CJEU ruling designates IAB Europe as ‘joint controller’ for consent in TCF processing, according to Osborne Clarke
Businesses Relying on Online Advertising Framework Must Amend Policies and User-Facing Information Following CJEU Judgment
The Court of Justice of the European Union has delivered a landmark judgment in a case involving IAB Europe, the digital marketing and advertising association, and its Transparency and Consent Framework (TCF). The ruling has significant implications for businesses relying on the online advertising framework, as they may need to make changes to their policies and user-facing information.
The TCF, developed by IAB Europe, is widely used in the online advertising industry, particularly in relation to targeted online advertising and real-time bidding (RTB). The CJEU stated that IAB Europe should be considered a joint controller in relation to the record of user consent, but not for subsequent processing by website and app providers for online advertising purposes.
Privacy campaigners in Belgium raised concerns about the TCF’s processing of personal data, leading to a fine imposed on IAB Europe by the Belgian Data Protection Authority. The CJEU clarified that the TC string, used in the TCF, combined with other data like IP addresses, constitutes personal data.
The CJEU’s ruling has implications for businesses participating in the TCF, as they may need to amend their cookie consent mechanisms, policies, and agreements. IAB Europe has provided an action plan to address the judgment, and businesses are advised to make necessary changes to comply with the GDPR requirements.
The decision has sparked debate among industry stakeholders, with IAB Europe interpreting it as having a limited role in the TCF, while privacy campaigners argue that it will force the industry to undergo significant changes. The true impact of the ruling will be seen when the Belgian Court of Appeal issues its final decision on the case.
Overall, the CJEU’s judgment highlights the importance of transparency and compliance with data protection regulations in the online advertising industry. Businesses using the TCF must ensure they are in line with the GDPR requirements to avoid potential legal consequences.