IAB standard TCF not compliant with GDPR

The GDPR came into effect in 2018 and regulates the processing of personal data within the European Union. It imposes obligations on organisations, wherever they are, as long as they target and/or collect data from people residing in the European Union. This initiative aims in particular to respond to users’ demands for greater protection of their privacy and more transparency in the use of their data.

On February 2nd, 2022, the Belgian Data Protection Authority (DPA) fined the Interactive Advertising Bureau (IAB) of Europe 250,000 euros, judging that the Transparency & Consent Framework (TCF) was contrary to several clauses of the GDPR. 

While the TCF is used by the majority of players in the advertising chain, could this European sanction questions the way consent is collected for targeted advertising?

1 – What is the TCF?

The Transparency & Consent Framework (TCF) is a consent standard developed by the IAB Europe (the organisation that brings together the main players in online advertising) to help the various players in the advertising chain to comply with the requirements of the GDPR and the ePrivacy Directive.

When an Internet user visits a website, a Consent Management Platform (CMP) banner appears, allowing them to consent or not to the collection and sharing of their data. It is at the moment of this choice that the TCF comes into play, recording the preferences collected in the form of a file called “TC String”.

The IAB France defines the “TC String” as: “a chain of digital signals allowing the memorization and propagation of users’ choices concerning the use of their personal data for purposes related to advertising, content and audience measurement”. 

This file is shared with all the players involved in the OpenRTB (Real Time Bidding) system, a method of selling and buying advertising inventory in real time based on auctions. RTB is one of the main tools of programmatic advertising.

2 – What does DPA blame the IAB for ?

The Belgian CNIL considers IAB Europe to be responsible for the processing of “TC Strings”, and accuses it in particular of :

  • The absence of a legal basis for the use of the data collected through this file;
  • A lack of transparency, with information that is too generic, not allowing Internet users to understand what the collection of their data involves;
  • A lack of rigor regarding the means put in place to ensure data protection: absence of a register of processing activities, absence of a data protection officer (DPO), etc.

3- What future for advertising? And what consequences for publishers?

The DPA gives the IAB Europe two months to submit an action plan to bring its advertising standard into compliance within the next six months. It also orders the permanent removal of all TC Strings and other personal data already processed under TCF from all IT systems, files and databases.

In a press release, published on February 2nd, 2022, the IAB Europe states that it takes note of the Belgian Authority’s decision, but that it has not observed any prohibition of their TCF standard. While the organisation says it is willing to work with the DPA to ensure that TCF is maintained and used in the market, it rejects its role as “data manager”. On February 11th, 2022, IAB Europe announced that it would appeal the DPA’s decision before the Belgian courts.

As a reminder, there are currently 3 contexts for media advertising monetisation: with consent, without consent or in the absence of choice, in which case the website publisher can rely on its legitimate interest to display ads without cookies. At Opti Digital, we offer cross-consent monetisation, which respects users’ choice, and allows publishers to monetise their website with and without user consent to targeted advertising.

For our CEO and co-founder Magali Quentel-Reme: “It’s still too early to tell, but if publishers were to reintroduce the CMP during TCF compliance, we might see a drop in the consent rate because the internet user, out of weariness, might decide to object to everything.”

As the announcement is still recent, the consequences for the sector are still difficult to foresee. At Opti Digital, we will therefore be following this subject closely over the coming weeks, in close contact with our CMP partners (read Sirdata’s article following the DPA announcement). We shall keep you informed of the situation by updating our article on a regular basis.

The IAB Europe will host a live chat on Wednesday February 16th to answer questions raised by the DPA decision. Further information on the next steps will be provided at this event. In the meantime, an FAQ is available on the organisation’s website.

If you would like to discuss this further, please contact one of our publishers managers.

Our AdTech predictions for 2022

2021 was a particularly eventful year for the AdTech industry. Publishers and players in online advertising had to adapt to the start of a cookieless world, in particular with the new CNIL guidelines that came into effect. The year was also marked by a major event for their natural referencing: Core Web Vitals, 3 Web performance indicators set up by Google aimed at promoting sites that offer a good user experience.

Publishers had to redouble their efforts to continue to offer their audiences content that meets their expectations while ensuring sustainable advertising revenues. 

What will it be like in 2022? Can we foresee the major trends that will mark the year? Magali Quentel-Reme, our CEO and co-founder, will reveal her 2022 AdTech market predictions at Programmatic Spain.

What impact has COVID had on programmatic advertising in 2021 and how is it recovering?

It is difficult to take stock of 2021 because 2020 was a very irregular year which makes it hard to make any valid comparisons. During the first half of 2021, we saw the effects of the pandemic on investments. We observed a very strong temporary effect. Advertising investment were concentrated into 3 key moments: March 2021 and June 2021, when the restrictions were lighter, and November-December as usual.

In the last two years, the programmatic ecosystem has been advancing at the same level as technology. More and more publishers converted to Header Bidding and buying by deal IDs was on the rise in Europe with initiatives like WeMass that offer curated inventories from media leaders on a programmatic basis only.

What is the biggest opportunity you see for programmatic in 2022?

In addition to the strong growth of connected TV, which we take for granted, I believe that the audio format is going to be on the rise due to digital users who consume more and more podcasts.

The pre-roll video format is also a winning bet for publishers who can produce video content. In Header Bidding, we see a rising fill rate and advertisers are looking for good completion rates, and are willing to pay for it. Publishers will have to find the balance: ensure a good UX and mobile video ad space with good completion rates.

What is the biggest challenge facing the programmatic industry in the coming year?

Despite the noise about solutions to replace third-party cookies, this remains a real challenge because we still don’t see a miracle solution in the near future.

Unique IDs are an interesting proposition, but only for publishers capable of gathering logged data from their visitors. Most of the publishers we collaborate with have little data logged and the reach is too small to guarantee a profitability similar to cookies.

Knowledge about FloC (since this interview, Google announced the replacement of FloC by Topics, a much more simple targeting method) is still weak in Europe and this lack of understanding may harm the advertising revenue of media groups, Sales Houses and independent publishers in their fragility due to the Covid-19 crisis.

Which channels do you think will have the greatest growth? And the least? 

Outstream and instream video, Digital audio, TV and DOOH are going to see a lot of growth.

Conversely, Google is progressively giving less exposure to AMP (Accelerated Mobile Pages) pages in the SERPs.

And more than channels, I also believe that the performance of those who offer low-quality inventory to brands with no added value will progressively worsen.

What do you expect to happen most in the industry in 2022?

I hope that transparency and quality will win for all links in the programmatic chain so that users like advertisers and publishers benefit from a better UX and deliver results.

When do you think the sector will have viable alternative solutions to Third Party Cookies?

I think it could take some time to see a valid and widely accepted solution and that 2022 could be an experimental year.

One of the shorter-term solutions will be to use first-party data to increase campaign targeting capabilities and optimize publisher revenue.

Need additional information about our solutions and/or our job offers? Contact us!