The European Court of Justice has ruled that IAB Europe is responsible under the General Data Protection Regulation (GDPR) for the 'Transparency and Consent Framework' (TCF) consent system, for 'consent popups' that appear on almost every website and is used by tech giants such as Google, Amazon, Microsoft, TikTok and hundreds of tracking-based online advertising companies.

The court's decision indicates that IAB Europe has committed multiple GDPR violations in its processing of personal data in the context of its TCF and the 'Real-Time Bidding' (RTB) online advertising system. The TCF has been used to legitimise the broadcasting of personal data of millions of people in Europe to companies globally, including China and Russia, 71 trillion times per year.

IAB Europe had argued that it is not a 'data controller' under the GDPR as it only sets the rules for data use, but does not process the data itself. This argument was rejected by the Court.

Dr Johnny Ryan of ICCL Enforce commented on the ruling: "People across Europe have been plagued by fake ‘consent’ popups every day on almost every website and app since the GDPR was introduced almost six years ago. IAB Europe has sought to evade its responsibility for this charade. But the European Court of Justice has set it straight. This decision will not only end the biggest spam operation in history. It will deal a mortal wound to the online tracking-based advertising industry."

Ryan said this ruling underscores the broad protection of personal data in Europe and will force significant changes in the online tracking and advertising industry. Ryan said companies such as Google, Amazon, and Microsoft can no longer evade their responsibilities by claiming that the data they use is not protected by the law.