Landmark court decision against “TCF” consent pop ups on 80% of the internet
14 May 2025
(Updated on 15 May to include linked judgement and itemised infringements)
- Download the judgement in Flemish
- Download the judgement in English (machine translation)
Google, Microsoft, Amazon, X, and the entire tracking-based advertising industry rely on the “Transparency & Consent Framework” (TCF) to obtain “consent” for data processing. This evening the Belgian Court of Appeal ruled that the TCF is illegal. The TCF is live on 80% of the Internet.[1]
Today’s decision arises from enforcement by the Belgian Data Protection Authority, prompted by complainants coordinated by Dr Johnny Ryan, Director of Enforce at the Irish Council for Civil Liberties. The group of complainants are: Dr Johnny Ryan of Enforce, Katarzyna Szymielewicz of the Panoptykon Foundation, Dr Jef Ausloos, Dr Pierre Dewitte, Stichting Bits of Freedom, and Ligue des Droits Humains.
Dr Johnny Ryan said "Today's court's decision shows that the consent system used by Google, Amazon, X, Microsoft, deceives hundreds of millions of Europeans. The tech industry has sought to hide its vast data breach behind sham consent popups. Tech companies turned the GDPR into a daily nuisance rather than a shield for people."
This Belgian enforcement arises from a chain of complaints and litigation across Europe initiated by Dr Ryan in 2018 against Real-Time Bidding (RTB).
Today’s decision confirmed the Belgian Data Protection Authority's 2022 finding of multiple infringements by the TCF, closely echoing the complainants' submissions.
The Court confirms the findings of the 2022 Decision, and specifies the infringements "in paragraph 535 of the contested Decision". The infringements listed in that paragraph include:
- GDPR Article 5(1)f, Article 25, and Article 32
The Court found that TCF fails to ensure personal data are kept secure and confidential - GDPR Article 5(1)a and Article 6
The Court found that fails to properly request consent. It also finds that the TCF may use legitimate interest, which is not permissible because of the severe risk posed by online tracking-based "Real-Time Bidding" advertising - GDPR Articles 12, 13, and 14
The Court found that TCF fails to provide transparency about data processing
For seven years, the tracking industry has used the TCF as a legal cover for Real-Time Bidding (RTB), the vast advertising auction system that operates behind the scenes on websites and apps. RTB tracks what Internet users look at and where they go in the real world. It then continuously broadcasts this data to a host of companies, enabling them to keep dossiers on every Internet user.[2] Because there is no security in the RTB system it is impossible to know what then happens to the data. As a result, it is also impossible to provide the necessary information that must accompany a consent request.[3]
Today’s judgement confirms the Belgian Data Protection Authority’s 2022 decision. It applies immediately across Europe.
Dr Ryan of Enforce said “This decision is momentous. It creates a clear need for industry to innovate and move away from the dangerous, ineffective, and fraud-riddled tracking-based advertising. RTB can operate without personal data. This decision shows that it must. This good news for every person online, and for publishers, too.”
In addition, the Court confirmed the 2022 Decision's findings against IAB Europe, with one exception. The Court found that IAB Europe infringed GDPR Article 24, 30, 35, and 37. The Court said IAB Europe is not responsible for "processing operations carried out entirely within the framework of the OpenRTB protocol".
We thank our lawyers Frederic Debusseré and Ruben Roex, of Timelex.
Image: machine translation of page 70 of the judgement
Links
See chronology, evidence, and explainers about RTB https://www.iccl.ie/RTB/
Brussels Appeals Court judgement (Flemish) https://www.iccl.ie/wp-content/uploads/2025/05/Arrest-Marktenhof-14-05-2025.pdf
Brussels Appeals Court judgement (MACHINE TRANSLATION to English) https://www.iccl.ie/wp-content/uploads/2025/05/Arrest-Marktenhof-14-05-2025-en.pdf
Article 60 (EU-wide) Belgian Data Protection Authority decision, 2 February 2022 https://www.edpb.europa.eu/system/files/2022-03/be_2022-02_decisionpublic_0.pdf
Notes
[1] See "IAB & IAB Tech Lab Respond with Support for OpenRTB and IAB Europe’s Transparency & Consent Framework", October 19 2020 https://iabtechlab.com/iab-and-tech-lab-respond-with-support-for-open-rtb-and-iab-europes-transparency-consent-framework/
[2] For detail on the scale of RTB see our report "The Biggest Data Breach: ICCL report on the scale of Real-Time Bidding data broadcasts in the U.S. and Europe", ICCL, May 2022 https://www.iccl.ie/digital-data/iccl-report-on-the-scale-of-real-time-bidding-data-broadcasts-in-the-u-s-and-europe/
[3] "As it is technically impossible for the user to have prior information about every data controller involved in a real-time bidding (RTB) scenario, programmatic trading, the area of fastest growth in digital advertising spend, would seem, at least prima facie, to be incompatible with consent under GDPR". See e-mail and page 3 of attached lobbying paper from IAB Europe CEO Townsend Feehan to European Commission, 26 June 2017, obtained by Enforce using Freedom of Information.