ECJ finds IAB Europe responsible for TCF consent spam popups across the Internet

> On 2 February 2022 the Belgian Data Protection Authority, in agreement with 27 other EU data protection authorities, ruled that the [IAB controlled] “TCF” consent spam system is illegal.

You could start be removing all tracking code from your site and code sharing with 3rd parties.

Boom, compliant (in that part) and not even a need for a consent form in the first place.

The you may add a feature to track and share with 3rds, but opt in. The you need the consent but can get it in a privacy friendly way.

Oh, but you “cannot” do this because the ads won’t work and you’ll loose profit? What you dont seem to realise is that this decision is already made for you by EU: with GDPR the eu made the decision that privacy is more important than your profit. You just have to face facts and stop trying to figure a way around it. Yes that means rethinking business models, but I would wager that had people known fully how they were tracked and profiled, they would not have done business with you in the first place thus your ad/tracking based business model was only valid through deception.

Article 4 from the GDPR:

> ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

Seems so obvious that they're a controller by that definition (specifically a "Joint Controller" according to Article 26), even if "only sets the rules for how data should be used" would be true, that would put them inside the definition, so even by their own admission, they are a controller?

> However, this was appealed at the Brussels Markets Court. [...]

> The Brussels Markets Court can now proceed to rule on the matter with certainty that IAB Europe is indeed responsible, and that the data concerned are protected by the GDPR.

But my tl.dr. as I understand it is that IAB provides a Transparency Consent Framework[2] to its users, which includes popup cookies.

They lost a case where they argued they don't have any responsibility ( to the degree that they didn't even have a Data Privacy Officer or had done a Data Privacy Impact Assessment) for providing the IAB compliance popups. These popups were used by others in order to do gain "consent" to do real time bidding ads (and probably other things), it might be that they also provided some level of RBT.

They lost and the court said they are jointly responsible and need to fix long list of things and pay 250k euro.

IAB then appealed and the appeals court deferred it to the ECJ, who has now said that yes they do have a join responsibility.

So as I understand it, this is sadly not the death-blow to valid or invalid consent popups. But at least it might improve the UX on them.

[1] https://web.archive.org/web/20240109014435/https://www.gegev... [2] https://iabeurope.eu/transparency-consent-framework/

I hate the system as it is —the "do not track" header should mean something— but I'll take a disclaimer, an explanation of how they plan to use my data, and an opt-out over the Wild West.

They're catching up but it'll be a while. The Federal HIPAAGLBACOPPAFERPABBQ are all pretty toothless and even the golden child, California's CCPA is a series compromises that doesn't accomplish that much.

The first time I went there I spent about half the day in the park tossing frisbees to dogs just to marvel at how smoothly everything seemed to move.

You see that, and your problem is not "why do they need PII to let me do anything, nor "why are they giving my data to others", nor "why to SO MANY others", nor "why do they not want to tell me", no your problem is that they tell you. By describing the problem as "the law that force them" instead of "sharing so much with so many", you are saying of the two solutions available to fix that, you would prefer that they not tell you, instead of just not doing this mass sharing of PII anymore.

These banners are not what the law said had to happen. These banners are the mass sharing companies malicious compliance to get users to complain about the protection the law gives them instead of complaining about the original abuse that triggered it.

They're doing it this way because, as you show, it does work, people buy it and eat it.

(I wish I was kidding, though it is not such a common occurence)

I visited the US and it took me a few months to stop receiving spam from businesses I interacted with. There were ads at the petrol pumps and in the bathrooms and basically everywhere else. There was little concept of consent wrt advertising and data collection, something I've come to take for granted.

It wasn't as bad as I make it, but it shows how our priorities might differ.

https://blog.didomi.io/vietnam-data-privacy-law-pdpd-everyth...

However, I guess we won't talk much about Vietnam's new law on the English speaking web, whether it's successful or not. Purely because we don't talk or hear much of anything about Vietnam's internal policies on the English speaking web. While we will continue to discuss every tiny detail about the GDPR.

https://www.priv.gc.ca/en/privacy-topics/technology/online-p...

Canada has its own version of TCF.

There are loads, and loads more are coming.