Belgian Market Court rules on IAB Europe’s TCF

On May 14, 2025, the Belgian Market Court issued a landmark ruling in the protracted legal battle over IAB Europe's Transparency & Consent Framework (TCF), one of the most consequential consent management systems underpinning programmatic digital advertising across Europe. The court rejected the Belgian Data Protection Authority's (APD/GBA) position that IAB Europe qualifies as a joint controller alongside TCF participants — a classification that would have imposed significant GDPR liability on IAB Europe for the data processing activities of its member companies. This decision partially overturns or substantially modifies the regulatory burden that had been placed on IAB Europe following the APD's February 2022 finding that the TCF violated GDPR, and the subsequent enforcement actions and remediation plan that followed.

This ruling provides meaningful legal relief to IAB Europe and, by extension, to the broader programmatic advertising ecosystem that relies on the TCF as its primary consent signaling infrastructure. The TCF is used by thousands of publishers, advertisers, and ad tech vendors across Europe to communicate user consent choices through the OpenRTB bid stream. Had IAB Europe been confirmed as a joint controller, it could have faced direct liability for GDPR violations committed by any of its hundreds of TCF participants, potentially destabilizing the framework entirely. The ruling reduces existential legal risk for the TCF and may encourage wider adoption or renewed investment in TCF-compliant consent management platforms (CMPs). However, the underlying questions about whether the TCF itself is GDPR-compliant in its design and operation remain contested, and further regulatory or judicial scrutiny from other EU data protection authorities is still possible. The decision also has implications for industry self-regulatory bodies more broadly, clarifying the limits of joint controller liability for trade associations that develop technical standards rather than directly processing personal data.