Belgium's data watchdog fines IAB Europe €250K after finding its ad-targeting tool violates GDPR, and orders a “series of remedies” within two months
IAB Europe, an association for online advertising companies, was fined 250,000 euros ($282,690) and handed an ultimatum …
BloombergStephanie Bodoni
Context & Ripple Effects
Belgium is again the venue where European ad-tracking practices meet a regulator: four years after a [[a:926785|Belgian court ruled Facebook was illegally collecting user data via cookies on third-party sites]], the country's data watchdog has turned to the industry body itself, fining IAB Europe €250K and ordering remedies within two months. The target matters more than the amount — IAB Europe administers the consent and transparency tooling that much of European online advertising runs through.
First-order effects
IAB Europe must implement the ordered remedies within two months, putting the association's own GDPR compliance framework under direct regulatory control rather than industry self-governance.
The thousands of advertisers and publishers that rely on IAB Europe's ad-targeting tooling inherit the compliance burden, since the Belgian authority found the tool processes personal data in breach of GDPR.
Second-order effects
IAB Europe's appeal pushed the question to the EU's highest court, whose later ruling that the online advertising model uses personal data and falls under GDPR (confirmed on appeal) converts this national fine into an EU-wide legal precedent.
The fine joins a pattern of enforcement against behavioral advertising specifically — the Irish DPC's €390M fine of Meta over behavioral ad data shows national regulators converging on the same practice from different jurisdictions.
Third-order effects
If the CJEU ruling holds as the operative law, behavioral advertising in Europe must be rebuilt around GDPR-compliant consent at the infrastructure level, not patched at the edges — shifting costs toward privacy-tech vendors and away from self-regulatory bodies like IAB Europe.
A structure where one member state's authority can invalidate a pan-European industry framework points toward fragmented national enforcement becoming the de facto rulebook for the EU ad market until harmonized guidance emerges.
The trend: European regulators are progressively invalidating the ad industry's self-regulatory consent mechanisms, forcing GDPR compliance into the core architecture of behavioral advertising.
Momentous news. 5 long years. The TCF is finally ruled unlawful. All data collected through it by Google, Amazon, Microsoft's tracking businesses is unlawful and must be deleted. https://www.iccl.ie/...
Since all data collected through the TCF are unlawful, they must now be deleted by the 1,000+ companies that pay IAB Europe to use the TCF. This includes Google's, Amazon's and Microsoft's online advertising businesses.
-Fails to provide transparency about what will happen to people's data (Article 12, 13, and 14 GDPR) -Fails to implement measures to ensure that data processing if performed in accordance with the GDPR (Article 24 GDPR) ...
In addition, IAB Europe - maintain records of data processing (Article 30 GDPR) - conduct a data protection impact assessment (DPIA) (Article 35 GDPR) - appoint a Data Protection Officer (Article 37 GDPR)
BREAKING: Those awful pop-up cookies? EU data protection authorities rule they are illegal! All data collected by it (incl. Google, Amazon, Microsoft surveillance) is unlawful & must be deleted. ‘Immediately binding & enforceable across the EU.’ #GDPR https://www.iccl.ie/...
The findings: The TCF consent system infringes the GDPR as follows: -Fails to ensure personal data are kept secure and confidential (Article 5(1)f, and 32 GDPR) -Fails to properly request consent, and relies on a lawful basis (legitimate interest) that is not permissible ...
The good news: major companies may have to delete loads of data on you The bad news: those annoying cookie consent pop ups could get MUCH worse as a result The questionable news: cookies are on the way out and being replaced with new forms of tracking https://www.iccl.ie/...
Incredible GDPR ruling finds pop ups used on 80% of EU websites to be illegal. All data collected through IAB's TCF must now be deleted by more than 1,000 companies using it. This includes Google's, Amazon's and Microsoft's online advertising businesses. https://www.iccl.ie/...