Purposes in IAB Europe’s TCF: Which Legal Basis and How Are They Used by Advertisers?

Abstract

The General Data Protection Regulation (GDPR), Data Protection Authorities (DPAs) and the European Data Protection Board (EDPB) discuss purposes for data processing and the legal bases upon which data controllers can rely on: either "consent" or "legitimate interests". We study the purposes defined in IAB Europe's Transparency and Consent Framework (TCF) and their usage by advertisers. We analyze the purposes with regard to the legal requirements for defining them lawfully, and suggest that several of them might not be specific or explicit enough to be compliant. Arguably, a large portion thereof requires consent, even though the TCF allows advertisers to declare them under the legitimate interests basis. Finally, we measure the declaration of purposes by all advertisers registered in the TCF versions 1.1. and 2.0 and show that hundreds of them do not operate under a legal basis that could be considered compliant under the GDPR.

Privacy Preference Signals: Past, Present and Future

“…Legal methods are relevant to the semantic content of the signal. For example, the purposes for collecting personal data standardized in the TCF may not be specific enough [64].…”

“…Web scraping studies have focused on implementation problems with TCF [64] or the ecosystem of consent management providers (CMP) [13]. These studies provide measurements of TCF in passing.…”

“…These studies provide measurements of TCF in passing. For example, both studies measure TCF vendor registrations and their claimed purposes for processing data for TCF 1.x [13, p. 9] and both TCF 1.x and TCF 2.0 [64]. The latter study measures aggregate TCF 2.0 adoption, whereas we measure and visualise at the vendor level.…”

“…This work differs from existing work by focusing exclusively on the adoption of privacy preference signals. We largely ignore the actors [13,64] and interfaces [7,9,10] harvesting such signals and instead focus on which factors (e.g. website type, popularity, and partners) are associated with TCF adoption.…”

Will EU’s GDPR Act as an Effective Enforcer to Gain Consent?

“…However, many webservice providers are not sure if their business is GDPR compliant. For example, IAB Europe presents the Transparency & Consent Framework, which is widely used in the online advertising industry [8]. However, this framework was also pointed out by the French data protection authority CNIL to lack consent verification.…”