Please use this identifier to cite or link to this item: https://hdl.handle.net/10419/330354 
Year of Publication: 
2025
Citation: 
[Journal:] Internet Policy Review [ISSN:] 2197-6775 [Volume:] 14 [Issue:] 3 [Year:] 2025 [Pages:] 1-23
Publisher: 
Alexander von Humboldt Institute for Internet and Society, Berlin
Abstract: 
In 2022, the Belgian Data Protection Authority (DPA) issued a fine against IAB Europe. It held this industry association for online advertising liable for multiple violations of the General Data Protection Regulation (GDPR) in relation to the Transparency and Control Framework (TCF). This technical standard is used by most Consent Management Platforms (CMPs) deployed on websites available from Europe. It generates a machine-readable expression of user preferences with regards to online privacy, transmitting to all stakeholders' servers taking part in the display of online advertisements. This is meant to ensure that no identifiers are stored on user devices, thus no personal data are processed, prior to any user consent. The Belgian DPA's qualification of IAB Europe as a joint controller in the operation of this standard, which has been confirmed in January 2024 by the European Union's Court of Justice, could be a significant development generating major implications for the whole internet governance ecosystem, object of the examination conducted in this contribution. However, the specifics of this case mean that it can hardly apply to all internet standard developing organisation.
Subjects: 
Data protection
GDPR
Data controller
Technical standardisation
EU law
Persistent Identifier of the first edition: 
Creative Commons License: 
cc-by Logo
Document Type: 
Article

Files in This Item:
File
Size





Items in EconStor are protected by copyright, with all rights reserved, unless otherwise indicated.