What is the Transparency & Consent Framework?
GDPR requires a consent framework which can handle both an opt-in and opt-out signal from a consumer and ensure that these can be responsibly passed through to tech vendors and adhered to consistently and persistently throughout the online advertising ecosystem.
The Transparency & Consent Framework (TCF) was established by IAB Europe to ensure that when a user in Europe visits a website or app, they are presented with a consent notice that asks them for their permission to allow certain data processing activities. The user can then choose to grant or withhold consent for each purpose. The consent or denial is then stored in a consent string, which can be seamlessly passed on to other parties throughout the advertising ecosystem. In the TCF these consent strings are known as TC Strings.
What were the legal challenges brought against IAB Europe related to the TCF?
The legal processes started on 2nd February 2022 when the Belgian Data Protection Authority (DPA) ruled that IAB Europe was acting as a 'data controller' for the data being processed via TC Strings. Data controllers are defined as making decisions about data processing activities, and exercise overall control of the personal data being processed and are ultimately in charge of and responsible for the processing. The timeline of events & decisions thereafter were as follows:
4th March 2022 - IAB Europe appeals the Belgian DPA decision.
7th September 2022 - The case refers to the Court of Justice of the European Union (CJEU) to clarify on the key points of contention, namely the status of IAB Europe as a data controller and whether or not TC Strings qualify as being personal data.
16th May 2023 - IAB Europe launches TCF v2.2 to mitigate any risks and meet the needs of the industry.
7th March 2024 - The CJEU determines that IAB Europe is a data controller and that TC Strings do qualify as being personal data, but limits the repsonsbility of IAB Europe in the processes which overturns the initial Belgian DPA ruling.
14th May 2025 - The case is referred back to the Belgian Market Court who confirm that legally the TC String is personal data and that IAB Europe are deemed a joint controller of the data - but that in practice the TC String is legal if IAB Europe are included in the registry of approved vendors of the TCF.
What are the practical ramifications for the validity of the TCF in Europe?
The most recent ruling, on 14th May 2025, confirmed that the TC Strings qualify as personal data and that IAB Europe must be regarded as a joint controller under the GDPR, but only for its own processing of TC Strings. One can see the decision as a workable comprimise between IAB Europe effectively losing a legal appeal, but succeeding in practice to find a way to make the TCF workable both legally and operationally moving forwards.
In practice this finally draws a line under these ongoing legal proceedings and means that:
- The TC Strings, which communicate consumer consent preferences through to the online advertising ecosystem, must be regarded as personal data under GDPR. As a result, in order to run ad targeting in Europe through the OpenRTB protocols, IAB Europe must itself be included amongst those vendors granted permission for collecting or using data.
- The past infringements of the early versions of TCF were addressed by IAB Europe with the launch of v2.2 (May 16th 2023) which replaced previous versions and are 100% legal as they have not been targeted by the various legal proceedings.
- Additionally, TCF v2.3 has already been built by IAB Tech Lab and is currently 'open for comment' (see link below).
- Vendors or publishers using the TCF in Europe do not need to change anything and IAB Europe will shortly update the industry with a new contractual framework, in which IAB Europe is included in the registry of approved vendors in order to comply with the court findings.
What might this mean for the Australian market as we await an update on the Privacy Review?
Here in Australia we should actually stand to benefit from the ongoing challenges to IAB Europe's framework as the TCF has been under such intense scrutiny both legally and technically over the past few years. This can give us confidence that any version of a framework we eventually develop and adopt here can be workable both from a practical perspective but also a legal basis.
We can also lean on the more recent experience of the Canadian market – as IAB Canada has rolled out its version of TCF there in the last 12-18 months and IAB Australia work closely with IAB Canada and are regularly in touch with them on their ongoing learnings.