Impossible Asks: Can the Transparency and Consent Framework Ever Authorise Real-Time Bidding After the Belgian DPA Decision?

Authors

• Michael Veale University College London https://orcid.org/0000-0002-2342-8785
• Midas Nouwens Aarhus University
• Cristiana Santos Utrecht University

DOI:

Keywords:

Abstract

On 2 February 2022, the Belgian Data Protection Authority handed down a decision concerning IAB Europe and its Transparency and Consent Framework (TCF), a system designed to facilitate compliance of real-time bidding (RTB), a widespread online advertising approach, with the GDPR. Here, we summarise and analyse this large, complex case. We argue that by characterising IAB Europe as a joint controller with RTB actors, this important decision gives DPAs an agreed-upon blueprint to deal with a structurally difficult enforcement challenge. Furthermore, under the DPA’s simple-looking remedial orders are deep technical and organisational tensions. We analyse these “impossible asks”, concluding that absent a fundamental change to RTB, IAB Europe will be unable to adapt the TCF to bring RTB into compliance with the decision.

Downloads

Author Biographies

• Michael Veale, University College London

  Associate Professor, University College London, UK

• Midas Nouwens, Aarhus University

  Assistant Professor, Department of Digital Design and Information Studies, Aarhus University, Denmark

• Cristiana Santos, Utrecht University

  Assistant Professor, School of Law, Utrecht University, The Netherlands