IAB Europe’s TCF and the Belgian APD: The legal saga explained

It has now been over two years since the APD, Belgium's data protection authority, challenged IAB Europe’s Transparency and Consent Framework (TCF).

As the legal proceedings continue to evolve and shape the AdTech industry in Europe, now is a great time to revisit the entire saga, from its start to the situation today (and tomorrow).

‍

Where it all started: the decision from the Belgian DPA

On February 2nd, 2022, the Belgian DPA, the APD (“Autorité de Protection des Données”), issued a decision against the European Interactive Advertising Bureau (IAB Europe) on its Transparency and Consent Framework (TCF). 

The four main points brought by the APD against the TCF were the following:

• The Transparency & Consent (TC) string, the consent signal stored by players in the advertising industry, was considered personal information for which participants need to establish a legal basis, be it consent, legitimate interest, or something else
• IAB Europe was deemed a data controller of that information, regardless of the fact that it doesn't process the consent information
• IAB Europe was described as a joint controller with TCF participants (vendors, CMPs, publishers). As a result, the APD considers that it failed to establish a legal basis for processing the TC string
• The security measures in place to protect the consent signal's integrity were insufficient.

IAB Europe was fined EUR250K and ordered to develop an action plan within the next two months.

As a Consent Management Platform (CMP) provider integrated with the TCF, we reacted promptly, and our team was able to host a webinar and provide guidance in the weeks following the decision, with recommendations and next steps for our clients.

IAB Europe’s response and the TCF v2.2

Following the decision, IAB Europe responded with an action plan in April 2022, which, after additional procedural events in September 2022, was reviewed by the Belgian APD on January 11th, 2023. 

The main points of this action plan, aimed at addressing the issues identified by the Belgian APD, were applied in the last iteration of the Transparency and Consent Framework, the TCF 2.2, which was released on May 16th, 2023, with an implementation deadline for participants on November 20th, 2023 (originally scheduled for July 11th, 2023, but delayed). 

Didomi fully supported the migration, working closely with the IAB in developing the framework, improving our Advanced Compliance Monitoring to help organizations stay on top and reduce their vendors list when necessary, and assisting customers in the change and figuring out how many vendors to declare in their consent banner. 

Our team was eventually able to report on the impact of these changes in a whitepaper release in the last quarter of 2023:

The situation today (and tomorrow)

IAB Europe appealed the Belgian APD decision in 2022, which led to the Belgian Court of Appeal sending some questions regarding the case to the Court of Justice of the European Union (CJEU). 

On March 7th, 2024, the CJEU answered these questions in a ruling on the TCF and the Belgian APD question, focusing on two main points that were raised in 2022 by the Belgian APD:

• The Transparency & Consent (TC) String is considered personal data
• IAB Europe could be a joint data controller

We sat down with our Chief Privacy Officer, Thomas Adhumeau, to discuss the CJEU opinion on the TCF in full. We urge you to read the article to gain an up-to-date understanding of the situation and its implications:

{{understanding-the-eu's-eprivacy-regulation-gdpr-vs-tcf}}

In response to the CJEU's reasoning, the Transparency & Consent Framework (TCF) Steering Group approved a new iteration of the IAB TCF Framework in June 2024, incorporating three new amendments. You can learn more in our help center documentation.

What’s next? The CJEU opinion is now helping the Belgian Court of Appeal deliberate to provide a decision, which is expected for the end of 2024 or early 2025. It’s important to note that this will not necessarily conclude the case and might instead kickstart new developments for IAB, the Belgian APD, and the TCF.

“This legal saga will likely continue to be at the center stage of the digital industry for years to come.”

- Thomas Adhumeau, Chief Privacy Officer at Didomi (source: Didomi Blog)

In the meantime, make sure to sign up for our newsletter and follow us on social media to stay updated on the case's developments.