Why target ads don’t inherently require consent under the IAB Europe ruling

No, consent is *not* required for real-time bidding or targeted ads pursuant to the CJEU’s IAB Europe / TCF judgment. Why not? Because the paragraph where the CJEU suggests this is not part of the scope of the responses, so it’s an “obiter dictum” – that’s what it’s called when a court says something that isn’t part of the questions it is supposed to decide upon.

This is all in reference to the following sentence in paragraph 24 of the that judgment (7 March 2024, case C-604/22): “before displaying such targeted advertisements, the prior consent of that user must be obtained”.

While it looks like the CJEU is requiring consent for profile-based onlineadvertising, this is *not* part of the questions referred to it by the Belgian Market Court. It’s in fact in an introductory section and precedes the CJEU’s actual response to the questions referred to it. At most, you could consider the CJEU to be describing the general context.

To quote the CJEU itself, this statement should therefore be viewed as “an�obiter dictum�which went beyond the bounds of the [questions referred to the CJEU] and did not thus actually or necessarily decide a point of law” (see for instance C?352/09�P and C?514/14�P).

So we’re still left with the usual “GDPR doesn’t require it, what about ePrivacy?” question, and I’ll leave this out there: https://lnkd.in/ezYeGSi4

[Why this post? I’m seeing more and more posts claiming that the CJEU requires consent for “personalised” ads. This isn’t the case. If you are wondering about how this issue affects you, whether you are in the adtech industry, a publisher or vendor or something else entirely, reach out!]

More information on the IAB Europe judgment:
– IAB Europe FAQ:�https://lnkd.in/ebzKPSm6�
– My initial analysis of Q1 (Is the TC String personal data?):�https://lnkd.in/enTPn35W
– My initial analysis of Q2 (Is IAB Europe a (joint) controller in relation to TC String processing or TCF-related processing?):�https://lnkd.in/emSUFmQh

data protection privacy