IAB Europe’s Transparency and Consent Framework was designed to help companies comply with the General Data Protection Regulation. But an ad tech company exploited the framework to collect information on potentially millions of people in the U.S.