Landmark court decision against “TCF” consent pop ups on 80% of the internet
14 May 2025
Google, Microsoft, Amazon, X, and the entire tracking-based advertising industry rely on the “Transparency & Consent Framework” (TCF) to obtain “consent” for data processing. This evening the Belgian Court of Appeal ruled that the TCF is illegal. The TCF is live on 80% of the Internet.[1]
Today’s decision arises from enforcement by the Belgian Data Protection Authority, prompted by complainants coordinated by Dr Johnny Ryan, Director of Enforce at the Irish Council for Civil Liberties. The group of complainants are: Dr Johnny Ryan of Enforce, Katarzyna Szymielewicz of the Panoptykon Foundation, Dr Jef Ausloos, Dr Pierre Dewitte, Stichting Bits of Freedom, and Ligue des Droits Humains.
Dr Johnny Ryan said "Today's court's decision shows that the consent system used by Google, Amazon, X, Microsoft, deceives hundreds of millions of Europeans. The tech industry has sought to hide its vast data breach behind sham consent popups. Tech companies turned the GDPR into a daily nuisance rather than a shield for people."
This Belgian enforcement arises from a chain of complaints and litigation across Europe initiated by Dr Ryan in 2018 against Real-Time Bidding (RTB).
Today’s decision confirmed the Belgian Data Protection Authority's 2022 finding of multiple infringements by the TCF, closely echoing the complainants' submissions.
For seven years, the tracking industry has used the TCF as a legal cover for Real-Time Bidding (RTB), the vast advertising auction system that operates behind the scenes on websites and apps. RTB tracks what Internet users look at and where they go in the real world. It then continuously broadcasts this data to a host of companies, enabling them to keep dossiers on every Internet user.[2] Because there is no security in the RTB system it is impossible to know what then happens to the data. As a result, it is also impossible to provide the necessary information that must accompany a consent request.[3]
Today’s judgement confirms the Belgian Data Protection Authority’s 2022 decision. It applies immediately across Europe.
Dr Ryan of Enforce said “This decision is momentous. It creates a clear need for industry to innovate and move away from the dangerous, ineffective, and fraud-riddled racking-based advertising. RTB can operate without personal data. This decision shows that it must. This good news for every person online, and for publishers, too.”
We thank our lawyers Frederic Debusseré and Ruben Roex, of Timelex.
Links
See chronology, evidence, and explainers about RTB https://www.iccl.ie/RTB/
Notes
[1] See "IAB & IAB Tech Lab Respond with Support for OpenRTB and IAB Europe’s Transparency & Consent Framework", October 19 2020 https://iabtechlab.com/iab-and-tech-lab-respond-with-support-for-open-rtb-and-iab-europes-transparency-consent-framework/
[2] For detail on the scale of RTB see our report "The Biggest Data Breach: ICCL report on the scale of Real-Time Bidding data broadcasts in the U.S. and Europe", ICCL, May 2022 https://www.iccl.ie/digital-data/iccl-report-on-the-scale-of-real-time-bidding-data-broadcasts-in-the-u-s-and-europe/
[3] "As it is technically impossible for the user to have prior information about every data controller involved in a real-time bidding (RTB) scenario, programmatic trading, the area of fastest growth in digital advertising spend, would seem, at least prima facie, to be incompatible with consent under GDPR". See e-mail and page 3 of attached lobbying paper from IAB Europe CEO Townsend Feehan to European Commission, 26 June 2017, obtained by Enforce using Freedom of Information.