IAB Europe reacts to APD’s validation of its action plan

Posted on: Thursday 12 January 2023 | IAB UK

The Belgian Data Protection Authority (APD) has informed IAB Europe that it has validated all points of the action plan submitted by IAB Europe in April 2022, in compliance with the APD’s decision last February

The validation of the action plan by the APD confirms the legal functionality of the Transparency and Consent Framework (TCF) within the provisions of the General Data Protection Regulation (GDPR).  

Each step described in the action plan is the result of a careful assessment of which measures are best suited to meet the APD’s interpretation of the GDPR (as laid out by the APD in February 2022) and deliver extended compliance functionality to the TCF. It reflects a collaborative effort and in-depth discussions amongst IAB Europe member companies and associations, that convene in the TCF working groups to iterate the Framework to meet the expectations of the APD. 

This said, the measures proposed in the action plan stem directly from the assumption that (i) the TC String (a digital signal containing user preferences) should be considered personal data and that (ii) IAB Europe acts as a (joint) controller for the dissemination of TC Strings and other data processing done by TCF participants. Both of these assumptions have been referred to the Court of Justice of the European Union (CJEU) by the Belgian Market Court for a preliminary ruling, and such referral was explicitly asked by the APD itself in the course of the proceedings.  

While IAB Europe is pleased that the action plan was favourably received by the APD, it states that it has grave reservations about the APD pre-empting responses from the CJEU which may, as a result, initiate changes to the TCF that might need to be rolled back at the end of the appeal process. Pending the proceedings before the Belgian Market Court and the CJEU, IAB Europe will take any initiative to ensure that any future developments of the TCF are sustainable and aligned with EU-level interpretations of the GDPR.  

Commenting on the latest development, Townsend Feehan, CEO of IAB Europe, said: “The validation of IAB Europe’s action plan confirms the legality of the TCF as a standard that can help digital publishers and their partners comply with certain provisions of the GDPR and ePrivacy Directive. However, it is important to bear in mind that implementation of the action plan – which IAB Europe is now being required to effect over a period of six months – would entail operating changes for TCF participants that may ultimately be found inadequate by the European Court.”  

You can find IAB Europe's FAQs about what's happening with the APD and the TCF here.

Related content

IAB member at an event

IAB Europe launches TCF 2.2

CMPs and Vendors have until the end of September to implement the new policies and specifications, which aid compliance with the ePrivacy Directive and...

Learn more
Member at IAB UK event

APD suspends action plan implementation period in TCF case

IAB Europe confirms that the Belgian Data Protection Authority (APD) has voluntarily suspended the six-month implementation period for IAB Europe’s...

Learn more

IAB Europe lodges formal request for interim measures in TCF case

IAB Europe has lodged a formal request with the Belgian Market Court for interim measures in its case with the Belgian Data Protection Authority (APD)...

Learn more
EU flag

IAB Europe explores how prepared industry is for reducing CO2 emissions

The Sustainability in Digital Advertising State of Readiness Report shows how far the digital advertising industry is progressing on its journey towards...

Learn more

Why digital advertising works

Discover why digital advertising is effective for reaching your customers and building brands.