BACKGROUND
On 7 March 2024, the Court of Justice of the European Union (“CJEU”) issued its significant judgement in case C-604/22, which addressed questions raised by the Belgian Market Court regarding the interpretation of the General Data Protection Regulation (“GDPR”) in a dispute between IAB Europe and the Belgian Data Protection Authority (“APD”). The ruling established that, under certain circumstances, TC Strings may be considered personal data, particularly when they can be associated with other identifiable data points, such as IP addresses, which could enable the identification of the individual concerned through reasonable means.
Following this ruling, the APD determined that IAB Europe had committed various GDPR violations, specifically noting that IAB Europe lacked a legal basis for processing TC Strings. In response to the CJEU’s reasoning, the TCF Working Groups have developed a new “Special Purpose 3 – Save and Communicate Privacy Choices” (“Special Purpose 3”). This new purpose aims to facilitate the way TCF participants establish a legal basis for processing users’ privacy choices when recorded as a TC String, in cases where participants consider the TC String to be personal data from their perspective.
The introduction of Purpose 3 seeks to address the concerns raised by the CJEU’s judgment and ensure that TCF participants can comply with the GDPR while processing users’ privacy choices. This development highlights the ongoing efforts to adapt to evolving legal interpretations and maintain a balance between data protection and the legitimate interests of organizations operating within the digital advertising ecosystem.
TCF V2.2 MAIN POLICIES AMENDMENTS
- Inclusion of Special Purpose 3 – “Save and Communicate Privacy Choices” to the TCF purposes (see here)
Special Purpose 3 has been introduced to cover data related to privacy choices that are passed to parties via the TC String. This purpose aims to enable processing activities such as:- Verify information about the transparency, consent, and/or objection status of a Vendor and/or purpose, the opt-in status, and Publisher restrictions.
- Retrieve and/or pass on the TC Signal in the technical formats required under the IAB framework policies, when available.
- Respect TC Signals communicated by a CMP or received from a Vendor who forwarded the Signal originating from a CMP in accordance with the IAB specifications and policies, and act accordingly.
- New secondary layer UI requirement for CMPs
In addition to the current User Interface Requirements of the authorized CMPs (as detailed in Appendix B), when providing transparency about Purposes, Special Purposes, Features, Special Features and Vendors in connection with a legitimate interest for the same, the CMP must include a single secondary layer that disclose how the TC String is stored and the maximum time it is stored on the user’s device.
This can be achieved by adding to the second layer the following statement “the choices you make regarding the purposes and entities listed in this notice are saved in a cookie named [n] for a maximum duration of [x] months”
ACTION ITEMS
Vendors must complete the following action items by July 3, 2024:
- Update their GVL registration and declare the Special Purpose 3.
- Carry out LIA to demonstrate their legitimate interest for processing personal data for this purpose.
- Update the legitimate interest claim (mostly appear in the privacy policy)
Registered CMP must implement the secondary layer UI requirement, by October 4, 2024.
We will continue to provide you with updates on regulatory developments and any recommendations issued by relevant authorities regarding this matter.
This document is intended to provide only a general background regarding this matter. It should not be regarded as setting out binding legal advice but rather as a practical overview based on our understanding of applicable regulations.
Regards,
Cyber, Technology, Compliance and Regulation team
Shibolet & Co.
