IAB Europe this morning announced that Belgium’s data protection authority, the APD, has suspended its six-month deadline for IAB Europe to rethink its Transparency and Consent Framework, a widely used technical specification for collection and passing user consent through digital advertising supply chains. The announcement means that IAB Europe won’t have to make any immediate changes to the TCF.
The news is the latest chapter in a long-running legal debate about the validity of the TCF under Europe’s General Data Protection Regulation.
The APD gave IAB Europe a limited window to develop an action plan after it ruled last February that the TCF doesn’t comply with the General Data Protection Regulation – the very piece of legislation which it was designed to accommodate. This action plan, which hasn’t been fully revealed, detailed adjustments which IAB Europe could make to the TCF in order to make it GDPR compliant, under the APD’s interpretation.
IAB Europe created this action plan, and the APD approved it earlier this year, kicking off a six-month timeline for those changes to be made.
But IAB Europe has always contested the APD’s original decision, and the case has worked its way through to Europe’s highest court, the Court of Justice of the European Union (CJEU). The CJEU is deliberating some of the decisions made by the APD in its original ruling, which are key to answering the wider question of whether the TCF is GDPR-compliant.
So IAB Europe is hoping that the CJEU will rule against the APD’s initial judgement, which would mean there wouldn’t be any need to make changes to the TCF anyway, rendering the whole action plan redundant. And the trade body had argued that implementing an action plan which may prove to be redundant would be harmful for the industry, since publishers and ad tech companies would have to adapt to the new framework, only to roll back those changes further down the line.
“The APD’s validation of the action plan was a welcome confirmation of the legality of the TCF, but its timing had raised legitimate concerns,” said Townsend Feehan, IAB Europe CEO. “Many organisations in the sector have shared their surprise that the APD imposed a deadline for implementation despite the referral of key questions to the European Court of Justice.”
“The voluntary suspension by the APD of the implementation of the action plan will enable the release of sustainable improvements to the TCF pending the decision of the Belgian Market Court,” Feehan added.
Change is coming
The news is a reprieve for IAB Europe, but it doesn’t mean there aren’t any changes coming for the TCF.
IAB Europe says it’s already working on some changes relating to the APD’s complaint, since not all of the APD’s concerns hinge on the CJEU’s ruling. For example, one of the points in the action plan outlined by IAB Europe is an introduction of restrictions on use of legitimate interest (a legal basis for collecting and processing data without consent) by vendors within the TCF. Whether legitimate interest can be claimed as a legal basis for consent-free targeted advertising isn’t one of the points being considered by the CJEU, so this change may still be made anyway (though IAB Europe hasn’t said that this is the case).
And it’s possible that the CJEU will agree with the APD’s initial ruling, which would mean the timeline would resume for IAB Europe to follow through with the entire action plan.
However, things have certainly improved for the TCF since the APD first argued that it falls foul of the GDPR. At the time, some privacy advocates said the judgement confirmed that large swathes of digital advertising infrastructure aren’t compliant with GDPR, calling for a wholesale stripping of personal data from digital advertising.
The fact that the IAB Europe and APD have agreed on an action plan at least shows that there is a future for the TCF in one form or another, and it won’t be scrapped completely.
