CJEU ruling clarifies limited role of IAB Europe in TCF

Posted on Thursday 07 March 2024 | IAB UK

The Court of Justice of the European Union (CJEU) has released its ruling on specific parts of IAB Europe’s Transparency & Consent Framework (TCF) after they were referred by the Belgian Market Court in 2022

IAB Europe has acknowledged the ruling handed down today by the CJEU in connection with its appeal of the Belgian Data Protection Authority's (APD) decision against IAB Europe and the TCF in February 2022. In September 2022, the Belgian Market Court’s interim judgement referred questions to the CJEU for a preliminary ruling on the basis that the APD's decision was insufficiently substantiated and failed to meet the relevant standard for proper investigation and fact-finding.

In relation to the CJEU's latest ruling, IAB Europe states that it “welcomes the CJEU ruling that provides well-needed clarity over the concepts of personal data and (joint) controllership, which will allow a serene completion of the remaining legal proceedings.”

In particular, the judgement of the Court establishes:

  • TC Strings (digital signals containing user preferences) constitute personal data, even from the perspective of IAB Europe, when they can be linked with reasonable means to an identifier such as for instance the IP address of the device of the user and IAB Europe can have access to such data
  • IAB Europe can be viewed as a joint controller, together with TCF participants, in relation to the creation and use of TC Strings by publishers and vendors. This is on the basis that the TCF provides specifications for its processing, if IAB Europe actually influences the processing (purposes and means) for its own reasons
  • IAB Europe should not necessarily be viewed as a joint controller, together with TCF participants, in relation to the subsequent data processing performed in pursuit of the TCF purposes - such as digital advertising, audience measurement, or content personalisation - since IAB Europe has no influence on such processing. The CJEU conclusion on the latter is particularly important, as the APD’s erroneous controllership qualification of IAB Europe over such processing served as a basis for the authority’s assessments of the validity of legal bases established through the TCF and corresponding sanctions

The Belgian Market Court will now resume its examination of IAB Europe’s substantive arguments in line with the answers provided by the CJEU. Pending the conclusion of the proceedings before the Market Court which can take several months, the suspension of the execution of the APD decision (i.e. the implementation of IAB Europe’s action plan following its validation) continues to apply.

IAB Europe will be posting a more in-depth commentary of the ruling and of its consequences shortly. Although it was adopted specifically in the context of the TCF-related dispute before the APD, the findings of the CJEU are important for all organisations with digital activities.

An updated FAQ regarding the APD decision can be found on IAB Europe’s website, here.

Related content


IAB Europe: Digital ad spend in Europe rose by 11.1% in 2023

Learn more

Belgian Market Court makes decision regarding TCF/APD case

Learn more
IAB member at an event

IAB Europe launches TCF 2.2

Learn more
Member at IAB UK event

APD suspends action plan implementation period in TCF case

Learn more

Rediscover the joy of digital advertising

Champion connections instead of clicks. Capture audiences' imaginations, not just their attention. Boldly move to your own beat instead of letting tech set the pace. It’s time to rediscover the joy of digital.