Search site

Become an AOP member

More details

IAB Europe 2022 652x342

IAB Europe has been found in breach of GDPR. Here’s what it means.

Published: 03 Feb 2022

A new ruling has found IAB Europe in breach of various articles within GDPR, specifically regarding the lawfulness of processing of their Transparency and Consent Framework (TCF). A €250,000 sanction has been issued to IAB Europe, as well as a series of demands. As a result, advertisers and other members of the ecosystem will have to delete all historic data gathered using this framework.

What are the main factors behind the IAB Europe GDPR ruling?


The IAB Europe argue they are not a Data Controller; The Data Protection Authority disagree, and as a result they find that the IAB Europe are in breach of various obligations under GDPR.

GDPR defines a Data Controller as ‘the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

By contrast, GRPR defines a Data Processor as ‘a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Players within the ecosystem operate as a Data Controller and/or as a Data Processor. However, the specific roles are similarly opaque:

Impact upon other companies within the digital ecosystem

IAB Europe have been found in breach of various articles specifically regarding the Lawfulness of processing. This has an impact upon the personal data processed historically: "It is the responsibility of the CMPs and the publishers who implement the TCF, to take the appropriate measures ensuring that personal data that has been collected in breach of Articles 5 and 6 GDPR is no longer processed and removed accordingly."

The original complaint originated from the Irish council of civil liberties (ICCL) and claims that "All data collected through the TCF must now be deleted by the more than 1,000 companies that pay IAB Europe to use the TCF. This includes Google’s, Amazon’s and Microsoft’s online advertising businesses."

A must read

A valuable insight to help you better understand the implications of the APD ruling on IAB’s TCF, what you need to know, immediate impacts and future considerations -

FURTHER INFO / References

· Ruling in English

  • IAB Europe
  • ICCL Irish Council of Liberties

Categories:  Industry News