A Brief Reprieve for the IAB TCF

By: Hina Moheyuddin

In 2018, Interactive Advertising Bureau Europe (IAB Europe) released the Transparency and Consent Framework (TCF) to provide guidance to parties in the digital advertising chain regarding compliance with GDPR and the ePrivacy Directive when obtaining and managing user consent for online advertising purposes.  The TCF standardizes the communication of user consent preferences between parties in a transaction through a transparency and consent string (TC string). 

The Belgian Data Protection Authority (DPA) received 22 complaints in 2019 regarding the TCF, and its purported compliance with the GDPR.  Accordingly, the Belgian DPA initiated an investigation, culminating in a February 2022 decision that the TCF violated the GDPR for the following reasons:

• The TC string constitutes personal data. While the TC string itself does not directly identify an individual because it contains limited metadata and values, when combined with an IP address, however, it can indirectly identify a user;
• The creation and communication of the TC string constitutes the processing of personal data.  Hence, as applied by Consent Management Platforms (learn more here), it does not provide a sufficient basis for processing personal data; and
• IAB Europe acts as a data controller in respect of the TCF.

In March 2022, IAB Europe appealed the DPA’s decision to the Belgium Market Court on two grounds. First, IAB Europe disputed “the finding that the TC String is personal data for IAB Europe, arguing that the Internet user whose choices go into a TC String is not identified or identifiable for IAB Europe.” Second, the IAB Europe challenged the DPA’s finding “that it is a controller, arguing that this reflected an incorrect interpretation of the GDPR and would have grave negative implications for standard-setting organizations everywhere.”

In September 2022, the Belgium Market Court issued a preliminary ruling referring several questions to the Court of Justice of the European Union (CJEU) regarding the fundamental legality of the TCF.  While these appeals were ongoing, the IAB submitted a corrective plan of action to the Belgian DPA.

In January 2023, the Belgian DPA approved an action plan that required IAB to update the TCF within six months.  In February 2023, the IAB filed a request for interim measures with the Belgian Market Court to halt implementation of the action plan.  Within weeks, the Belgian DPA voluntarily suspended the deadline and the timeline to update the TCF is currently being reviewed. 

The CJEU’s opinion remains pending.