Court decision · 7 March 2024
IAB Europe v Gegevensbeschermingsautoriteit
Case C-604/22, ECLI:EU:C:2024:214 · Court of Justice of the European Union
What it means for your code
Consent records and ad-tech preference strings are themselves personal data; the vendors and frameworks you plug in share responsibility with you.
What happened
The Belgian DPA found that the Transparency & Consent Framework used across the ad-tech industry processed personal data; IAB Europe challenged the decision.
What was decided
A consent string (TC String) recording a user's preferences is personal data where it can be linked to an identifier such as an IP address, and the organisation defining the framework can be a joint controller.
The legal test applied
- Information that can be linked to an identifier such as an IP address by reasonable means is personal data
- An organisation that defines the framework and rules for processing can be a joint controller without accessing the data
What would have changed the outcome
- Consent signals that genuinely cannot be linked to an identifier fall outside the GDPR
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.