CJEU Judgment on IAB Europe’s Transparency and Consent Framework: Analysis and Implications

The Court of Justice of the European Union (CJEU) recently issued a significant judgment in the case of IAB Europe, shedding light on the processing operations associated with its Transparency and Consent Framework (TCF) and further developing case law on personal data under the EU General Data Protection Regulation (GDPR).

The case originated from a fine imposed by the Belgian Data Protection Authority (DPA) against IAB Europe in 2022 following an investigation into the TCF. The TCF is a widely used GDPR consent solution for managing consent for targeted advertising cookies in the EU. It allows users to provide consent for data collection and sharing for targeted advertising purposes and object to certain processing activities based on ad tech vendors’ legitimate interests.

The CJEU was asked to clarify whether the TCF String should be considered personal data and the role of IAB Europe in the processing operations associated with the TCF. The CJEU determined that the TCF String could potentially identify individuals and that IAB Europe exercises influence over the processing operations related to the TCF.

However, the CJEU ruled against considering IAB Europe as a joint controller for subsequent processing of personal data by other entities based on preferences communicated through the TCF String. The case will now return to the Belgian Market Court for a final decision based on the CJEU’s guidance.

It is worth noting that IAB Europe presented an action plan in 2023 to bring the processing of personal data in the TCF into compliance with the GDPR, which is currently on hold pending the Belgian Market Court’s decision.

This judgment has significant implications for data protection and privacy in the EU, highlighting the importance of transparency and accountability in data processing operations. Stay tuned for further developments as the case progresses through the legal system.