IAB Europe – Court Ruling (Belgium, 2025)

IAB Europe (“IAB”, short of Interactive Advertising Bureau) is an association of undertakings active in the field of digital advertising such as publishers, ecommerce and marketing companies and intermediaries, including major international players such as Microsoft and Google. IAB is established in Belgium and operates on a European level. IAB developed the “Transparency & Consent Framework” (“TCF”). The purpose of the TCF is to make the processing of personal data for online advertising compliant with data protection requirements. To this end, the TCF provides a set of technical standards and rules (in the form of contractual obligations) for companies in the sector. In particular, the TCF specifies how publishers, advertisers, and intermediaries should use the OpenRTB protocol, a widely used Real Time Bidding (“RTB”) system. RTB consists in the instant and automated online auction of users profiles for the purpose of selling and purchasing advertising space online. When an internet user visits a webpage where advertising space is available, the server sends the user’s data to a platform where advertisers automatically and instantly place bids. Advertisers place their bids based on some characteristics of individual users visiting the page (such as their location, marketing profiles, and browsing history). The bid winner displays their customer's advertising in that specific advertising space. The whole process involves a mass exchange of personal data. For this operation to be possible, users are (in principle) asked to express their advertising preferences when they first visit a publisher’s website. These preferences are collected by websites (more specifically, by each website's Consent Management Platform) and stored in a string called Transparency and Consent string (‘TC string’). The TC string is subsequently shared with advertisers and data brokers, in order to inform them of the user's preferences. At the same time, the CMP writes a cookie called euconsent-v2 on the user’s device. In combination with the TC string, the euconsent-v2 cookie can reveal the user’s IP address. In 2019 a number of complainants, including several non-profits, filed complaints with different DPAs against the TCF. The DPA decision [https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_21/2022 The Belgian DPA, as lead supervisory authority, ruled] that IAB was acting as a joint controller (along with the TCF participants) in relation to the TC string. The DPA also considered that this processing influenced the OpenRTB protocol and that IAB was therefore a joint controller in relation to the OpenRTB as well. It also found several breaches of the GDPR. As a result, the DPA fined IAB €250,000. The decision was adopted pursuant to the cooperation procedure under Article 60 GDPR, in the context of which 21 supervisory authorities agreed with the DPA’s draft decision during the procedure. IAB challenged the DPA decision IAB challenged the decision before the Court of Appeal of Brussels (hereafter the Court). In particular, IAB claimed that the TC string did not constitute personal data, and that even if it did, IAB was not a controller for the processing in relation to the TC strings. In particular, it claimed that by creating the TCF, it merely set a standard for processing personal data across the organizations handling TC strings. In IAB's view, this did not amount to actually processing data. Request for preliminary ruling The Court of Appeal referred several questions to the CJEU. In 2024 the CJEU issued a preliminary ruling in which it confirmed (i) that TC strings were personal dataCJEU, Case C-604/22, IAB Europe, 7 March 2024, margin 51 (available [https://curia.europa.eu/juris/document/document.jsf?docid=283529&doclang=en here]). and (ii) that IAB was a joint controller for the processing in relation to the TC stringsCJEU, Case C-604/22, IAB Europe, 7 March 2024, margin 77 (available [https://curia.europa.eu/juris/document/document.jsf?docid=283529&doclang=en here])., along with the other recipients of the string. The CJEU specified that its findings about IAB’s qualification as a controller, did not extend to the entire data processing happening through the OpenRTB protocol. In other words, IAB was a controller for the TC string processing, but it did not necessarily follow that it was a controller for the broader processing of personal data in the OpenRTB protocol for the purpose of targeted advertising. The Court resumed the proceedings after the preliminary ruling of the CJEU. On the nature of the TC string Further to the preliminary ruling, the Court observed that IAB members - who were recipients of the TC strings - held data that could identify the data subject when combined with the TC string. This implied that the TC string qualified as personal data, irrespective of the possibility for IAB to actually identify users. The Court then examined if IAB could actually identify users. It held that under IAB's internal policies, which are binding for the other participants in the TCF, IAB could require to access data which, in combination with the TC string, could identify users. The Court concluded that as IAB could require such information, it had reasonable means to identify the users. For these reasons, the Court held that TC strings were personal data in the meaning of Article 4(1) GDPR. On the processing of personal data The Court then confirmed that once created, the TS strings are then structured and organized by IAB, which qualifies as a processing operation within the meaning of the GDPR. On IAB’s controllership The Court then examined if IAB qualified as a controller under Article 4(7) GDPR. The Court noted that IAB shares a purpose with other participants in the TCF: that users preferences are captured in a structured way and the shared with other participants. Given its overriding control over the TCF, the Court found that IAB held clear decision making power both over the purposes and means of the processing. Regarding the joint controllership, the Court distinguished between the processing in relation to the TC String and the processing in the context of the OpenRTB protocol. For what concerns the TC Strings, the Court confirmed that IAB was jointly responsible, with the TCF participants, for storing data subject's consent preferences in the TC string. It therefore qualified as a joint controller. For the processing in relation to the OpenRTB, the Court however refused to follow the DPA's reasoning. It considered that the scope of the litigation was limited to the processing within the TCF and that the DPA did not sufficiently prove that IAB was a joint controller in the context of the OpenRTB protocol. The Court therefore found that IAB's claim was founded only to the extent that the DPA decision considered that IAB acted as a joint controller in the context of the OpenRTB protocol. On other violations The Court mostly upheld the DPA’s findings and confirmed that IAB violated Articles 5(1)(a), 5(1)(f), 6, 13, 14, 24, 25, 30, 32, 35, and 37 GDPR. In particular, the Court confirmed that: * IAB had no legal basis under the GDPR to process TC strings. In particular, the Court confirmed the DPA's findings on the legal basis of legitimate interest: IAB failed to correctly balance its legitimate interest with that of the end users and, therefore, could not invoke legitimate interest as a legal basis for processing the TC string. * IAB failed to inform website visitors about the processing of personal data, in violation of the controller's transparency obligations; * the TCF did not meet GDPR standards for data protection by design and default; * IAB failed to appoint a data protection officer and carry out a data protection impact assessment. Conclusion In conclusion, the Court upheld most of the DPA reasoning and confirmed the €250,000 fine imposed. The only part of the DPA decision that was not confirmed was the extension of IAB's controller quality to the full OpenRTB protocol. The Court did not specifically decide on the matter but considered that it was out of scope of the present proceeding and that the DPA did not sufficiently justify its reasoning. The Court also specified that the case would not be sent back to the DPA.