Are internet standard developing organisations data controllers under the GDPR?

Julien Rossi and Jonathan Keller

Internet Policy Review: Journal on Internet Regulation, 2025, vol. 14, issue 3, 1-23

Abstract: In 2022, the Belgian Data Protection Authority (DPA) issued a fine against IAB Europe. It held this industry association for online advertising liable for multiple violations of the General Data Protection Regulation (GDPR) in relation to the Transparency and Control Framework (TCF). This technical standard is used by most Consent Management Platforms (CMPs) deployed on websites available from Europe. It generates a machine-readable expression of user preferences with regards to online privacy, transmitting to all stakeholders' servers taking part in the display of online advertisements. This is meant to ensure that no identifiers are stored on user devices, thus no personal data are processed, prior to any user consent. The Belgian DPA's qualification of IAB Europe as a joint controller in the operation of this standard, which has been confirmed in January 2024 by the European Union's Court of Justice, could be a significant development generating major implications for the whole internet governance ecosystem, object of the examination conducted in this contribution. However, the specifics of this case mean that it can hardly apply to all internet standard developing organisation.

Keywords: Data protection; GDPR; Data controller; Technical standardisation; EU law (search for similar items in EconPapers)
Date: 2025
References: Add references at CitEc
Citations:

Downloads: (external link)
https://www.econstor.eu/bitstream/10419/330354/1/1938820347.pdf (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:zbw:iprjir:330354

DOI: 10.14763/2025.3.2034

Access Statistics for this article

More articles in Internet Policy Review: Journal on Internet Regulation from Alexander von Humboldt Institute for Internet and Society (HIIG), Berlin
Bibliographic data for series maintained by ZBW - Leibniz Information Centre for Economics ().