On 7th March, the Court of Justice of the European Union (CJEU) delivered a ruling in IAB Europe v APD. In light of the complexity of the case and the risk of confusion about the implications of the ruling, we have laid out below the Court’s findings and what they actually mean.
Above all, nothing in the ruling puts into question the validity of the TCF or prohibits its use by the digital ecosystem to comply with the EU data protection framework.
The ruling concerned IAB Europe, not the TCF
The ruling was about IAB Europe and its role, as a standard-setting organisation, in the TCF. Specifically, the CJEU had been asked whether IAB Europe acts as a data controller, and if so, of what data processing.
The Court’s answer was that IAB Europe does indeed act as a data controller, but its controllership is narrowly defined. IAB Europe acts as a joint controller for the processing of “TC Strings”, the digital signal capturing information about choices users make about data processing when they interact with a TCF CMP UI, which the Court finds to be personal data.
Contrary to the APD’s assumption, IAB Europe does not act as a controller for the subsequent processing of all personal data processed for the TCF Purposes (digital advertising, content personalisation, etc.).
Changes to the TCF will be limited and can be effected quickly
The fact of the TC String being designated as personal data confirms one of the APD’s findings in their February 2022 Decision. As a result, the corresponding changes to the TCF in order to accommodate it have already been proposed as part of the action plan submitted to and validated by the APD last year.
Although these limited iterations have been put on hold pending the answers from the CJEU, they have been approved by the APD and can be effected quickly.
The appeal procedure is still ongoing, but meaningful changes to the TCF have already been made
The referral to the European Court was an important step in IAB Europe’s ongoing appeal of the APD’s February 2022 decision. The Belgian court of appeal will now resume its deliberations on the merits - which can take several months. This does not mean that the TCF is standing still: since the beginning of the appeal procedure, the TCF instances have consistently continued to bring new and meaningful iterations to the Framework in line with regulators’ expectations, such as the roll-out of TCF v2.2 last year. Yesterday’s ruling merely provides the direction to continue expanding the compliance functionality of the TCF.
IAB Europe will continue to keep the market updated on the case and the further development of the Framework.
