IAB Europe reacts to APD’s validation of its action plan

The validation of the action plan by the APD confirms the legal functionality of the Transparency and Consent Framework (TCF) within the provisions of the General Data Protection Regulation (GDPR).  

Each step described in the action plan is the result of a careful assessment of which measures are best suited to meet the APD’s interpretation of the GDPR (as laid out by the APD in February 2022) and deliver extended compliance functionality to the TCF. It reflects a collaborative effort and in-depth discussions amongst IAB Europe member companies and associations, that convene in the TCF working groups to iterate the Framework to meet the expectations of the APD. 

This said, the measures proposed in the action plan stem directly from the assumption that (i) the TC String (a digital signal containing user preferences) should be considered personal data and that (ii) IAB Europe acts as a (joint) controller for the dissemination of TC Strings and other data processing done by TCF participants. Both of these assumptions have been referred to the Court of Justice of the European Union (CJEU) by the Belgian Market Court for a preliminary ruling, and such referral was explicitly asked by the APD itself in the course of the proceedings.  

While IAB Europe is pleased that the action plan was favourably received by the APD, it states that it has grave reservations about the APD pre-empting responses from the CJEU which may, as a result, initiate changes to the TCF that might need to be rolled back at the end of the appeal process. Pending the proceedings before the Belgian Market Court and the CJEU, IAB Europe will take any initiative to ensure that any future developments of the TCF are sustainable and aligned with EU-level interpretations of the GDPR.  

Commenting on the latest development, Townsend Feehan, CEO of IAB Europe, said: “The validation of IAB Europe’s action plan confirms the legality of the TCF as a standard that can help digital publishers and their partners comply with certain provisions of the GDPR and ePrivacy Directive. However, it is important to bear in mind that implementation of the action plan – which IAB Europe is now being required to effect over a period of six months – would entail operating changes for TCF participants that may ultimately be found inadequate by the European Court.”  

You can find IAB Europe's FAQs about what's happening with the APD and the TCF here.