech companies that receive users' choices, and consent management platforms, which are the tools publishers use to display banners and collect those choices. Lacuna registered in the first category. Nothing in the announcement suggests it operates or plans to operate a consent management platform.

A vendor ID is the practical consequence. Every TC string, the encoded record a banner writes after a user makes a choice, refers to vendors by their numeric GVL IDs. When a publisher using a framework-compliant banner adds Lacuna to its vendor selection, ID 1648 becomes the slot in which that user's consent or objection for Lacuna is recorded and passed along the programmatic supply chain. Without an ID, a company cannot be named in that string at all.

The ID is not a count. IAB Europe's own compliance report, published in March 2026, put the number of registered vendors at 953 at the end of 2025, up from 885 a year earlier, with 154 joining during 2025. IDs above that figure reflect the way numbers are assigned over time to companies that join and leave; this is an inference from the gap between the two numbers rather than something Lacuna or IAB Europe states.

What the announcement leaves out

Several technical details that would normally accompany a GVL entry are absent from the release. Lacuna does not say which TCF policy version or specification it registered under, although TCF v2.3 has been the operative technical standard since its mandatory deadline at the start of March 2026. It does not list the purposes it declared, the legal basis it relies on for each one, whether it claims legitimate interest for any processing, or whether it uses either of the framework's special features, such as precise geolocation. It also gives no maximum cookie storage duration, no data retention periods and no detail on whether it shares data with other vendors. All of these are fields published on the GVL itself rather than in a press release, so the release's silence does not mean the information is missing from Lacuna's registration. It means only that the company chose not to describe it.

Lacuna and its products

According to Lacuna, Lacuna Ads is "the company's programmatic advertising ecosystem," made up of an ad exchange, what the company calls "an intelligent demand-side optimisation platform," and "a full-stack self-service SaaS platform." The company describes the business as "supported by owned-and-operated (O&O) inventory and direct publisher relationships." In its boilerplate, Lacuna says it was founded in 2022 and claims what it describes as "a distinct edge across key markets in North America, Europe, and Asia-Pacific." That is the company's own characterisation, and the release provides no revenue, traffic or European market share figures to support it.

The release itself does not name the individual products. A September 30, 2026 report by TechNode Global on the launch of Lacuna Ads identified them as Lacuna Axis, the exchange; Lacuna Engine, for demand-side bidding and buying optimisation; and Lacuna Agent, a self-service platform. The same report cited more than 2.4 billion installs across Lacuna's utility and gaming apps, more than 200 billion daily requests and 180 million daily impressions. Those figures were supplied by the company and have not been independently verified.

The owned-and-operated inventory is relevant to the TCF registration. If a significant part of Lacuna's supply comes from its own mobile apps, then Lacuna occupies two positions at once in some transactions: publisher, deciding which vendors to show users, and vendor, receiving those choices. The release does not say whether Lacuna's own apps use a TCF-registered consent tool in the European Economic Area.

What the company says it will do next

The release attaches a single named quote. "Programmatic growth and respect for user privacy should advance together," said Michael Wang, CEO of Lacuna, according to the company. Wang described the framework as providing "an important shared foundation for advancing this vision responsibly, with transparency, user choice and accountability reflected in how we design and operate our systems."

The forward-looking commitment is modest and undated. According to Lacuna, the company "will continue to refine its systems and processes in line with TCF Policies and technical specifications, supporting more consistent handling of consent and objection signals across relevant services in Europe." The release does not say which services are covered, nor when the refinement will be complete. Is registration therefore the end point, or the start of integration work? The wording points to the latter.

How the framework works, and what it does not guarantee

Much of the release restates IAB Europe's own description of the TCF. It says the framework "was launched in April 2018" and is "a cross-industry voluntary standard that relies on standardisation to facilitate compliance with certain provisions of the ePrivacy Directive and the GDPR." The operative word is facilitate. Participation is voluntary, and registration is not a regulatory approval; data protection authorities enforce the ePrivacy Directive and the GDPR, not IAB Europe.

The legal position of the framework itself has been contested for years. The Belgian Data Protection Authority fined IAB Europe €250,000 on February 2, 2022. On March 7, 2024, the Court of Justice of the European Union held in Case C-604/22 that TC strings can be personal data when they can be linked to identifiers such as IP addresses, and that IAB Europe can be a joint controller for their processing. The Belgian Market Court then ruled on May 14, 2025 that IAB Europe's joint controllership covers TC strings within the framework but not later processing under OpenRTB, while keeping the fine. On January 7, 2026, the same court annulled the authority's 2023 validation of IAB Europe's action plan, finding that IAB Europe's right to be heard had been violated.

For vendors such as Lacuna, the more immediate consequence is IAB Europe's own enforcement. The organisation began auditing registered vendors in 2021, giving non-compliant companies 28 calendar days to fix problems before suspension from the GVL, with a fourth breach in 12 months triggering an immediate suspension of at least 14 days. The pace has picked up. Vendor enforcement procedures reached 587 in 2025, up from 269 the year before, and temporary vendor suspensions rose from 23 to 41, according to IAB Europe's report as covered by PPC Land. Crawlers flagged incorrect device storage disclosure URLs in 155 procedures, and 332 vendors were audited for mismatched storage disclosures. A newly listed vendor enters that regime from its first day on the list.

Timing

The registration lands during a period of policy change for the framework. IAB Europe released TCF Policies v5.0.b on May 29, 2026, adding rules on consent carried across devices, standard explanation texts for features, and a renamed Special Feature 2, "Identify devices based on information actively requested," with guidance that covers Client Hints used for fingerprinting. The update removed a legitimate interest workaround for vendors declaring only special purposes. Compliance deadlines for consent tools were set for mid-October 2026 on the web and mid-February 2027 for native apps and connected TV, with exact dates still to be confirmed at the time. Lacuna's announcement does not refer to the policy update.

Mobile apps are the environment where Lacuna's own inventory appears to sit, based on the TechNode report, and where the later deadline applies.

Why this matters for advertisers and publishers

For publishers in Europe that sell through Lacuna's exchange, the change is mechanical but real. A publisher running a framework-compliant banner can now add vendor 1648 to its list and pass a valid signal about Lacuna in its TC strings. Platforms that read the string check vendor IDs before processing data. Google, for instance, made TCF v2.3 mandatory for publishers using its products from early 2026 and validates whether its own vendor ID, 755, appears in the disclosed vendors segment. The same logic of named, numbered vendors governs smaller exchanges.

There is also a cost to the user side of the equation. Every new GVL entry lengthens the list of partners that a publisher can choose to display. Banners carrying more than a thousand partners have drawn complaints; noyb filed one against dict.cc on July 30, 2026, citing 1,741 partners behind a single accept button, although that banner was not built on the TCF.

For buyers, a GVL listing is a minimum condition rather than a quality mark. It shows that Lacuna has declared, in a standard machine-readable form, what it does with data and on what basis. Whether its systems actually honour the signals is a separate question, and Lacuna's own statement that it will "continue to refine its systems and processes" suggests that work is ongoing.

Timeline

Summary

Who: Lacuna, a Singapore-headquartered programmatic advertising technology company founded in 2022 and led by CEO Michael Wang, which operates the Lacuna Ads exchange and buying platforms.

What: Lacuna registered as a vendor in IAB Europe's Transparency & Consent Framework and is listed on the Global Vendor List under Vendor ID 1648. It did not register as a consent management platform, and the announcement does not disclose its declared purposes, legal bases, policy version or special features.

When: The registration was announced today, October 16, 2026, around the mid-October web compliance deadline for TCF Policies v5.0.b and ahead of the February 2027 deadline for apps and connected TV.

Where: The framework applies to publishers and vendors handling data of users in Europe; Lacuna says it is expanding its presence in the European programmatic market.

Why: A GVL ID is required for consent tools on European sites and apps to record users' choices about a vendor in TC strings, which many exchanges and platforms rely on before processing data. The listing also places Lacuna under IAB Europe's vendor audits and suspension regime, which recorded 587 enforcement procedures in 2025.