FAQ: Updates on the Belgian DPA’s investigation of the IAB’s TCF

November 11, 2021

The IAB Europe’s Transparency & Consent framework is the most widely-used advertising industry framework for GDPR compliance. Launched in 2018, it is used by Consent Management Platforms (CMPs) who have been validated by the IAB Europe, across the biggest media companies in Europe and the US. Over the last year, GDPR complaints against the framework were filed with different data protection authorities in Europe.

A year ago, a series of GDPR complaints were filed against the IAB Europe by a pan-European consortium of privacy activists, including Johnny Ryan of the Irish Council for Civil Liberties and previously Chief Privacy Officer at privacy-first browser Brave. These complaints were focused on the IAB Europe’s Transparency & Consent Framework; in parallel, there were complaints about Real Time Bidding (RTB). 

An investigation by the inspection service of the Belgian Data Protection Authority (DPA), known as the APD, issued a preliminary report with findings that the TCF fails to comply with the GDPR principles of transparency, fairness and accountability, and the lawfulness of processing. Subsequently, this moved to the litigation chamber of the Belgian DPA, but there has been no ruling yet.


On Friday, 5th Nov, the IAB Europe announced that a draft ruling will soon be published by the APD. There has been nothing from the APD yet, but the draft ruling is expected to be published in two to four weeks.

The APD’s draft ruling will be released in the midst of the UK ICO’s recent calls for G7 countries to reform the cookie banner to combat “consent fatigue” and allow for more “meaningful” consent, as well as a push by a member of the European Parliament to ban targeted advertising.


We believe this is an opportunity to improve the standard. Sourcepoint is monitoring the situation very closely, but we don’t expect any changes for our clients in the near future. We’ll continue to be your partner, and help you adapt to the ever-changing regulatory landscape. Standards are a very good thing for compliance, and this is something we know that many DPAs agree on. 

Are the other DPAs likely to make similar rulings? 

As part of the GDPR Cooperation Procedures, the Belgian DPA (the APD) will have to bring their draft ruling to the other DPAs to reach agreement. If they can’t come to an agreement, it will be referred to the European Data Protection Board (EDPB) for a binding decision. It’s too soon to say what will happen, but in either case, this is not going to happen overnight. 

When WOULD I have to make changes to my CMP implementation?

It’s important to remember that this is all going to take time. As of this writing (15th November 2021), the Belgian DPA’s draft ruling has not been published; it is expected to be released in the next two to four weeks. Subsequent to that, per GDPR procedures, it would be shared with the other DPAs, who would have 30 days to review it. Depending on the outcome of that review, the Belgian DPA may adopt a final ruling or the matter may be referred to the EDPB for a binding decision, which would also take some time.

Subsequently, per the IAB Europe, there may be a six-month period to fix any issues found by the DPA and revise the TCF accordingly. Such collaborative work would enable the TCF to become a transnational GDPR code of conduct, which many DPAs have been saying is necessary for some time. This would only strengthen the TCF as a framework for compliance. 

Reach out if you have questions

An essential part of our business model is anticipating changes in the data privacy landscape and adapting our product and services to help you navigate those changes. We’re prepared to support you in making any changes needed. This is why Europe’s largest publishers choose to partner with Sourcepoint for GDPR compliance.

This post is provided for general, informational purposes only, does not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.

Latest Blog Posts

Week of November 15, 2021

November 22, 2021

Bedoya testifies in FTC nomination hearing, plus federal online...

Week of November 8, 2021

November 15, 2021

UK denies privacy class action against Google. European commission...

FAQ: Updates on the Belgian DPA’s investigation of the IAB’s TCF

November 11, 2021

The IAB Europe’s Transparency & Consent framework is the...

Latest White Papers

Ebook: A Publisher’s Guide to Vendor List Curation

August 16, 2021

How to review your vendor list to mitigate compliance...

Keep in touch

Sign up for our newsletter to keep up with the latest privacy and media news.

Let's explore what we can do together.

We'll be in touch within 48 hours

    First name *

    Last name *

    Email address *

    Company *

    Message *

    * indicates required fields