On March 7th, 2024, the CJEU (the Court of Justice of the European Union) made a significant decision regarding the TCF (the Transparency and Consent Framework) of IAB Europe (the Interactive Advertising Bureau Europe). This ruling, in the case of IAB Europe (Case C-604/22), not only evaluated the framework’s workings but also clarified the concept of personal data under the EU GDPR (General Data Protection Regulation).
Background
The case originated from a fine imposed by the DPA (Belgian Data Protection Authority) in 2022, against IAB Europe after probing into the TCF. The TCF, a tool for GDPR consent, helps manage consent for targeted advertising cookies within the EU, especially through the OpenRTB protocol (a fast-paced auction system that helps advertisers post their ads on dedicated spaces in websites and apps) used in programmatic advertising.
Under the TCF, users encounter a consent management tool (e.g., cookie banners) on their initial visit to a website or app. This tool enables users to consent to data collection and sharing for targeted advertising while also allowing them to object to certain processing activities. The preferences are recorded via a digital signal known as the TCF-String.
IAB Background and Significance
IAB Europe established the TCF (the Transparency and Consent Framework) to align with the EU GDPR and the Cookie Directive. This framework was set up to provide a standardized approach for obtaining user consent for online advertising cookies within the European Union. Many companies in the digital advertising ecosystem use the TCF as a guideline because it offers a structured way to manage consent and comply with legal requirements. The TCF serves as a trusted tool for businesses navigating the complex landscape of data privacy regulations, offering clarity and consistency in obtaining user consent.
However, it is worrying that an accepted industry “guideline” like the TCF has been found to potentially violate the law. The CJEU’s ruling, deeming the TC-String as personal data, emphasizes the importance of ensuring that industry standards align with legal standards. When widely used frameworks like the TCF fall short of legal requirements, it creates uncertainty and challenges for businesses operating in the digital advertising space. Additionally, it highlights the need for continuous evaluation and adaptation of industry practices to ensure compliance with evolving legal frameworks like the GDPR.
The CJEU’s Decision
The CJEU addressed two key questions raised by the Belgian Market Court:
Firstly, does the TCF String qualify as personal data?
Secondly, what is IAB Europe’s role in the associated processing operations?
Regarding the TCF-String, the CJEU emphasized the broad interpretation of personal data under the GDPR. Although the TCF-String alone may not directly identify individuals, it can, in combination with other information, help to do so. Thus, the CJEU deemed it should be considered personal data, pending further verification by the Belgian Market Court.
Regarding IAB Europe’s role, the CJEU acknowledged its influence over processing operations and the joint determination of processing purposes with its members. However, it refrained from labeling IAB Europe as a joint controller for subsequent processing carried out by other entities based on TCF-String preferences.
Next Steps
The case now returns to the Belgian Market Court for a final decision. Notably, the Belgian DPA previously approved an action plan by IAB Europe aimed at GDPR compliance within the TCF context, pending the court’s decision.
IAB Transparency and Consent Framework Must Evolve
The ECJ’s ruling requires improvements to the IAB Transparency and Consent Framework. The ruling, dated March 6th, 2024, deems the TC-String as personal data and suggests shared responsibility between IAB and its members in data processing.
The IAB TCF was created to follow the GDPR and the Cookie Directive. It heavily depends on the TC-String to communicate user consent for online ads. However, the ECJ sees the potential to identify users with the TC-String, so they consider it personal data.
Additionally, the ECJ’s ruling hints at IAB’s shared responsibility in data processing, subject to clarification by the Belgian court. IAB’s influence over TCF creation and standards implies a level of responsibility.
Practical Implications
Companies employing the IAB TCF must prepare for adjustments. The current version, 2.2, falls short of ECJ conditions, requiring thorough assessments of data processing legality. The expected judgment from the Belgian court will provide clarity on IAB’s responsibilities.
In response, IAB has pledged to update stakeholders on the roadmap ahead, welcoming the decision as a clarifier of roles in data processing.
In conclusion, the CJEU’s rulings emphasize the evolving landscape of data privacy and advertising practices, signaling a change in regulatory compliance and industry adaptation within the EU.