The Court of Justice of the European Union sheds light on the legal boundaries and responsibilities of digital advertising platforms and associations like IAB Europe in the rapidly evolving online advertising ecosystem.
In a landmark ruling of March 7, 2024 (C-604/22), the Court of Justice of the European Union has delivered clarifications on the intricacies of auctioning personal data for advertising purposes under the General Data Protection Regulation (GDPR).
Background of the Case
The practice in question, known as Real Time Bidding (RTB), involves companies, brokers, and advertising platforms bidding in real-time to secure advertising space on websites and applications. These spaces are then used to display targeted advertisements based on the user’s personal data, such as location, age, and browsing history. Under the GDPR, such processing of personal data requires prior consent from the user.
IAB Europe, a non-profit association representing the digital advertising and marketing sector in Europe, introduced a mechanism it claimed to align this auction system with GDPR requirements. This solution involves the use of a ‘Transparency and Consent String’ (TC String) alongside cookies to store and communicate user consent preferences. However, the Belgian Data Protection Authority challenged this approach, deeming the TC String as personal data and concluding that IAB Europe is acting as a data controller without adhering to GDPR mandates which lead to corrective measures and fines against IAB Europe.
The Court’s Judgment
The EU Court of Justice has affirmed that the TC String, especially when linked with an identifier like an IP address, indeed constitutes personal data as it can be used to profile and identify users. The fact that IAB Europe cannot itself combine the TC String with the IP address of a user’s device and does not have the possibility of directly accessing the data processed by its members in the context of the adopted consent framework was insufficient to preclude the TC String from being classified as personal data. The CJEU referred in that respect to the means reasonably likely to be used either by the controller or by another person to identify the natural person, directly or indirectly. Consequently, it is sufficient that relevant information is in possession of IAB Europe members or other participants of the framework that are required to provide it (which should be verified by the local court). This crucial determination clarifies the scope of personal data within the ambit of digital advertising.
Consequently, the Court recognized IAB Europe as a ‘joint controller’ for the purposes of GDPR. This classification is pivotal, highlighting that IAB Europe, alongside its members, holds influence over and determines the purposes and means of processing the consent preferences recorded in the TC String. However, the Court also delineated the limits of this responsibility, indicating that IAB Europe’s role as a controller does not extend to data processing operations conducted after these preferences have been recorded, unless it is proven that IAB Europe influences those subsequent operations.
Implications for the Digital Advertising Sector
This judgment has profound implications for the digital advertising world, emphasizing the need for explicit consent and transparent handling of personal data in accordance with GDPR standards. It reinforces the principle that organizations, regardless of their operational capacities in the data processing chain, must adhere to strict data protection responsibilities when they can determine the purposes and means of data processing.
For digital advertisers, this means a reconsideration of their data handling practices, ensuring that user consent mechanisms are GDPR-compliant and that their roles in data processing are clearly defined and justified. It also underscores the importance of collaboration among all parties involved in digital advertising to foster GDPR compliance, especially in complex operations like RTB.
Conclusion
The Court of Justice’s ruling provides much-needed clarity on GDPR compliance in the context of auctioning personal data for advertising purposes. It underscores the critical importance of obtaining prior user consent and delineates the responsibilities of entities like IAB Europe in the digital advertising ecosystem. As digital advertising continues to evolve, this judgment serves as a reminder of the paramount importance of privacy and data protection in the digital age.