The CJEU IAB Europe ruling: liability no longer stops at the publisher
For a long time, an advertising SDK provider could treat consent as the publisher’s problem: their banner to show, their choice to collect. The Court of Justice of the European Union’s ruling in March 2024 moved that line.
What the Court decided
Asked about the IAB’s consent framework (the TCF), the Court settled two structural points. First, the string that encodes the user’s choices, the “TC string”, is personal data as soon as it can be tied to an identifier such as an IP address.
Second, an entity that determines, with others, the purposes and means of the processing can be a joint controller, even without accessing the data itself. Responsibility does not require handling the data: organizing how it flows is enough.
Why the whole chain is concerned
An SSP, a DSP, an ad network, a measurement partner do not merely receive data: they take part in a shared system that defines how consent is encoded, passed and used. That is the Court’s own reasoning.
The consequence is concrete. Receiving a request with a consent signal attached no longer covers you if, in reality, that signal does not reflect the user’s choice, or if the SDK acted before the choice was expressed.
The link no one sees
This link plays out inside the app, on the device, beyond the reach of the vendor’s servers. A publisher can integrate an SDK badly: fire it too early, ignore a refusal, miswire the banner. The vendor only sees an incoming request, already tidied up.
Independent research has documented cases of vendors receiving data despite a refusal, or setting identifiers before any consent. From the server, nothing looks wrong. From the device, the gap is clear.
The reasonable precaution
The safeguard is not first legal, it is factual: knowing what your SDK actually does once integrated, on real apps. When it fires, what it sends, what it keeps sending after a refusal.
That is the purpose of an integration check for ad networks and adtech: documenting the SDK’s real behavior in the field, app by app, so you do not discover a gap at the same time as the regulator.