Judgment;Abstract — ECLI:EU:C:2024:214
Date: 2024-03-07
Language of the case: Dutch
Court formation: Fourth Chamber
Subject matter: Approximation of laws;Fundamental rights;Data protection;Charter of Fundamental Rights
Procedure: Reference for a preliminary ruling
Origin: Belgium

Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged:  
19 September 2022 
Referring court:  
Hof van beroep te Brussel (Belgium) 
Date of the decision to refer:  
7 September 2022 
Appellant:  
IAB Europe 
Respondent:  
Gegevensbeschermingsautoriteit 
      
Subject matter of the main proceedings 
The subject of the main proceedings is a series of complaints lodged with the 
respondent, the Gegevensbeschermingsautoriteit (the Belgian Data Protection 
Authority), against the appellant, Interactive Advertising Bureau Europe (‘IAB 
Europe’), a sectoral organisation in the field of digital advertising. The complaints 
relate to violations of various provisions of Regulation 2016/679 (the General 
Data Protection Regulation; ‘GDPR’). IAB Europe has developed the so-called 
Transparency and Consent Framework (‘TCF’). This is a standard which allows 
users’ preferences for advertising purposes to be easily stored in a Transparency 
and Consent String (‘TC String’). According to the complaints in the main 
proceedings, this TC String – a string of numeric characters with the relevant user 
preferences – is not in accordance with Regulation 2016/679.  
Subject matter and legal basis of the request for a preliminary ruling 
This request for a preliminary ruling under Article 267 TFEU concerns the status 
of IAB Europe as a controller within the meaning of Article 4(7) of Regulation 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-604/22 
 
2  
2016/679 GDPR and the question of whether the TC String can be considered 
personal data. 
Questions referred for a preliminary ruling 
1. (a) Must Article 4(1) of Regulation (EU) 2016/679 of the European 
Parliament and of the Council of 27 April 2016 on the protection of natural 
persons with regard to the processing of personal data and on the free movement 
of such data, and repealing Directive 95/46/EC, read in combination with 
Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, be 
interpreted as meaning that a character string that captures the preferences of an 
Internet user in connection with the processing of his or her personal data in a 
structured and machine-readable manner constitutes personal data within the 
meaning of the said provision in respect of (1) a sectoral organisation which 
makes available to its members a standard whereby it prescribes to them how that 
string should be generated, stored and/or distributed practically and technically, 
and (2) the parties that have implemented that standard on their websites or in 
their apps and thus have access to that string?  
(b) Does it make a difference in that regard if the implementation of the 
standard means that this string is available together with an IP address?  
(c) Does the answer to questions 1(a) and 1(b) lead to a different conclusion if 
this standard-setting sectoral organisation does not itself have legal access to the 
personal data that are processed within this standard by its members? 
2. (a) Must Articles 4(7) and 24(1) of Regulation (EU) 2016/679 of the 
European Parliament and of the Council of 27 April 2016 on the protection of 
natural persons with regard to the processing of personal data and on the free 
movement of such data, and repealing Directive 95/46/EC, read in combination 
with Articles 7 and 8 of the Charter of Fundamental Rights of the European 
Union, be interpreted as meaning that a standard-setting sectoral organisation 
must be classified as a controller if it offers its members a standard for managing 
consent which contains, in addition to a binding technical framework, rules setting 
out in detail how those consent data – which constitute personal data – must be 
stored and disseminated?  
(b) Does the answer to question 2(a) lead to a different conclusion if this 
sectoral organisation itself does not itself have legal access to the personal data 
that are processed within this standard by its members?  
(c) If the standard-setting sectoral organisation must be designated as a 
controller or a joint controller for the processing of Internet users’ preferences, 
does that (joint) responsibility of the standard-setting sectoral organisation 
therefore automatically extend to the subsequent processing by third parties for 
which the Internet users’ preferences were obtained, such as targeted online 
advertising by publishers and vendors?  
IAB EUROPE 
 
3 
Provisions of EU law relied on 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation) 
Provisions of national law relied on 
Wet tot oprichting van de Gegevensbeschermingsautoriteit (Law on the 
establishment of the Data Protection Authority), in particular Articles 100 and 101 
Succinct presentation of the facts and the procedure in the main proceedings 
1 The TCF developed by IAB Europe plays a role in real-time bidding. This concept 
refers to the instantaneous and automatic online auction of user profiles for the 
sale and purchase of advertising space on the Internet. When users visit a website 
or application which contains advertising space, technology companies 
representing thousands of advertisers can bid instantaneously (‘in real time’) 
behind the scenes for that advertising space via an automated auction system. By 
means of algorithms, targeted advertisements specifically tailored to the user’s 
profile can then be displayed.  
2 One of the most widely used technical standards for real-time bidding is the 
OpenRTB protocol. IAB Europe developed the TCF to promote GDPR 
compliance when using this OpenRTB protocol. That purpose is served by the 
TCF standard, which defines a certain method of selling advertising space on the 
Internet. On the technical level, this uses a Consent Management Platform 
(‘CMP’). This is an interface which appears when users first visit a website or 
application. There, they can consent to the collection and sharing of their personal 
data or object to one or more ways in which adtech vendors process personal data 
based on legitimate interests.  
3 The TCF facilitates the recording, via the CMP, of users’ preferences. These 
preferences are then encrypted and stored in the TC String, which is shared with 
the organisations participating in the OpenRTB system. They then know to what 
the user has consented or objected. The CMP also places a cookie (euconsent-v2) 
on the user’s device. In combination, the TC String and the euconsent-v2 cookie 
can be linked to the user’s IP address.  
4 The respondent received complaints from several Belgian and foreign parties 
about this practice and found, in a decision dated 22 February 2022, inter alia, 
that, by recording consent, objections and preferences of individual users as a 
unique TC String, the TC String is linked to identifiable users and that IAB 
Europe acts as a controller in that regard. The respondent also ordered IAB 
Europe to adopt a series of technical and organisational measures to bring its 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-604/22 
 
4  
practices into line with the GDPR and imposed an administrative fine of 
EUR 250 000. IAB Europe lodged an appeal against that ruling with the referring 
court.  
Essential arguments of the parties in the main proceedings 
5 IAB Europe challenges the contested decision and raises 19 complaints in support 
of its appeal, the first eight of which concern these proceedings. The essence of 
the remaining complaints is that it was wrongly found in the contested decision 
that the appellant processes personal data. According to the appellant, there is no 
question of it using personal data, because only the other participants in the TCF – 
and not the appellant – can combine the TC String with an IP address to turn it 
into an item of personal data. The TC String itself is not unique for a given user. 
Moreover, the appellant has no legal access to the personal data that its members 
process within the TCF. Furthermore, the appellant disputes that it is a controller 
for processing of TC Strings.  
6 According to the respondent, TC Strings do constitute personal data. After all, 
CMPs can link the TC Strings to IP addresses. Moreover, TCF participants can 
also identify users on the basis of other data, and IAB Europe has access to 
information that allows that to happen. Finally, that user identification is precisely 
the purpose of the TC String, which facilitates targeted advertising.  
7 The fact that IAB Europe must be regarded as a controller within the meaning of 
the GDPR is demonstrated by its decisive role in the processing of TC Strings. 
That organisation determines the purposes and means of processing, how TC 
Strings are generated, modified and read, and how and where the necessary 
cookies are stored. Furthermore, IAB Europe determines who receives the 
personal data and on the basis of which criteria the retention periods for the TC 
Strings can be determined.  
8 The initial complainants, who have voluntarily intervened in the proceedings, also 
emphasise that IAB Europe is the controller. They point out that the TCF itself, 
for which IAB Europe expressly states that it is responsible, obliges participants to 
process personal data, in its own words, in order to align the processing of that 
data through the OpenRTB auction system with the GDPR.  
Succinct presentation of the reasoning in the reference for a preliminary 
ruling 
9 According to the referring court, the following questions arise: whether, with the 
TC String, IAB Europe uses personal data, be it in combination with an IP address 
or otherwise, and whether IAB Europe is a controller within the meaning of the 
GDPR.  
IAB EUROPE 
 
5 
10 As regards the first issue, the referring court finds that there is an important 
question of interpretation of the relevant EU legislation which is moreover new 
and exceeds the importance of the specific dispute. The views on the second issue 
– IAB’s denial that it is a controller and the opposite view of the respondent and 
the complainants – reflect, according to the referring court, the views of different 
national supervisory authorities. The Court of Justice has not yet had an 
opportunity to rule on this matter, however, in the context of the new and far-
reaching technology at issue. The referring court therefore agrees to the request to 
refer questions to the Court for a preliminary ruling.