Court of Justice rules on IAB Europe’s role in real time bidding

The Court of Justice of the European Union (CJEU) has today ruled in the IAB Europe case (C-604/22) that relates to IAB Europe’s Transparency and Consent Framework. This is a framework that can be used to record consent and meet GDPR transparency requirements in the context of real time bidding for advertising.

In its judgment, the Court of Justice confirms that the Transparency and Consent string (TC String) contains information concerning an identifiable user and therefore constitutes personal data within the meaning of the GDPR. The TC String is shared with personal data brokers and advertising platforms so that they know what the user has consented or objected to. In this process, a cookie is placed on the user’s device. When combined, the TC String and the cookie can be linked to that user’s IP address.

The Court also said that IAB Europe must be regarded as a ‘joint controller’ within the meaning of the GDPR. But IAB Europe is not a controller for the processing operations for which consent is being obtained by means of the Transparency and Consent Framework.

Representing IAB Europe, Kristof Van Quathem, Of Counsel at Covington, told PL&B that essentially the judgment is about the role and responsibility of IAB Europe as a sector organisation.

“The court has adopted an expansive interpretation of IAB Europe’s role. It is disappointing that when defining IAB Europe as a joint controller, a sector organisation is seen as determining the purposes of processing, although the Brussels Market Court still has to verify the facts of the case before it applies the Courts decision.”

“The decision does not have any immediate impact on the users of the Transparency and Consent Framework as it does not touch on the standard itself.”

The CJEU decision is not final. The Brussels Court of Appeal may send the file back to Belgium’s Data Protection Authority, or in a less likely scenario, replace the DPA’s decision, Van Quathem said.

IAB Europe is a European-level association for the digital marketing and advertising ecosystem.

See the judgment