... and confirms the full legality of IAB's TCF
On May 14, 2025, the Belgian Market Court annulled the decision issued in 2022 by the Data Protection Authority (APD) against IAB Europe, the organization behind the Transparency and Consent Framework (TCF).
⚙️ The TCF, a cornerstone of programmatic advertising in Europe
The TCF is a technical standard that allows publishers, advertisers and platforms to ensure the compliance of their data processing activities with the GDPR. It is based on “TC Strings”, which record users’ consent preferences.
In 2022, the APD considered TC Strings to constitute personal data and held IAB Europe jointly responsible, including for processing operations carried out by third parties.
⚖️ A disputed decision from the outset
IAB Europe appealed the decision, denouncing:
- An incomplete investigation,
- A misinterpretation of GDPR rules,
- An unjustified extension of its responsibility.
On September 7, 2022, the court referred two questions to the CJEU:
- Are TC Strings personal data?
- Is IAB Europe responsible for processing such data?
📜 The CJEU judgment and its clarifications
In March 2024, the CJEU ruled that:
- TC Strings can constitute personal data if linked to an identifier like an IP address,
- IAB Europe may be a joint controller only for the creation of TC Strings,
- It is not responsible for the subsequent processing (advertising, personalization...).
🧨 A decisive annulment of the APD’s decision
On May 14, 2025, the Belgian court annulled the APD’s decision:
- Due to insufficient investigation,
- Due to flawed legal qualification,
- And confirmed that IAB Europe is not responsible for processing done by TCF participants.
🔄 An action plan on hold
IAB Europe had anticipated this situation by proposing a compliance plan in 2022, which included:
- Dropping legitimate interest as a legal basis for some purposes,
- Improving clarity for users,
- Increasing transparency on vendors
But these measures were based on a legal interpretation that has now been challenged, and their implementation is no longer required.
🌍 What this changes for the advertising industry
This decision:
- Clarifies legal responsibilities in the digital advertising ecosystem,
- Protects collective standards like the TCF,
- Reminds regulators that solid, contextual investigations are essential.
