The Market Court rejects the GBA’s 2022 ruling but confirms the 250,000 euro fine imposed on IAB Europe.
IAB Europe, a European association for digital marketing and advertisers, will have to pay a fine of 250,000 euros. This fine was confirmed by the Market Court on Wednesday. The Data Protection Authority (GBA) imposed this penalty in 2022 because IAB’s Transparency and Consent Framework (TCF) violates GDPR legislation.
The Market Court confirms that the so-called TC String, which records user preferences within the framework, is personal data according to GDPR legislation and that it is not sufficiently anonymized. Where the court of appeal disagrees is that IAB Europe acts as a joint data controller of the OpenRTB protocol.
Timeline
The fine for IAB Europe remains in place after multiple legal rounds. In 2022, the GBA reprimanded the advertising association, but IAB appealed. In March 2024, the European Court of Justice agreed with the GBA’s position. The Market Court rejects the original GBA ruling due to procedural reasons, but this does not make IAB Europe’s fine disappear.
The case revolves around IAB Europe’s TCF. This framework is used in the advertising world to record and communicate user consent for personalized advertising. It plays a central role in Real-Time Bidding (RTB), an automated system for buying and selling online advertising space.
IAB Europe has learned its lesson. At the request of the GBA, it submitted an action plan in 2023 with adjustments to the advertising framework. These adjustments have not yet been implemented as IAB still hoped to prevail on appeal.