IAB Transparency & Consent Framework (TCF) is an open standard jointly developed by the European advertising industry and launched in 2018 to help stakeholders comply with EU privacy regulations (GDPR and ePrivacy), particularly in programmatic advertising. It enables websites and technology vendors to manage user consent transparently and consistently across the advertising supply chain. Consent is recorded using a technical identifier known as the TC String (Transparency and Consent String), which stores a user’s choices regarding which vendors are granted consent and for what purposes cookies or personal data may be used.
In February 2022, the Belgian Data Protection Authority (APD) issued a decision questioning the legality of the TCF. The APD ruled that the TC String constitutes personal data and that IAB Europe acts as a data controller for its processing, not only for documenting consent but also for the subsequent use of that data within the programmatic advertising supply chain. IAB Europe was fined €250,000 and required to submit a corrective action plan. This triggered a years-long legal process. It concluded in May 2025 when the Belgian Market Court confirmed its final interpretation based on a preliminary ruling issued by the Court of Justice of the European Union (CJEU) in spring 2024.
The outcome: IAB Europe is not responsible for how other parties process the data, such as for targeted advertising. Its role is limited to managing the TCF and generating the TC String. At the same time, it was confirmed that the TC String can sometimes constitute personal data, particularly when combined with other identifiers, such as an IP address. In such cases, processing requires a valid legal basis under the GDPR.
It’s important to note that the process is not yet fully concluded — a second appeal is still ongoing before the Belgian Market Court, relating to the enforcement of the original APD decision.
What does the decision mean in practice?
The TCF has not been deemed illegal. Publishers and technology providers can continue using it, ensuring TC Strings are treated as personal data when linked to an identifiable user.
IAB Europe’s responsibility is limited to creating and managing the TC String, not how consent data is subsequently used for ad targeting. This means each party remains responsible for its data processing activities.
The TCF remains a valid and valuable way to manage consent transparently, provided that participants, such as publishers, CMP providers, and SSPs, ensure their privacy practices comply with the GDPR.
What happens next?
The Belgian Market Court’s ruling now allows IAB Europe to implement the corrective action plan it previously submitted, at least for the necessary parts. Some planned changes have already been implemented (e.g. TCF v2.2), and a new update (TCF v2.3) is currently open for public comment.
It’s important to note that the implementation of the action plan, including the addition of IAB Europe to the vendor list, is currently on hold. The reason is an ongoing second appeal before the Belgian Market Court concerning the enforcement of the original APD decision. It is unlikely that any progress will be made before the summer break, but the market will be informed well in advance of the next steps.
Summary: What should publishers do now?
The Belgian Market Court’s May 2025 ruling clarifies the legal status of the TCF in Europe and offers digital publishers greater certainty around its continued use. The TCF is not illegal, but its use requires compliance with the GDPR when the TC String can be linked to an identifiable user.
Key actions for publishers:
- Ensure you use an up-to-date TCF version (v2.2 or later v2.3).
- Confirm that your CMP supports the latest TCF updates, particularly regarding TC String handling and consent documentation.
- Ensure that your privacy policy and consent management are aligned with the GDPR, especially when the TC String is combined with other identifiers.
- Monitor the situation regarding IAB Europe’s addition to the vendor list and be prepared to include it once the process moves forward.
This decision finally brings some stability after years of uncertainty. Now is a good time to review your practices and ensure that consent management is transparent, from both the user’s and the regulator’s perspective.