The Belgian Data Protection Authority (APD) has informed IAB Europe that it has validated all points of the action plan submitted by IAB Europe in April 2022 in compliance with the February APD decision. 

The validation of the action plan confirms the legal functionality of the Transparency and Consent Framework (TCF) within the provisions of the General Data Protection Regulation (GDPR).  

Each step described in the action plan is the result of a careful assessment of which measures are best suited to meet the APD’s interpretation of the GDPR (as laid out by the APD in February 2022) and deliver extended compliance functionality to the TCF. It reflects a collaborative effort and in-depth discussions amongst IAB Europe member companies and associations, that convene in the TCF working groups to iterate the framework to meet the expectations of the APD. 

This said, the measures proposed in the action plan stem directly from the assumption that (i) the TC String (a digital signal containing user preferences) should be considered personal data and that (ii) IAB Europe acts as a (joint) controller for the dissemination of TC Strings and other data processing done by TCF participants. Both of these assumptions have been referred to the Court of Justice of the European Union (CJEU) by the Belgian Market Court for a preliminary ruling, and such referral was explicitly asked by the APD itself in the course of the proceedings.  

While IAB Europe is pleased that the action plan was favourably received by the APD, it has grave reservations about the APD preempting responses from the CJEU which may, as a result, initiate changes to the TCF that might need to be rolled back at the end of the appeal process. Pending the proceedings before the Belgian Market Court and the CJEU, IAB Europe will take any initiative to ensure that any future developments of the TCF are sustainable and aligned with EU-level interpretations of the GDPR.  

“The validation of IAB Europe’s action plan confirms the legality of the TCF as a standard that can help digital publishers and their partners comply with certain provisions of the GDPR and ePrivacy directive”, comments Townsend Feehan, CEO of IAB Europe. “However, it is important to bear in mind that implementation of the action plan - which IAB Europe is now being required to effect over a period of six months - would entail operating changes for TCF participants that may ultimately be found inadequate by the European Court.”  

An FAQ regarding the TCF can be found on IAB Europe’s website, here.