Frustration, hope and confusion amid industry’s search for TCF answers

It’s safe to say this caught the industry off guard. And for good reason. The regulator, which represents its other counterparts across the European Union, wasn’t meant to be active. It hasn’t been active on all things TCF since February, when it found the framework illegal in its current form and subsequently fined its architect the IAB Europe.

In other words, the regulator went dormant. And the IAB Europe assumed it might stay that way until its appeal played out. That might have been a tad optimistic. The appeal won’t be decided until next year at the earliest — something that only became clear last month when the appeal court deferred specific questions in the case to the union’s high court.

Clearly, the regulator didn’t want to wait that long to resolve TCF’s future. Not when it didn’t have to. Belgian law makes orders immediately enforceable, irrespective of appeals. So it was always going to be a question of sooner, not later when it came to the regulator putting TCF back under the spotlight. It could lead to enforcement moving forward, though the regulator isn’t saying. Everything else is up for interpretation. 

“The hope that there can be some negotiated solution here may be underestimating the depth of this fundamental right that goes all the way to the philosophical level,” said Gartner analyst Andrew Frank. “This particular flare up is an indicator of a deeper rift that hasn’t really been addressed between the people who believe that there can be sound system that both protects people and supports the ads business and those people who believe there is no compromise here because addressable advertising is a fundamental violation of the principles of privacy that the GDPR is designed to protect.”

What comes next could have big implications for the future of targeted advertising on the web. There’s still a chance the Belgian data privacy watchdog, which is acting on behalf of all its counterparts across the European Union, could finish what it started in February: snuff out the use of the TCF guardrails the industry erected to help legally track people per the General Data Protection Regulation.

Granted, a lot still has to happen between now and then. Namely, the regulator has to make a call on whether TCF can be saved from itself. It can’t do that, though, until it has looked over an action plan from the framework’s architect, the IAB Europe. And even then there’s every chance the trade body will appeal the decision if it’s not the one it wants. 

In short, TCF’s future is far from clear. Frustrating as this is, it could be a lot worse. At least both the regulators and the IAB Europe are talking. That has to offer some respite that TCF’s future can be resolved amicably.

“The regulator has indicated that it intends to review, examine the action plan with a view to validating it but it didn’t indicate how long that will all take,” said the IAB Europe’s CEO Townsend Feehan. “The good thing for us, and probably for the market, is that we will have the prospect of some sort of working level dialogue with the authority, which we haven’t had. We’ve been lost in this logic of litigation and they have not offered any point of contact since we submitted the action plan. This update arguably breaks the ice in that respect.”

Even so, there’s a lot of pressure on Feehan and her team to pull a rabbit out of a hat when it comes to nudging the TCF toward what the regulator is asking for: the TCF to deliver a broader range of compliance functionality, including ensuring wholesale GDPR compliance of all TCF vendors. There’s also the small matter of developing data processing purpose definitions that are both more granular and more concise. Oh, and don’t forget the regulator is also seeking limitations on the use of the legitimate interests legal basis for TCF. Needless to say, it’s a lot. Still, the industry remains hopeful.

“It’s encouraging that the IAB is working with the [the Belgian data regulator] in the meantime,” said Russ Howe, vp of data control business Ketch’s business in EMEA. “Privacy needs programmatic standards that protect people’s data dignity, give them transparency and control over their data, while enabling businesses to grow with data and participate in the data driven economy.”

Two steps forward, two steps back. Regulators and the ad industry have been conducting a strange dance over the future of widespread tracking in Europe so far this year. And after all the back and forth, the situation is virtually back to where it started: Regulators moving forward with their plans to run the rule over the ad industry’s attempt to sustain third-party addressability on the open web.   

“This isn’t necessarily news so much as the IAB trying to find an angle to shape the discourse around the near-constant attention it has gotten in Europe; it’s clear that various European regulatory and legislative bodies can smell blood in the water and the IAB is their primary target,” said Cory Munchbach, president and chief operating officer at customer data platform BlueConic. “Anything the IAB can do to try and create a counter-narrative they will — and it seems like this press release (as well as several others over the past few months) fit the same pattern.”