The Court of Justice of the European Union is called upon to position itself with regard to compatibility between the Transparency & Consent Framework (TCF), the consent collection standard initiated by the European International Advertising Bureau (IAB), and the General Data Protection Regulation (GDPR).
It was the Market Court, a division of the Brussels Court of Appeal, that on September 7 asked the European judge to answer some of his questions. This stems from a case between the Office for Data Protection (APD), the Belgian equivalent of the National Commission for Computing and Liberties (Cnil), and IAB Europe, the body that brings together most players in online advertising.
IAB status and TC lines
Indeed, in a judgment issued in February 2022, the ADP ruled that TCF had violated certain provisions of the GDPR and imposed a €250,000 fine on the IAB, which is considered the data controller. The professional association appealed the verdict. The European Judge will now have to take a stand on two issues raised by the Market Court. The first concerns the status of the IAB Europe data controller, and the second concerns the qualification of “personal data” for the “TC string”.
To understand the importance of these issues, we must return to the role and functioning of the TCF. It aims to promote GDPR compliance by organizations using OpenRTB. This protocol is one of the most commonly used protocols for “real-time bidding”, i.e. automatic and instant online auctions of user profiles for the sale and purchase of advertising space on the Internet.
This allows advertisers to serve targeted ads. When users visit a site or application for the first time, a so-called Consent Management Platform (CMP) interface appears, allowing them to consent to or object to the collection and sharing of their personal data. This is where TCF comes in: it makes it easy to save settings. They are then encoded and stored in a “TC string” that will be shared with organizations participating in OpenRTB.
Business outside of Belgium
The European judge will not make a final decision on the case, but will issue a decision allowing the Brussels judge to take a stand. “The IAB Europe case has an impact that goes far beyond Belgium. That is why we think it is good that it is being discussed at the European level,” commented Hilke Hyemans, President of the APD Court of Justice.
For its part, IAB Europe also welcomed the appeal to the European Court of Justice: “The interpretation of the concepts of personal data and control adopted by the DPA is unnecessarily broad from a consumer protection perspective and has significant negative developmental implications.” open standards and codes of conduct provided for by the GDPR”.
The outcome of this case could have very serious consequences for the online advertising industry. Indeed, if the market court confirms the incompatibility between the current version of the TCF and the GDPR, IAB Europe will be forced to comply by changing its standard.