A step closer to TCF v3.0 for the ad tech industry?
Locations
On 7 March, 2024 the Court of Justice of the EU ("CJEU") issued its decision in the case of IAB Europe v APD.
Background
In February 2022, the Belgian Data Protection Authority (the "Belgian DPA") issued a decision against IAB Europe. This decision found that IAB Europe's Transparency and Consent Framework ("TCF") failed to comply with certain provisions of the GDPR. IAB Europe was required to produce an action plan setting out how to remedy such non-compliance. IAB Europe appealed the decision to the Belgian Markets Court, which referred specific questions to the CJEU. Meanwhile, IAB Europe produced an action plan, which was approved by the Belgian DPA (although put on hold pending the outcome of the Belgian Market Court's decision).
Key take aways from the CJEU decision
The CJEU made 2 key findings:
- IAB Europe's Transparency and Consent String ("TC String") (which indicates user preferences in relation to cookies/personal data processing) is personal data.
- IAB Europe is likely a joint controller with other ad tech players in relation to the use of such personal data to indicate consent/legitimate interest but is not automatically a joint controller for subsequent uses.
TC String as personal data
In view of previous decisions, in particular the Breyer case (C‑582/14, EU:C:2016:779), which considered whether a dynamic IP address amounts to personal data, the CJEU's conclusion is unsurprising. In essence, it made clear that:
- insofar as the TC String, in conjunction with the IP address of a user's device, allows that user to be identified, the TC String contains personal data;
- in line with the Breyer decision, this conclusion is not undermined by the mere fact that IAB Europe cannot directly access the data processed by its members in the context of the TCF; and
- IAB Europe appears to have reasonable means of identifying a particular natural person from a TC String (because of the information which its members and other organisations participating in the TCF are required to provide to it).
IAB Europe as joint controller
Drawing on its Jehovah's Witness decision (C‑25/17, EU:C:2018:551), the CJEU made clear that a person will meet the controllership criteria if they exert structural influence over the processing of personal data for their own purposes. It also made clear that a formal arrangement between controllers as regards the purposes and means of processing is not needed to conclude that joint controllership exists. The CJEU concluded that IAB Europe appears to exert influence over the processing of personal data in the TC String, including via its framework of rules for membership of the association.
Importantly, however, the CJEU reiterated its findings in the Fashion ID decision (C‑40/17, EU:C:2019:629) that a person will be considered as a joint controller only in respect of processing operations for which it jointly determines the purposes and means. So, while IAB Europe is likely jointly responsible for the processing of personal data contained in the TC String in accordance with the TCF Framework, it appears not to be responsible for the subsequent processing carried out by website/app provider or other third parties based on the choices expressed by the relevant user, for example, the offering of personalised ads.
What next for the ad tech industry?
While the decision is long-awaited and is likely to be hailed as a "win" by activists, it is limited in its scope. It is significant that IAB Europe is not regarded automatically as a joint controller for subsequent processing beyond recording user preferences in a TC String in accordance with TCF rules. The conclusion that the TC String is personal data appears to have been anticipated by IAB Europe in its approved action plan. So, while the CJEU's findings are significant, they are unlikely to prove fatal to the operation of the TCF.
The next step is for the Belgian Market's Court to hand down its decision on the merits of IAB Europe's appeal against the Belgian DPA's decision. In the meantime, IAB Europe has indicated that it continues to bring changes to the TCF. See here. With that in mind, it seems that the way is paved towards a TCF v. 3.0 to address further compliance aspects, although it remains to be seen what form these further changes will take.