A computer generated padlock with a real man's hand reaching out to touch it

IAB Europe expecting to be found in breach of GDPR

Following reports earlier this year that the UK was set for a data rules shakeup relating to online cookies, it has been revealed that one widely used framework for gathering consent for tracking cookies is set to be found in breach of the EU’s General Data Protection Regulation (GDPR).

IAB Europe’s Transparency and Content Framework (TCF) was actually found to be non-compliant with several strands of the GDPR by the Belgian Data Protection Authority (DPA) in October 2020. However, after 12 months of the complaint moving through the DPA’s litigation chamber and process, an official decision is now set to be issued.

According to an IAB Europe press statement, it expects its entire business, rather than just the TCF, to be found in breach of the GDPR.

Pre-emptive move unlikely to prevent penalties but may prolong process

While not wholly unprecedented, issuing a pre-emptive statement ahead of a judgment is a somewhat unusual step.

Notably, IAB Europe seems to be looking to reassure users of the TCF by saying the issue is “fixable” within six months. However, the body is non-committal as to how. IAB Europe also seeks to imply that the finding itself may not be fixed an absolute, as the Belgian DPA isn’t acting on behalf of the EU as a whole. However, if other European DPAs disagree with the Belgian findings and recommended actions, the European Data Protection Board may need to intervene. Such a scenario saw WhatsApp slapped with a fine earlier this year that was significantly larger than the one initially proposed.

While IAB Europe’s statement won’t change whatever judgment is handed down, it sets the scene for a prolonged process of disputes and appeals, meaning there likely won’t be a final resolution until at least the end of 2022. However, even that timeline looks like a generous best-case scenario given the glacial pace with which such investigations and appeals have proceeded in recent years.

Whatever the outcome, and to whatever degree European DPA’s agree on a course of action, expect IAB Europe to keep this one running for as long as possible. Tracking cookies probably aren’t going to disappear just yet!

Complainants yet to see ruling

One point of note, and of some concern, is that while IAB Europe appears to have been given a heads up about what they should expect to be in the Belgian DPA ruling, complainants have not. While it is standard practice for parties to get early access to such documentation to prepare press comments and the like, it’s somewhat questionable when only selected parties get this.

That hasn’t stopped complainants from commenting, though. One of them, Johnny Ryan of the Irish Council for Civil Liberties (ICCL), issued a press statement himself, in which he said: “We have won. The online advertising industry and its trade body, ‘IAB Europe’, have been found to have deprived hundreds of millions of Europeans of their fundamental rights.

“IAB Europe designed the misleading ‘consent’ popups that feature on almost all (80%+) European websites and apps. That system is known as IAB Europe’s ‘Transparency & Consent Framework’ (TCF). These popups purport to give people control over how their data are used by the online advertising industry. But in fact, it does not matter what people click.”

IAB Europe defiant in light of likely judgment

IAB Europe’s case for its defence seems to rely on it saying it didn’t know it was a data controller, “based on guidance from other DPAs up to now.” IAB Europe’s statement says that this is why it hasn’t fulfilled the obligations expected of data controllers and shouldn’t be punished for failing to fulfil them.

Will ad tracking be banned outright?

Judgment being handed down in this case comes as the European Parliament looks increasingly likely to move towards banning behavioural advertising outright. If, after the appeals process is complete, IAB Europe and its TCF are definitively found to breach the GDPR, then it seems inevitable that such legislation will be introduced with haste.

What happens next?

It remains to be seen what the definitive outcome of this case will be. Should IAB Europe be found in breach of GDPR and fail with any appeals, that will lead to game changing shakeup to the entire online advertising industry, with significant financial penalties likely to be levied against the body, too.