Belgium's 2022 ruling found a consent tool itself broke GDPR

The revenue mechanism

On 2 February 2022 the Litigation Chamber of Belgium's Data Protection Authority issued Decision on the Merits 21/2022, ruling on a complaint against IAB Europe over its Transparency and Consent Framework, or TCF, the mechanism most European real-time-bidding advertising uses to record and pass a reader's consent choice as a TC String between publishers, consent platforms and ad vendors. This matters directly to publisher revenue because the TCF underlies most programmatic header-bidding advertising sold into the EU; if its signal is not lawfully generated, every downstream party inherits that problem, the theory the decision pursues by finding IAB Europe a data controller for the TCF.

What the documents show

The decision's operative order finds breaches of GDPR's lawfulness and transparency principles under Article 5(1)(a) and Article 6, its information duties under Articles 12 to 14, its security and design duties under Article 5(1)(f), Article 25 and Article 32, and its duty to appoint a data protection officer under Article 37, given what it describes as the large-scale, systematic monitoring the TCF involves. The regulation's own text sets out each article's requirement, including the design duty applied to the TC String's integrity. The decision ordered IAB Europe to submit a remedial plan within two months and complete six compliance measures, including establishing a lawful basis and barring reliance on legitimate interest, within six months, backed by a 5,000 EUR daily penalty and a 250,000 EUR fine.

The assumptions exposed

The decision's own cover page records that it was appealed and that the Brussels Market Court referred preliminary questions to the Court of Justice in Case C-604/22, so it should be treated as under appeal at the time of the dossier, not a final, unappealable determination, even though it remained the operative Belgian ruling as retrieved. It addresses the TCF's design and governance, not every publisher's separate use of it, so a post-ruling TCF version does not automatically resolve a publisher's own consent-collection practices. IAB Europe's role, a controller for the framework's design, is distinct from a publisher's role as controller for the choices its own site collects.

What to check before you rely on it

This is an editorial checklist, not legal advice: confirm which TCF version a site's consent platform runs, since the framework changed after this decision; confirm the site's banner does not rely on legitimate interest for ad personalization, which the decision ordered barred; and note the underlying legal questions were still working through the EU courts as of the decision's own appeal notice.

• Does the site's consent-management platform run a TCF version built after this decision's remedial order, or an older one?
• Is any ad partner on the site still relying on legitimate interest rather than consent for personalized advertising?
• Has the site checked whether the later Court of Justice proceeding changed any operative requirement since this decision?

A consent signal that looks technically valid to an ad server is not the same as one a regulator has found lawfully generated, and this decision is the clearest illustration of that gap issued against the mechanism most European publishers still rely on.