After IAB Europe appealed a 2022 decision, the EU's highest court rules that IAB's online advertising model uses personal data and is therefore subject to GDPR
After clarification from Luxembourg, the Belgian Court of Appeal will now rule on the case. — IAB Europe's online advertising …
Context & Ripple Effects
The ruling follows a Belgian watchdog finding that IAB Europe’s ad-targeting framework breached GDPR and a €250,000 fine with required remedies. The earlier Belgian enforcement action made the framework’s legal status a central issue for the ad industry.
The EU court’s clarification does not finish the dispute: the Belgian Court of Appeal must apply it in the underlying case. It nevertheless strengthens the privacy-law framing around a framework whose consent standards had already been challenged by EU data regulators.
First-order effects
- IAB Europe’s online advertising model must be assessed as processing personal data under GDPR, narrowing its ability to treat the framework as outside the regulation’s scope.
- The Belgian Court of Appeal now resumes the case with that interpretation, while IAB Europe and framework users face continued legal scrutiny over compliance measures.
Second-order effects
- Publishers, ad-tech vendors, and other users of the framework may need to reassess consent and data-governance practices because the framework’s signals can trigger GDPR obligations.
- The decision gives privacy regulators a clearer basis to examine industry-wide ad-targeting infrastructure, rather than focusing only on an individual platform’s data practices.
Third-order effects
- If courts and regulators consistently treat advertising-consent signals as personal data, compliance responsibility will extend more visibly across shared ad-tech standards and intermediaries.
- The case points toward privacy enforcement of the technical layers that coordinate targeted advertising, potentially making lawful consent design a competitive constraint across the European ad market.
The trend: European privacy enforcement is moving from isolated platform conduct toward the shared consent and data-routing infrastructure that enables targeted advertising.