What does the decision mean for businesses in the online marketing industry?
On 14 May, the Brussels court of appeal handed down the final ruling – at least for the time being – in the long-running dispute between the online marketing industry association IAB Europe and the Belgian data protection authority APD (case no. 2022/AR/292). While the original decision of the data protection authority was dismissed on procedural grounds, the court confirmed several of its most important substantive findings. The judgement has far-reaching consequences for the Transparency and Consent Framework, the industry standard developed by IAB Europe for the collection and use of tracking consent in online advertising.
According to our assessment of the judgement, IAB Europe will now probably have further ‘update’ the TCF standard in addition to the adjustments already made in version 2.2. Businesses that rely on the TCF should keep an eye on how the judgement will be implemented.
Background of the case
In February 2022, the Belgian data protection authority issued a much-discussed decision stating that IAB Europe’s TCF standard violated the General Data Protection Regulation (GDPR) in several respects. The APD had come to the conclusion that IAB Europe would have to be regarded as a joint controller of the businesses handling TCF-based user consent data (‘consent signals’). It imposed a fine of €250, euros and instructed IAB Europe to make a number of adjustments to the TCF standard.
IAB Europe appealed against the decision, upon which the Brussels judges initially referred a number of preliminary questions to the European Court of Justice. In its judgement of March 2024, the ECJ then confirmed that the user-specific consent codes (‘TC Strings’) are indeed personal data and that IAB Europe must be considered a joint controller when processing it. The judgement that has now been handed down implements the ECJ’s preliminary ruling and closes the case for now.
Content of the judgement
Although the Brussels court of appeal annulled the decision of the Belgian data protection authority due to procedural flaws, it largely confirmed its substantive conclusions:
- The consent codes (“TC Strings”) are personal data, so the GDPR is fully applicable to their processing. We had shared this assessment since the beginning of the debate – on the condition that one considers the TC string together with the respective tracking identifiers – and have already implemented it with our clients.
- With regard to the creation, storage and forwarding of TC Strings, IAB Europe, together with the businesses participating in the TCF, must be regarded as ajoint controller under data protection law. The court of appeal thus aligns with the existing reasoning of data protection authorities and courts that continue to expand the scope of joint controllership under the GDPR.
- IAB Europe must ensure that there is a legal basis for the processing of TC Strings (i.e. the consent of the affected users).
- Furthermore, additional steps must be taken with regard to transparency and data security when processing TC strings.
- The €250,000 fine imposed on IAB Europe was upheld.
Practical consequences of the judgement for businesses that place or display online advertising on the basis of the TCF
Even though IAB Europe had already made adjustments to the TCF in response to the decision of the Belgian data protection authority and switched to version 2.2 in May 2023, the ruling will require a further revision of the TCF standard. This could look as follows:
- It can be assumed that the participation agreement on which the TCF is based will be supplemented by an agreement on joint controllership in accordance with art. 26 GDPR regarding the processing of TC Strings. In this agreement, the participating businesses would (only) be contractually required to comply with transparency regulations and to properly manage consent; in addition, the agreement would assign responsibilities, in particular for responding to data subject requests. For businesses participating in the TCF that have already properly implemented TCF 2.2 , the practical significance of this change will be minimal.
- One way of creating a sufficient legal basis for the creation, storage, and transmission of TC Strings would be the additional processing purpose(“Consent Purpose”) already added in the switch to TCF 2.2, which is routinely requested from users. All businesses that receive and use this data as so-called Vendors have already been asked by IAB Europe to amend their registration accordingly. It could therefore be worthwhile checking the correct implementation of this requirement once again. However, those who only act as publishers within the TCF still do not need to do anything except use a TCF-compliant CMP service for the consent prompt shown to their users.
- Publishers as well as ad tech businesses (Vendors) now need to be more strict when monitoring compliance with the requirements for TCF participants – which should ultimately benefit the entire online marketing industry.
An alternative approach for IAB Europe would be to rewrite the participation agreement for the TCF in such a way that it reduces its own role even further to ideally avoid its joint controllership role altogether. This would then even further reduce the practical consequences of the new decision.
However, as the opposite can sometimes be read online, it should be emphasised once again at this point: In all likelihood, the fundamental architecture of the TCF will not change as a result of this judgement.
Outlook
For businesses that place or display online advertising on the basis of the TCF, the current decision can serve as an opportunity to review their own TCF compliance – we are happy to assist you with this. Also, anyone who has been operating outside of the TCF standard can now reconsider their decision: As the requirements arising from the judgment have essentially already been implemented, the legal certainty of consent management for online advertising has ultimately even increased for businesses operating under the current version of the TCF standard