European Court of Justice questions business model for auctioning personal data for online advertising purposes

What is the TC string?

The TC (transparency and consent) string contains information on a user’s privacy settings. In particular, it shows to what kind of processing the user agrees and which he rejects. The ECJ has now clarified that the TC string constitutes personal data as defined by the GDPR. If the TC string is linked with an identifier, such as the user device’s IP address, this can be used to create a profile of the user and identify the data subject.

IAB Europe as "joint controller"

Furthermore, the ECJ confirmed that the IAB Europe association is to be considered as "joint controller". IAB Europe has developed the Transparency and Consent Framework (TCF) in order to create personalized advertising. The TCF is technically implemented by means of a Consent Management Platform (CMP) which obtains consent to the processing of personal data.

Real-time bidding (RTB) and the role of the TC String

Personalized advertising on the Internet is based, among others, on real-time auctions. Advertisers bid for the opportunity to display advertising to specific user profiles (so-called real-time bidding).

Every visit on a participating website triggers an auction among advertising providers. Based on the desired prices and the user’s data profile, the decision which advertising such user will see is made within milliseconds. In order for this to work, the advertising companies must have information about the user, such as age, gender, interests, websites visited, place of residence and purchasing power.

Due to the General Data Protection Regulation (GDPR), the data subject’s consent is required for such data processing. This is where cookie banners used to come into play, where users click on "Accept", for example. This click is stored by IAB Europe’s Transparency and Consent Framework (TCF), which generates a TC string in which the user preferences are stored in a string. Such information is shared with personal data brokers and advertising platforms so that they know what the user has consented to or objected to. At the same time, a cookie is stored on the user’s device. The combination of TC-String and cookie allows for an assignment of the user’s IP address.

Effects on the online advertising sector

The ECJ’s decision has far-reaching effects on the online advertising sector. The previous use of TC strings for personalized advertising no longer seems to be possible. A general consent to such kind of use through a cookie banner is not possible.