Belgium: Market Court issued ruling classifying the Transparency and Consent String as personal data under Interactive Advertising Bureau's Transparency and Consent Framework

On 14 May 2025, the Belgian Market Court ruled in the case between the Belgian Data Protection Authority (DPA) and Interactive Advertising Bureau (IAB) Europe regarding the Transparency and Consent Framework (TCF). The ruling followed the Court of Justice of the European Union's (CJEU) judgment of 7 March 2024 (case C-604/22), which confirmed that the TC String constitutes personal data under the General Data Protection Regulation (GDPR) and designated IAB Europe as a joint data controller. The TC String is an encoded component of IAB Europe's TCF that records a user's consent choices for personal data processing in online advertising. While the original decision by the DPA in 2022 was annulled on procedural grounds, the Market Court upheld the EUR 250’000 fine imposed on IAB Europe and endorsed the DPA's core legal reasoning. The DPA had previously found that the TCF involved the collection and dissemination of personal user preferences without obtaining proper consent or lawful basis, constituting breaches of GDPR provisions on lawful processing and the principles of lawfulness and fairness. Following this ruling, data controllers and websites providing advertising space must disclose if they are using the TCF framework, as IAB Europe's influence over data processing operations when user consent preferences are recorded makes it a joint controller under GDPR.