Joris DeeneOn Jan. 7, 2026, the Market Court (Brussels Court of Appeal) issued a ruling in the lingering saga surrounding IAB Europe and the Transparency & Consent Framework (TCF). The Court ruled that the Data Protection Authority (DPA) acted negligently in approving IAB Europe's action plan based on an earlier decision that had already been found largely illegal. The DPA must now retake the procedure, but with a narrower scope and with respect for the duty to hear.
The facts and legal context
This case revolves around the core of the online advertising market: the Transparency & Consent Framework (TCF) from IAB Europe. This system facilitates the management of user preferences (cookie consent and data processing) between Web sites, advertisers and technology providers.
The legal timeline is important to understanding this ruling:
- Feb. 2, 2022 (the Basic Decision): The Litigation Chamber of the DPA imposed sanctions on IAB Europe and ordered the submission of an action plan to bring the TCF into compliance with the General Data Protection Regulation (GDPR) .
- January 11, 2023 (the contested decision): The DPA validated the action plan submitted by IAB Europe.
- May 14, 2025 (the final ruling): In a parallel proceeding, the Market Court partially overturned the original Basic Decision of Feb. 2, 2022. The Court then ruled that IAB Europe is not a data controller for further processing under the OpenRTB protocol, but only for the so-called TC Strings (the digital signals of consent).
Despite ongoing discussions about the validity of the Basic Decision, by January 2023 the DPA had nevertheless approved the action plan and demanded its implementation. IAB Europe appealed against this, and the original complainants (privacy organizations) also interfered in the proceedings because they felt they should have a say in the validation of the plan.
Market Court decision
In the ruling of Jan. 7, 2026, the Market Court ruled in favor of IAB Europe and the validation of the action plan (the decision of Jan. 11, 2023) was rendered inapplicable under Article 159 of the Constitution.
The main pillars of the ruling are:
1. Breach of due diligence and legality.
The Court ruled sternly: in January 2023, the DPA built on a decision (Feb. 2, 2022) that was legally ‘shaky. Since the Market Court ruled in May 2025 that the Basic Decision was substantively flawed (particularly on the scope of IAB Europe's responsibility), the DPA could not simply implement that unlawful decision through the Action Plan. The Court stated that a diligent government should have suspended implementation pending clarity, rather than perpetuating an illegal situation.
2. Violation of hearing requirement
New facts occurred between the submission of the action plan and its approval (notably preliminary questions to the European Court of Justice and interlocutory rulings). The DPA should have heard IAB Europe on the impact of these new legal realities before approving the plan. By failing to do so, the DPA violated the rights of defense.
3. No participation rights for complainants in implementation
An interesting point for practice is the rejection of the claim of the complainants (the privacy NGOs). They demanded access to and participation in the action plan. However, the Market Court confirmed that, as a general rule, complainants do not have a right to be involved in the mere implementation of sanctions (the validation of the action plan) unless they demonstrate a specific, compelling interest that outweighs the confidentiality of corporate data. That was not the case here.
Legal analysis and interpretation
This ruling confirms the strict application of the hierarchy of norms and the legality principle in administrative law. Here, the Market Court applies the “poisoned fruit” theory in an administrative context: if the basic decision (the sanction) is fundamentally flawed in its scope and qualification of personal data, then the implementing decision (the action plan) cannot stand.
The limited scope of responsibility The crux of the matter remains the qualification of IAB Europe as a data controller. The Market Court reiterated its position from May 2025: IAB Europe is responsible for the TC Strings (user preferences), but this responsibility does not automatically extend to subsequent processing by third parties (advertisers) in the OpenRTB protocol. This is an important nuance. The DPA had adopted an action plan that assumed a much broader, and therefore incorrect, responsibility.
Procedural justice The Court emphasized that the DPA may not “push forward” on the precautionary principle when the legal basis is shaky. The DPA's argument that the protection of privacy takes precedence over IAB Europe's commercial interests was dismissed by the Court because there was no acute risk (like public health) that warranted a departure from careful decision-making.
Specifically, what does this mean?
This ruling has direct implications for various actors in the digital ecosystem:
- For IAB Europe: This is a procedural victory. The action plan must be reassessed, but the scope will be considerably narrower. IAB Europe only needs to remedy the situation with regard to TC Strings, and not for the entire Real Time Bidding (RTB) ecosystem.
- For advertisers and publishers: Uncertainty remains, but the threat of total illegality of the TCF system has been averted (for now). The focus shifts to the correct technical implementation of the consent strings themselves.
- For complainants and NGOs: The ruling confirms that their role is primarily in the filing of the complaint and the initial process. Once the sanction is issued, the handling (such as compliance plans) is seen as a matter between the regulator and the offending party.
FAQ: Frequently Asked Questions
Is the TCF (cookie banner system) now declared legal?
Not by definition. The Court held that the way the DPA enforced the recovery plan was illegal. The TCF should still be modified, but the modifications should be limited to the specific responsibilities of IAB Europe (the TC Strings) and not the entire ad ecosystem.
Does the procedure at the DPA now have to start all over again?
Not complete. The case has been referred back to the DPA. It must reassess the action plan, but this time taking into account the limited scope as determined by the Market Court in May 2025, AND it must give IAB Europe a chance to be heard.
Why were complainants (privacy organizations) not allowed to have a say in the action plan?
The Court held that the phase of validating an action plan is an implementation matter between the regulator and the company. Unless there are specific circumstances, complainants have no general right to “have a seat at the table” in the technical implementation of a sanction decision.
Conclusion
The January 7, 2026 ruling is a clear signal to the regulator: speed and decisiveness must not come at the expense of diligence and correct legal qualification. For the Belgian market, this means that the TCF framework remains intact, but that the battle over the precise interpretation of the GDPR obligations is not yet over. It is now up to the DPA to make a new, legally tenable judgment on the action plan.
Dutch 
English