WTF just happened to the IAB Europe’s TCF — and what does it mean for targeted ads in the EU?

Still parsing it all? We’ve got you. Here’s what actually happened, and what it means for Google, Amazon, IAB Europe and just about everyone else in the tracking-based ad economy. 

What is the TCF again? 

Think of it as the backend wiring behind those ubiquitous consent banners that pop up on about 80% of European websites. Developed by IAB Europe, the TCF was meant to give users a choice about tracking, while letting the ad industry keep operating more or less as it always had. In theory, it brought General Data Protection Regulation (GDPR) compliance to the fuelled world of programmatic advertising.

Why did it end up in court?

Because what was billed as a GDPR-compliant fix looked, to regulators, more like a workaround. In 2022, Belgium’s data protection authority said the TCF didn’t actually give users meaningful control over their data, and that the consent it generated wasn’t specific, informed or freely given. Worse, it found that IAB Europe wasn’t just a middleman. By orchestrating the system, it was acting as a data controller without accepting the legal responsibilities that come with that role.

The trade body pushed back, arguing it was merely providing the plumbing for the ad ecosystem. That kicked off a legal saga that’s dragged on for years. The latest twist came last week when Belgium’s Court of Appeal threw out the regulator’s original decision on procedural grounds but still upheld the core findings. 

What did the court actually say?

Despite the headlines, the court didn’t declare the TCF flat-out illegal. What it did do was deliver three key rulings.

TC strings are personal data: The court said these signals qualify as personal data if IAB Europe or TCF participants can reasonably use them to identify a person. That hinges on one misinterpreted clause in older versions of the TCF — language that’s already been revised. Still, the court’s decision sets a precedent. 

IAB Europe is a joint controller of TC String: Even though the TCF is open source and implemented by third-parties, the court decided IAB Europe plays too central a role in how the consent data is processed. That makes the trade body jointly responsible for the processing of personal data despite its claim that it just set the standard.

But not a joint controller of what happens next: The court drew a line: IAB Europe isn’t responsible for how companies process that data after it leaves the TCF system like in programmatic auctions. That part’s on the vendors themselves.

“This is an important ruling, setting a precedent for greater accountability of industry standards organizations and self-regulatory frameworks,” said Iesha White, director of intelligence at Check My Ads. “Positioning oneself as a pass-through service for data enablement doesn’t absolve industry bodies of accountability for the compliance of their frameworks, or for the enforcement of the standards that they create.”

What does this mean for programmatic advertising? 

The court technically annulled parts of the Belgian data watchdog’s original 2022 ruling but it also upheld key sanctions. That means IAB Europe still has to prove that the TCF can meet GDPR standards. The good news (for them) is that the action plan it submitted to do just that has already been validated by regulators. The TCF isn’t banned even as the framework as we know it is under legal pressure. Any organization using it must ensure it can handle personal data lawfully — and they can’t rely on the TCF alone to solve for that.

According to BlueConic’s CEO Melissa Murray Bailey, the ruling brings overdue clarity to a murky area of programmatic advertising and reinforces a broader truth: compliance theater is no longer enough.

“Consent frameworks can’t just check a box — they have to earn real trust,” she said. “For advertisers and intermediaries, that means rethinking how data is collected, shared, and used. This ruling could accelerate the shift toward durable, direct, and permission-based customer relationships — especially in markets where third-party data is still propping up outdated models.”

WTF now?

It’s a wake-up call for anyone still treating compliance as a technicality rather than a structural shift. This isn’t the end of TCF, but it may be the beginning of the end of the status quo. 

“Marketers can no longer treat privacy as someone else’s problem — it’s a core brand competency,” said Murray Bailey. “Whether driven by law or loyalty, the shift to transparency, control, and clear value exchange is happening. The companies that embrace this as a strategic and technological imperative will lead — not just in compliance, but in growth.”

White agrees that this Market Court decision is a reminder that broad adoption of industry frameworks does not necessarily mean that this processing is compliant.

“For the industry at large, the reality is that providing meaningful transparency and choice means that there will inevitably be some loss of scale,” she explained. “Efforts to bypass or circumvent this reality are unsustainable, fracture trust, and lead to protracted uncertainty and disruption that is bad for advertisers, publishers, and the public.”