Google, Microsoft, Amazon, X, and the entire tracking-based advertising industry rely on the “Transparency & Consent Framework” (TCF) to obtain “consent” for data processing. Yesterday, the Belgian Court of Appeal ruled that the TCF is illegal, according to ”iccl.ie”.
The TCF is live on 80% of the Internet.
The decision arises from enforcement by the Belgian Data Protection Authority.
Dr Johnny Ryan said „Today’s court’s decision shows that the consent system used by Google, Amazon, X, Microsoft, deceives hundreds of millions of Europeans. The tech industry has sought to hide its vast data breach behind sham consent popups. Tech companies turned the GDPR into a daily nuisance rather than a shield for people.”
This Belgian enforcement arises from a chain of complaints and litigation across Europe initiated by Dr Ryan in 2018 against Real-Time Bidding (RTB).
The decision confirmed the Belgian Data Protection Authority’s 2022 finding of multiple infringements by the TCF, closely echoing the complainants’ submissions.
The Court confirms the findings of the 2022 Decision, and specifies the infringements „in paragraph 535 of the contested Decision”. The infringements listed in that paragraph include:
- GDPR Article 5(1)f, Article 25, and Article 32The Court found that TCF fails to ensure personal data are kept secure and confidential
- GDPR Article 5(1)a and Article 6The Court found that fails to properly request consent. It also finds that the TCF may use legitimate interest, which is not permissible because of the severe risk posed by online tracking-based „Real-Time Bidding” advertising
- GDPR Articles 12, 13, and 14. The Court found that TCF fails to provide transparency about data processing
For seven years, the tracking industry has used the TCF as a legal cover for Real-Time Bidding (RTB), the vast advertising auction system that operates behind the scenes on websites and apps. RTB tracks what Internet users look at and where they go in the real world. It then continuously broadcasts this data to a host of companies, enabling them to keep dossiers on every Internet user. Because there is no security in the RTB system it is impossible to know what then happens to the data. As a result, it is also impossible to provide the necessary information that must accompany a consent request.
The judgement confirms the Belgian Data Protection Authority’s 2022 decision. It applies immediately across Europe.
Dr Ryan of Enforce said “This decision is momentous. It creates a clear need for industry to innovate and move away from the dangerous, ineffective, and fraud-riddled tracking-based advertising. RTB can operate without personal data. This decision shows that it must. This good news for every person online, and for publishers, too.”
In addition, the Court confirmed the 2022 Decision’s findings against IAB Europe, with one exception. The Court found that IAB Europe infringed GDPR Article 24, 30, 35, and 37. The Court said IAB Europe is not responsible for „processing operations carried out entirely within the framework of the OpenRTB protocol”.
Source: ”iccl.ie”.
Foto: ”freepik.com”
