IAB Transparency & Consent Framework (TCF) is an open standard created jointly by IAB Europe and the industry and launched in 2018 to meet the requirements of GDPR and ePrivacy for digital advertising.
On Wednesday, 2 February 2022, the Belgian data protection authority APD decided that the TCF standard violated certain parts of the EU's General Data Protection Regulation (GDPR). As a result of the infringement, IAB Europe was fined € 250,000. The data protection authorities of other EU countries also participated in the decision-making of the APD, and thus, the decision is, in principle, binding in all EU countries.
According to the statement, IAB Europe has the controller role in TCF's TC-String, which the decision interprets as personal data. It should be noted that the decision only applies to IAB Europe and not to companies using the TCF standard.
Within the next two months, IAB Europe had to submit a development plan to APD to remedy the shortcomings identified in the decision.
How did the process continue after the published decision?
On 4 March 2022, IAB Europe submitted to the Market Court (Court of Appeal of Brussels) an appeal against the Belgian Data Protection Authority (APD) ruling, which claimed that IAB Europe acted in breach of the General Data Protection Regulation (GDPR). The Market Court is expected to rule on the appeal in mid- or late summer 2022.
On 1 April 2022, IAB Europe submitted the action plan required by the decision to the APD. Once the action plan has been reviewed and validated by the APD and concerned supervisory authorities, IAB Europe will have six months to implement it.
On 13 May 2022, IAB Europe announced that it is withdrawing its request for suspension of the execution of the decision issued by the Litigation Chamber of the Belgian Data Protection Authority (“APD”) on IAB Europe and the Transparency & Consent Framework (TCF). The request for suspension had been submitted as part of the appeal to the Belgian Market Court lodged on 4th March. The withdrawal coincides with a confirmation by the APD that it will not decide on the validation of the action plan submitted by IAB Europe until 1st September at the earliest, the date by which the Market Court is expected to have issued a ruling on the appeal.
On 7th September 2022, IAB Europe acknowledged the interim ruling handed down by the Belgian Market Court (part of the Brussels Court of Appeal) in connection with IAB Europe’s appeal of the February 2022 decision by the Belgian Data Protection Authority (APD) on IAB Europe and the Transparency & Consent Framework (TCF). In its interim ruling, the Market Court has decided to refer preliminary questions to the Court of Justice of the European Union (CJEU) on how the concept of data controllership in the GDPR, as it pertains in this case, is to be interpreted and on whether a TC String (a digital signal containing user preferences) can be considered as “personal data” under the GDPR. The referral to the CJEU means that a final judgement by the Market Court is unlikely until 2023 or even 2024.
12th January 2023: The Belgian Data Protection Authority (APD) has informed IAB Europe that it has validated all points of the action plan submitted by IAB Europe in April 2022 in compliance with the February APD decision. The validation of the action plan confirms the legal functionality of the Transparency and Consent Framework (TCF) within the provisions of the General Data Protection Regulation (GDPR). The validation gives the industry six months to implement the action plan.
However, it is important to remember that implementing the action plan entails operating changes for TCF participants that the European Court may ultimately find inadequate.
Key FAQ
The full Q&A compiled by IAB Europe can be found here. Below, we have compiled some essential points for a quick overview.
Are TCF CMP consent pop-ups illegal?
No. Nothing in the APD’s decision even remotely suggests that consent prompts are illegal or that the digital advertising ecosystem should not employ them to comply with legal requirements under the EU’s data protection framework. APD considers only TCF-compliant TC strings personal data under certain conditions. Therefore, TC strings require a legal basis under the GDPR (consent or legitimate interest), and APD will request further clarification on its decision.
Why are TC Strings considered personal data by the APD?
TC Strings are the digital signals created by Consent Management Platforms (CMPs) that work for Publishers (owners of websites and/or apps) to capture data subjects’ choices about processing their personal data for digital advertising, content and measurement. The APD does not consider the TC String itself personal data, as the TC string does not allow for direct user identification due to the limited metadata and values it contains. However, the APD holds that the possibility of CMPs combining TC Strings and the IP address means it is ultimately information about an identifiable user and, therefore, personal data.
Should all data collected via the TCF be deleted?
No. APD says explicitly in its decision that it cannot mandate the removal of all TC Strings generated until now on IAB Europe. The APD only requires IAB Europe to ensure the deletion of personal data collected through TC Strings in the context of a specific mechanism called the “global scope”. IAB Europe announced the deprecation of global scope support on June 22nd 2021. APD's decision currently concerns IAB Europe and not an individual market player. Still, it refers to the possibility of ordering an individual operator to delete data collected through TCF if it contains personal data collected in breach of Articles 5 and 6 GDPR.
What are the next steps?
In September 2022, the Market Court made a preliminary ruling request to the Court of Justice of the European Union. Bringing the case to the Court of Justice of the European Union means that the final verdict of the market court is unlikely to be reached before 2023 or even 2024. It is currently not possible to give a more precise timeline. IAB Europe regularly informs about the different stages of the complaint process.
In September 2023, IAB Europe announced that the Belgian Market Court has granted an interim ruling that halts any further assessment of IAB Europe's action plan approval by the Belgian Data Protection Authority. This suspension will remain in place until the Court of Justice of the European Union (CJEU) delivers its judgment. The court's decision facilitates an orderly resolution of ongoing legal matters. It mitigates the risk of implementing any changes to the Transparency and Consent Framework (TCF) that may later be deemed unacceptable by the CJEU. Currently, there is no projected timeline for the CJEU's forthcoming ruling.
In March 2024, the Court of Justice of the European Union (CJEU) issued a decision clarifying IAB Europe's role in processing personal data and as a joint controller within the Transparency & Consent Framework (TCF). According to the court, IAB Europe can act as a joint controller with publishers and vendors in creating and using TC Strings—digital signals containing user preferences—if IAB Europe actively influences the objectives and methods of processing. Following this decision, the Belgian Market Court will continue to process the complaint made by IAB Europe according to the court's guidelines.
IAB Europe plans to publish a detailed account of the court's decision and its implications soon. Although the decision specifically addressed the dispute related to TCF with the Belgian Data Protection Authority (APD), the CJEU's directives are significant for all organizations involved in digital activities.