Is the TC string personal data?

Yes. The Court of Justice ruled in March 2024 that it is, as soon as it can be tied to an identifier such as an IP address, and the Brussels Market Court confirmed it in May 2025. The string that encodes consent is itself covered by the GDPR.

Can you be a joint controller without ever seeing the data?

Yes. That is the ruling’s main contribution: taking part in defining the purposes and means of the processing is enough, even without access to the data. Organizing how consent flows binds whoever organizes it.

What should an SDK provider verify after this ruling?

Its kit’s real behavior once integrated: when it fires relative to the banner, what it sends after a refusal, and whether the consent signal it receives matches the choice expressed. All of it invisible from its servers, all of it observable on the device.

All articles

The CJEU IAB Europe ruling: liability no longer stops at the publisher

July 18, 2026 · Updated August 26, 2026 · 5 min read · Mohamed

For a long time, an advertising SDK provider could treat consent as the publisher’s problem: their banner to show, their choice to collect. The Court of Justice of the European Union’s ruling in March 2024 moved that line.

What the Court decided

Asked about the IAB’s consent framework (the TCF), the Court settled two structural points. First, the string that encodes the user’s choices, the “TC string”, is personal data as soon as it can be tied to an identifier such as an IP address.

Second, an entity that determines, with others, the purposes and means of the processing can be a joint controller, even without accessing the data itself. Responsibility does not require handling the data: organizing how it flows is enough.

Why the whole chain is concerned

An SSP, a DSP, an ad network, a measurement partner do not merely receive data: they take part in a shared system that defines how consent is encoded, passed and used. That is the Court’s own reasoning.

The consequence is concrete. Receiving a request with a consent signal attached no longer covers you if, in reality, that signal does not reflect the user’s choice, or if the SDK acted before the choice was expressed.

The link no one sees

This link plays out inside the app, on the device, beyond the reach of the vendor’s servers. A publisher can integrate an SDK badly: fire it too early, ignore a refusal, miswire the banner. The vendor only sees an incoming request, already tidied up.

Independent research has documented cases of vendors receiving data despite a refusal, or setting identifiers before any consent. From the server, nothing looks wrong. From the device, the gap is clear.

What the courts have ruled since

The Court of Justice ruling was only a preliminary reference: the Belgian courts still had to apply the grid. They have. On 14 May 2025, the Brussels Market Court confirmed the substance of the Belgian authority’s decision: the TC string is indeed personal data, and IAB Europe is indeed a joint controller for the processing it organizes within the TCF. The original decision was annulled on procedural grounds, but the 250,000 euro fine stands and the qualification survives judicial review.

The court also drew a line: IAB Europe does not answer for the processing TCF participants then carry out, each for their own account. In other words, joint responsibility ends where each actor’s own processing begins, and it is precisely on that ground, what your SDK actually does with the data, that everyone is now expected. A further ruling, on 9 January 2026, moreover annulled the Belgian authority’s validation of the framework’s compliance action plan: IAB Europe prevailed on the scope of the corrective measures.

The reasonable precaution

The safeguard is not first legal, it is factual: knowing what your SDK actually does once integrated, on real apps. When it fires, what it sends, what it keeps sending after a refusal.

That is the purpose of an integration check for ad networks and adtech: documenting the SDK’s real behavior in the field, app by app, so you do not discover a gap at the same time as the regulator.

Sources

Every finding in this article traces back to one of these documents.

CJEU ’24Judgment C-604/22, IAB Europe v APDCourt of Justice of the European Union, 7 March 2024
Belgium ’25The Market Court rules in the IAB Europe caseBelgian data protection authority, statement on the ruling of 14 May 2025
IAB ’26IAB Europe wins appeal against APD decision on TCF corrective measuresIAB Europe, January 2026

Common questions

Is the TC string personal data?: Yes. The Court of Justice ruled in March 2024 that it is, as soon as it can be tied to an identifier such as an IP address, and the Brussels Market Court confirmed it in May 2025. The string that encodes consent is itself covered by the GDPR.
Can you be a joint controller without ever seeing the data?: Yes. That is the ruling’s main contribution: taking part in defining the purposes and means of the processing is enough, even without access to the data. Organizing how consent flows binds whoever organizes it.
What should an SDK provider verify after this ruling?: Its kit’s real behavior once integrated: when it fires relative to the banner, what it sends after a refusal, and whether the consent signal it receives matches the choice expressed. All of it invisible from its servers, all of it observable on the device.