On March 7, 2024, the Court of Justice of the European Union (“CJEU”) issued its judgment in the case of IAB Europe (Case C‑604/22). In this judgment, the CJEU assessed the role of the Interactive Advertising Bureau Europe (“IAB Europe”) in the processing operations associated with its Transparency and Consent Framework (“TCF”) and further developed CJEU case law on the concept of personal data under the EU General Data Protection Regulation (“GDPR”).

Background

As described in our previous blog, the case arises from a 2022 fine imposed by the Belgian DPA against IAB Europe following an investigation into the TCF.

The TCF is a GDPR consent solution that has become a widely used mechanism for obtaining and managing consent for the use of targeted advertising cookies in the EU. The TCF was designed to accommodate the use of cookies in connection with the OpenRTB protocol, which is a common protocol used by companies for “Real-Time Bidding” in programmatic advertising. The OpenRTB protocol enables advertisers to bid in real time on ad inventory contained on a publisher’s property (e.g., website or app), in order to deliver targeted advertising tailored to the profile of the website or app user. Under the TCF, a consent management tool is presented to a user on their first visit to a website or app to obtain the user’s consent to the collection and sharing of their data for targeted advertising purposes. The consent management tool also enables the user to object to certain processing activities based on the ad tech vendors’ legitimate interests. The TCF registers the user’s preferences through the consent management tool by creating a digital signal composed of a combination of letters and characters (the “TCF String”).

Following an appeal before the Belgian Market Court, the Belgian Court asked the CJEU to clarify: (1) whether the TCF String should be considered as personal data; and (2) IAB Europe’s role in the processing operation associated with the TCF.

The CJEU’s Decision

With regards whether the TCF String should be considered as personal data, the CJEU restated its previous Breyer case law and argued that “all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly” should be taken into account to determine whether a person is “identifiable.” In the present case, the CJEU considered that, subject to additional verifications to be carried out by the Belgian Market Court, IAB Europe appeared to have reasonable means allowing it to identify a particular individual through a TCF String. In particular, the CJEU highlighted the fact that members of IAB Europe are required to provide IAB Europe, at its request, with all the information allowing IAB Europe to identify the users whose data are the subject of a TCF String.

On the role of IAB Europe in the processing of personal data, the CJEU considered that, subject to additional verifications to be carried out by the Belgian Market Court, IAB Europe exercises influence over the personal data processing operations related to TCF and defines, jointly with its members, the purposes of such processing operations.

The CJEU also considered that, subject to additional verifications to be carried out by the Belgian Market Court, IAB Europe defined the means of the processing operations, due to the fact that it imposed a certain set of rules and precise technical standards on its members and could suspend or exclude them in case of non-compliance.

However, the CJEU rejected that IAB Europe should be considered as a joint controller for subsequent processing of personal data carried out by other entities, such as data brokers and advertising platforms, on the basis of the preferences communicated to them through the TCF String.

Next Steps

The case will now go back to the Belgian Market Court for a final decision based on the guidance from the CJEU.

It is important to note that in 2023, the Belgian DPA approved an action plan presented by IAB Europe aimed at bringing the processing of personal data in the context of TCF into compliance the GDPR. Implementation of this action plan is suspended pending the Belgian Market Court’s decision.

Read the CJEU’s decision.