The Transparency and Consent Framework (TCF) launched by the Interactive Advertising Bureau (IAB) will have to be improved following the decision of the European Court of Justice. The court has ruled (ECJ, judgment of 6.3.2024, C-604/22) that the so-called TC-String is to be classified as personal data. In addition, the ECJ assumes that the IAB is in part jointly responsible for data processing with the members of the IAB. Following the ECJ's ruling, the referring Belgian court (Hof van beroep te Brussel) will now have to examine whether and how far the conditions for joint controllership are actually met and decide the legal dispute between the Belgian data protection supervisory authority and the IAB. Companies that use the IAB TCF in the context of personalized online advertising, in particular for real-time bidding, will face changes.
Background:
The IAB TCF should be the answer to the requirements of the GDPR and the Cookie Directive (Directive 2002/58/EC, last amended by Art. 2 Directive 2009/136/EC of 25.11.2009) and enable legally compliant online advertising for advertisers and marketers. The IAB TCF therefore specifies, among other things, how consent is to be obtained by service operators who wish to use the IAB TCF for advertising. An essential part of the IAB TCF (now version 2.2) is the so-called TC string, a character string that contains the essential information about a user, such as which consents have been given, on which website or app the consent was given and for which recipients, etc. This character string, together with the IAB TCF, can be used for advertising purposes. This string is transmitted to the IAB and the other members together with the IP address.
The Belgian data protection supervisory authority (Gegevensbeschermingsautoriteit) had challenged the IAB TCF and declared various practices to be contrary to the GDPR. The IAB took action against this decision and challenged it in court. At the same time, the IAB TCF was further developed in order to implement certain points of criticism from the Belgian supervisory authority in an IAB action plan that was requested by the authority and ultimately approved in 2023. As part of the legal dispute, the competent court in Belgium referred several questions to the ECJ for a preliminary ruling. Essentially, the court wants to know whether the IAB is a controller within the meaning of Art. 4 No. 7 GDPR and whether the TC-String constitutes personal data.
The decision:
Essentially, the ECJ follows the view of the Belgian supervisory authority and consolidates its case law according to which the concept of personal data is to be understood broadly. Even if, in the context of the IAB TCF, the IAB can only access the TC string, which in itself does not contain any information that the IAB can use to identify a natural person without further aids, the string is nevertheless considered to be a personal characteristic as it can - due to its function - be assigned to a specific user and the user can therefore be identified. According to the ECJ, it is sufficient that this personal reference exists, regardless of whether the user's IP address is also transmitted in addition to the TC string.
In line with its previous case law, the ECJ has also assumed that the IAB is responsible, at least in principle, subject to further clarification of the facts by the referring court. If the IAB - as the ECJ assumes - determines the purposes and means of processing together with the members during the creation of the IAB TCF, for example by jointly determining the standards for the storage of consent preferences and the transmission in the IAB TCF, this influence would establish responsibility. Data processing that takes place after the IAB TCF has been stored must be separated from this.
Practical consequences:
Companies that use the IAB TCF will have to adapt to changes: The IAB TCF 2.2. does not yet meet all the requirements of the ECJ. If the IAB TCF continues to be used, it is therefore essential to check whether the data processing is lawful despite the ECJ ruling. The referring Belgian court will make a final judgment on the IAB TCF and clarify the question of (joint) responsibility. The IAB, which
welcomes the decision as it clarifies responsibilities, has already announced that it will soon provide information on the next steps.
Update (May 2025)
The Market Court in Brussels ruled on 14 May 2025 confirmed the Belgian supervisory authority’s core findings but annulled the formal Decision 21/2022. In consequence of the ECJ ruling, the TC String constitutes personal data under the GDPR and IAB Europe qualifies as a joint controller or the processing of these preferences within the TCF. However, the court clarified that the IAB Europe is not jointly responsible for those processing activities conducted entirely via the OpenRTB protocol. Due to the annulation of the authority’s order for formal reasons he authority must now reassess how to legally re-justify both the penalty and the requirement to submit a remediation plan.
