{"page":"/blog/gdpr-eprivacy-bidstream-tcf","modified":"2026-10-18","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Date","Body","Decision","Source"],"rows":[["2 February 2022","Belgian APD","Decision 21/2022: TC String is personal data; IAB Europe is a controller; no legal basis for the TC String; transparency, security and DPIA failures; €250,000 fine; action plan within two months","APD, 2 February 2022"],["11 January 2023","Belgian APD","Action plan approved, six months to implement; implementation later suspended pending the Market Court","APD"],["7 March 2024","CJEU (C-604/22)","TC String is personal data when linkable to an IP address; IAB Europe is a joint controller for recording preferences; joint controllership \"does not extend automatically to the subsequent processing\" by publishers and vendors","CJEU"],["14 May 2025","Brussels Market Court (2022/AR/292)","Upheld the APD's findings (personal data, joint controller within the TCF, Articles 6, 12 to 14, 35, 5(1)(f), 25, 32, 37); IAB Europe not a controller for processing solely within OpenRTB; decision partially annulled on procedural grounds","DLA Piper, 11 June 2025"]],"sourceUrls":[["https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr"],["https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr"],["https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0604"],["https://privacymatters.dlapiper.com/2025/06/eu-brussels-court-of-appeal-rules-on-iab-europe-and-the-tc-string-implications-for-gdpr-compliance/"]]}