Online advertising: Belgian court ends cookie banner dispute with clear ruling

An appeals court in Belgium has now clarified the dispute over the most important standard for real-time advertising on the internet: The version used for years has massively violated data protection law. This could have consequences for the entire online advertising market in the European Union.

Last year, the European Court of Justice ruled in a landmark decision that the transparency and consent string is personal data within the meaning of the General Data Protection Regulation. This transparency and consent string makes it possible to identify users across all pages. The framework is being developed by the online advertising industry association, IAB Europe. Clarity has been sought for years in a procedure initiated by the Belgian data protection authority APD in 2019.

If a user indicates their advertising preferences on one of the many websites that use IAB Europe's TCF framework, this is noted via a cookie and also made available to all other websites that market ad spaces in real time based on this framework as part of the OpenRTB protocol. For this process, the TC string is generated by IAB Europe to be able to assign the information to a user profile. Following questions referred by the Belgian Court of Appeal for Economic Matters, the ECJ judges had already declared that the TC-String constitutes personal data within the meaning of the GDPR –. However, the Belgian judges now had to define the specific consequences of this assessment in their ruling.

Advertising association remains optimistic

In an initial reaction, Hielke Hijmnans from the Belgian data protection supervisory authority APD sees two key points in particular: “That this decision of the Market Court, just like the ECJ 2024 decision, confirms our position that the TC String is personal data and that IAB Europe acts as a controller for the processing of user preferences under the TCF.” For everything else, the ruling, which was published in Flemish today by the ICCL, must now be thoroughly analyzed.

The decision shows “that the consent system used by Google, Amazon, X and Microsoft is deceiving hundreds of millions of Europeans”, says Johnny Ryan from the Irish Council for Civil Liberties. Ryan has been fighting for years against what he considers to be unlawful data processing and, together with other European data protection activists, took part in the proceedings as a joint plaintiff. It is the companies' fault that the General Data Protection Regulation has been “turned into a daily nuisance” instead of protecting people. For Ryan, it is clear: “The tech industry has tried to hide its huge data protection breaches behind fake consent pop-ups.”

New version of the TC string

The online advertising industry association IAB Europe is also satisfied with yesterday's ruling by the Belgian court – but for completely different reasons. Firstly, because the judges overturned the decision of the Belgian data protection authority APD on formal grounds. This would have meant a fine of 250,000 euros. On the other hand, IAB Europe also breathes a sigh of relief because the ruling establishes that the association is not a data controller beyond the TC-String – which is the company that uses it. Furthermore, according to IAB Europe, a new version 2.2 of the standard has already been developed, which already takes the ruling into account from the association's perspective – Companies can no longer rely on the “legitimate interest” under the GDPR for profiling purposes.

The APD's fine will now be replaced by the court ruling. However, the fact that those companies that have relied on the TCF as a standard for years and have worked with personal data unlawfully can now also expect to receive notices from the competent authorities is only one aspect. Due to the lack of a legal basis for processing, both IAB Europe and the advertising market operators using the TCF standard could face claims for damages. These could exceed a possible fine, as almost every internet user in the EU was affected by the unlawful processing. Even small individual compensation could therefore result in large sums of money.

(dahe)