IAB Europe reacts to APD’s validation of its action plan

Posted on: Thursday 12 January 2023 | IAB UK

The Belgian Data Protection Authority (APD) has informed IAB Europe that it has validated all points of the action plan submitted by IAB Europe in April 2022, in compliance with the APD’s decision last February


The validation of the action plan by the APD confirms the legal functionality of the Transparency and Consent Framework (TCF) within the provisions of the General Data Protection Regulation (GDPR).  

Each step described in the action plan is the result of a careful assessment of which measures are best suited to meet the APD’s interpretation of the GDPR (as laid out by the APD in February 2022) and deliver extended compliance functionality to the TCF. It reflects a collaborative effort and in-depth discussions amongst IAB Europe member companies and associations, that convene in the TCF working groups to iterate the Framework to meet the expectations of the APD. 

This said, the measures proposed in the action plan stem directly from the assumption that (i) the TC String (a digital signal containing user preferences) should be considered personal data and that (ii) IAB Europe acts as a (joint) controller for the dissemination of TC Strings and other data processing done by TCF participants. Both of these assumptions have been referred to the Court of Justice of the European Union (CJEU) by the Belgian Market Court for a preliminary ruling, and such referral was explicitly asked by the APD itself in the course of the proceedings.  

While IAB Europe is pleased that the action plan was favourably received by the APD, it states that it has grave reservations about the APD pre-empting responses from the CJEU which may, as a result, initiate changes to the TCF that might need to be rolled back at the end of the appeal process. Pending the proceedings before the Belgian Market Court and the CJEU, IAB Europe will take any initiative to ensure that any future developments of the TCF are sustainable and aligned with EU-level interpretations of the GDPR.  

Commenting on the latest development, Townsend Feehan, CEO of IAB Europe, said: “The validation of IAB Europe’s action plan confirms the legality of the TCF as a standard that can help digital publishers and their partners comply with certain provisions of the GDPR and ePrivacy Directive. However, it is important to bear in mind that implementation of the action plan – which IAB Europe is now being required to effect over a period of six months – would entail operating changes for TCF participants that may ultimately be found inadequate by the European Court.”  

You can find IAB Europe's FAQs about what's happening with the APD and the TCF here.

Related content

EU flag

IAB Europe explores how prepared industry is for reducing CO2 emissions

The Sustainability in Digital Advertising State of Readiness Report shows how far the digital advertising industry is progressing on its journey towards...

Learn more

What’s happening with IAB Europe, the TCF & the APD?

Read on for everything IAB UK members need to know on what’s happening with IAB Europe and the Belgian Data Protection Authority regarding the...

Learn more

IAB Europe on Belgian Market Court referring TCF ruling to European Court of Justice

Read IAB Europe's statement on the latest developments regarding the Belgian Market Court's referral ruling on the TCF

Learn more
Person using remote control on a connected television

CTV: Key definitions for the industry

Working in partnership with our connected TV (CTV) members and IAB Europe, we’ve developed a set of shared definitions for the CTV sector

Learn more

Why digital advertising works

Discover why digital advertising is effective for reaching your customers and building brands.