Who: IAB Europe
Where: Europe
When: February 2020
What happened:
IAB Europe is the European-level association for the digital marketing and advertising ecosystem.
On 25 April 2018, IAB Europe launched the first version of its Transparency and Consent Framework (TCF), a solution created in order to help those involved in online advertising to comply with legal requirements (namely, the General Data Protection Regulation (GDPR) (EU 2016/679) and the ePrivacy Directive (2002/58/EC)) when processing, accessing and storing data personal data collected through tracking technology. In particular, the TCF helps individuals to implement a Consent Management Platform (CMP) that complies with legal requirements.
However, on 30 October 2018, the French data protection authority (the CNIL) gave formal notice to Vectaury, an online advertising platform, for not obtaining informed, specific and unambiguous consent when collecting personal data, in particular, location data. The problem was that Vectaury implemented a CMP with the collaboration of the IAB France. In this formal notice, the CNIL stated that in order to process location data, obtaining effective prior consent from users is compulsory and that every CMP must enable:
- informed consent: users must be informed of the purpose for data processing and the companies that process their data in a clear and understandable language;
- specific consent: granular details of each purpose should be provided even if rejecting all purposes at once is possible;
- unambiguous consent: users must give their consent via a clear positive statement or act (for example, a box to be checked, a button to be activated).
Moreover, on 4 July 2019, the CNIL, like other European data protection authorities, adopted new guidelines on cookies and other trackers introducing two major changes: continued browsing would no longer be considered a valid expression of consent for the use of cookies, and operators using trackers will have to prove that they have obtained users consent.
Therefore, the IAB decided to upgrade the TCF to comply with the new legal requirements.
On 21 August 2019, IAB Europe started to work on the upgrade of the TCF to adapt the solution to the new recommendations and guidelines of the European data protection authorities. This new version is the result of a collaborative work where IAB Tech Lab dealt with the technical aspects and the TCF Steering Group managed to draft the new TCF Policy.
The TCF Steering Group worked with many online advertising stakeholders, including but not limited to EU-level associations, ten national IABs, 55 organisations, publishers, media owners, technology providers and media agencies, in order to create an environment adapted to actors of online advertising.
What are the contributions of this new version of the TCF?
This new version introduces changes on consent and on transparency.
Regarding consent:
- users will be able to grant or withhold their consent and furthermore, to exercise their “right to object”, in order to comply with the new legal framework stating that the continued browsing is no longer considered a valid expression of consent for the use of cookies and other trackers; and
- more control will be granted to users over the vendors’ use of some data processing, such as location data. (Thus, the IAB has learnt lessons from the CNIL formal notice.) From now on, the TCF will help to comply with the requirement of a specific consent thanks to a possibility of granular detail by purpose.
The second objective of this new version is to increase user transparency on publishers’ activities (publishers are considered as operators “of a Digital Property and who are primarily responsible for ensuring the framework UI is presented to users and that legal bases, including consent, are established with respect to vendors that may process personal data based on users’ visits to the publisher’s consent”). Therefore:
- more control and flexibility will be given on how publishers integrate and collaborate with their technology partners, in order to provide complete information to users; and
- there will be possibility to restrict the purposes for which personal data is processed by vendors on a publisher’s website on a per-vendor basis.
What are the next steps?
The new version of the TCF is still in progress but is expected to be available in April 2020. Therefore, in April, the first version of the TCF will become out of date and out of use.
On 1 July 2020, consent collected in the first version of the TCF will no longer be considered a valid expression for consent. Thus, migration as of April 2020, towards the new version shall be a priority for all the users.
But in order to help all users to switch to the new version of the TCF, the IAB organised workshops from January until April. These workshops were meant to guide users in this migration, including from a technical point of view.
Why this matters:
The update of the TCF, to help online digital players to comply with legal requirements, takes part of the context of evolution on personal data and trackers policies.
The CNIL conducted a public consultation (which closed on 25 February 2020) to develop a recommendation on cookies and other trackers in order to be a practical tool for online advertising actors (the recommendation provides concrete examples, methods of collecting consent and posting information and good practices).
However, in light of the fact that Google announced in January 2020 that it will no longer use third-party cookies by the end of 2021, the usefulness of the new IAB’s TCF for publishers, adtech companies and advertisers is questionable.
