What happened

The Court examined IAB Europe's framework for consent signals in real-time bidding. A TC String can be personal data when linked to an identifiable user, and IAB Europe can be a joint controller for parts of the processing.

The judgment makes responsibility in advertising technology more concrete. An organisation can be a controller for the rules and signals it designs even if it does not control every later operation by advertisers and brokers.

Legal status in Norway

Relevant to Norwegian organisations under the EEA GDPR; it is a court interpretation, not a GDPR amendment.

What the sources clarify

In real-time bidding, advertising space is auctioned while a page loads. The TC String encodes the user's consent and objections in letters and characters and is shared with brokers and advertising platforms. Combined with the cookie, it could be associated with the device's IP address and contribute to a user profile. The Court found that IAB Europe influenced the purposes and means when preferences were recorded through its framework. Joint control remained limited to operations it influenced: later advertising processing was included only if IAB Europe also influenced the purposes and means of those later operations.

For advertisers and publishers, the judgment means that a TCF signal alone does not prove valid consent. Review must follow the full data flow: who sets the cookie, who receives the IP address and TC String, which vendors are activated, and for what purposes. Contracts and privacy notices should reflect that joint control may cover one operation without automatically extending to every later targeting activity.

Practical implications

Management should require an end-to-end check of at least one advertising flow from the consent choice to recipients. It should end with a named owner for each processing operation, a documented legal basis and a block when a signal is absent or invalid. That provides better assurance than a broad statement that every participant follows the TCF.

Sources

Court of Justice of the European Union: “Press Release 44/24: IAB Europe,” 7 March 2024.

Court of Justice of the European Union: “Judgment in Case C-604/22, IAB Europe,” 7 March 2024.

For discussion

Where is the largest gap between documented control and actual practice?