Court rules that tracking-based advertising is illegal in the EU

A Belgian appeals court has ruled that the Transparency and Consent Framework (TCF), which underpins most online advertising, is illegal in the European Union, Engadget reports.

This decision only confirms the previous findings of the Belgian data protection authority from 2022 that the technology used for advertising violates several principles of the European "General Data Protection Regulation", adopted in 2018.

The technology in question is Real-Time Bidding (RTB). It is an advertising method where advertising inventory is bought and sold in real-time auctions. Advertisers bid on individual ad impressions, competing for the right to show their ads to a specific user based on factors such as demographics, interests, and online behavior. The highest bidder gets the ad and it appears on the web page.

At the same time, TCF is an accountability tool that relies on standardization to facilitate compliance with certain provisions of the ePrivacy Directive and the GDPR. TCF was created by the Interactive Advertising Bureau (IAB) to standardize how websites ask users for permission to track them. An initial 2022 ruling determined that both the consent collected by TCF and the data collected in the RTB process were unlawful under the GDPR.

"Today's court's decision shows that the consent system used by Google, Amazon, X, Microsoft, deceives hundreds of millions of Europeans. The tech industry has sought to hide its vast data breach behind sham consent popups. Tech companies turned the GDPR into a daily nuisance rather than a shield for people," said Johnny Ryan, director of the Irish Civil Liberties Council’s Enforce unit, which led the campaign against the current approach to ad tech.

IAB Europe, which filed the appeal, was largely relieved that it was not found liable for data collection under the TCF. The organization notes that it has already proposed changes to the TCF that more accurately reflect its "limited control" and has submitted them to the Belgian data protection authority for review. The original decision would have exposed the IAB to potential fines and required it to make major changes to its current advertising infrastructure.