2025
The Market Court rules in the IAB Europe case
Today, the Market Court (Court of Appeal) has ruled in the case between the Belgian Data Protection Authority and IAB Europe, exercising its full jurisdiction. Although decision 21/2022 is annulled for procedural reasons, the Market Court endorses the reasoning of the Belgian DPA and confirms the fine of 250,000 euros imposed. However, the Court rejects the BE DPA's conclusion that IAB Europe acts as (joint) data controller for the processing operations that take place entirely within the OpenRTB protocol.
IAB EUROPE case - Context
On 2 February 2022, the Belgian DPA published a decision concerning IAB Europe's TCF (Transparency and Consent Framework), a widespread mechanism that facilitates the management of users’ preferences for online personalised advertising, and which plays a central role in what is known as Real Time Bidding (RTB). RTB is an ecosystem that enables the sending of personalised ads.
The Belgian DPA fined the company €250,000 and gave it two months to submit an action plan to bring its activities into compliance. The decision was endorsed by all the concerned data protection authorities in the EU, after applying the one-stop-shop mechanism.
IAB Europe had appealed this decision before the Market Court (part of the Court of Appeal). Before ruling on the case, the Market Court decided to refer two preliminary questions to the CJEU.
In March 2024, the CJEU held, as the Belgian DPA had argued, that a structured characters string capturing internet users‘ preferences, such as IAB Europe's TC String, can indeed be considered personal data, and that a sectoral organisation such as IAB Europe can be qualified as (joint) controller of users’ preferences within the TCF.
Decision of the Market Court
On the basis of these elements, the Market Court ruled today on the appeal against the decision of the BE DPA on TCF version 2.0, taking into account the preliminary ruling of the Court of Justice.
In its judgment, the Court confirms the infringements established by the BE DPA and the penalties imposed. More specifically, the Court rules that the TC String is personal data within the meaning of the GDPR and that IAB Europe acts as joint data controller for the processing of user preferences within the TCF. However, the Market Court annulled the BE DPA's decision 21/2022 on procedural grounds.
Hielke Hijmans, chair of the Litigation Chamber of the BE DPA: ‘What is important to remember here is that this ruling by the Market Court, like that of the CJEU in 2024, confirms our position that the TC String is personal data and that IAB Europe acts as joint data controller for the processing of user preferences within the TCF. This clarification of key concepts in the GDPR has had and will continue to have a lasting positive impact on all those involved in the EU.’
The GBA must now analyse the ruling in more detail.
Timeline of the IAB Europe case
2022
- On 2 February 2022, the Litigation Chamber of the Belgian DPA published its decision 21/2022 concerning IAB Europe, in which the Litigation Chamber imposes several sanctions including an action plan for compliance
- IAB EUROPE appeals the decision
- On 7 September 2022, the Market Court refers several questions to the CJEU for preliminary ruling
2023
- On 11 January 2023, the Litigation Chamber approves IAB Europe's action plan
- IAB EUROPE and the complainants in the IAB Europe's case appeal the decision of the Litigation Chamber to approve IAB Europe's action plan
- On 21 September 2023, the hearing before the CJEU takes place
7 March 2024
- The CJEU rules on the case in its judgment C-604/22
14 May 2025
- The Market Court rules on the appeal lodged in 2022 by IAB Europe against decision 21/2022 of the Litigation Chamber.