On Jan. 7, 2026, the Market Court (Brussels Court of Appeal) issued a ruling in the lingering saga surrounding IAB Europe and the Transparency & Consent Framework (TCF). The Court ruled that the Data Protection Authority (DPA) acted negligently in approving IAB Europe's action plan based on an earlier decision that had already been found largely illegal. The DPA must now retake the procedure, but with a narrower scope and with respect for the duty to hear.<\/p>\n\n\n\n
This case revolves around the core of the online advertising market: the Transparency & Consent Framework<\/em> (TCF) from IAB Europe. This system facilitates the management of user preferences (cookie consent and data processing) between Web sites, advertisers and technology providers.<\/p>\n\n\n\n The legal timeline is important to understanding this ruling:<\/p>\n\n\n\n Despite ongoing discussions about the validity of the Basic Decision, by January 2023 the DPA had nevertheless approved the action plan and demanded its implementation. IAB Europe appealed against this, and the original complainants (privacy organizations) also interfered in the proceedings because they felt they should have a say in the validation of the plan<\/sup>.<\/p>\n\n\n\n In the ruling<\/a> of Jan. 7, 2026, the Market Court ruled in favor of IAB Europe and the validation of the action plan (the decision of Jan. 11, 2023) was rendered inapplicable under Article 159 of the Constitution<\/a>.<\/p>\n\n\n\n The main pillars of the ruling are:<\/p>\n\n\n\n The Court ruled sternly: in January 2023, the DPA built on a decision (Feb. 2, 2022) that was legally \u2018shaky. Since the Market Court ruled in May 2025 that the Basic Decision was substantively flawed (particularly on the scope of IAB Europe's responsibility), the DPA could not simply implement that unlawful decision through the Action Plan. The Court stated that a diligent government should have suspended implementation pending clarity, rather than perpetuating an illegal situation.<\/p>\n\n\n\n New facts occurred between the submission of the action plan and its approval (notably preliminary questions to the European Court of Justice and interlocutory rulings). The DPA should have heard IAB Europe on the impact of these new legal realities before approving the plan. By failing to do so, the DPA violated the rights of defense.<\/p>\n\n\n\n An interesting point for practice is the rejection of the claim of the complainants (the privacy NGOs). They demanded access to and participation in the action plan. However, the Market Court confirmed that, as a general rule, complainants do not have a right to be involved in the mere implementation of sanctions (the validation of the action plan) unless they demonstrate a specific, compelling interest that outweighs the confidentiality of corporate data. That was not the case here.<\/p>\n\n\n\n This ruling confirms the strict application of the hierarchy of norms<\/strong> and the legality principle<\/strong> in administrative law. Here, the Market Court applies the \u201cpoisoned fruit\u201d theory in an administrative context: if the basic decision (the sanction) is fundamentally flawed in its scope and qualification of personal data, then the implementing decision (the action plan) cannot stand.<\/p>\n\n\n\n The limited scope of responsibility<\/strong> The crux of the matter remains the qualification of IAB Europe as a data controller. The Market Court reiterated its position from May 2025: IAB Europe is responsible for the TC Strings<\/em> (user preferences), but this responsibility does not automatically extend to subsequent processing by third parties (advertisers) in the OpenRTB protocol. This is an important nuance. The DPA had adopted an action plan that assumed a much broader, and therefore incorrect, responsibility.<\/p>\n\n\n\n Procedural justice<\/strong> The Court emphasized that the DPA may not \u201cpush forward\u201d on the precautionary principle when the legal basis is shaky. The DPA's argument that the protection of privacy takes precedence over IAB Europe's commercial interests was dismissed by the Court because there was no acute risk (like public health) that warranted a departure from careful decision-making<\/sup>.<\/p>\n\n\n\n This ruling has direct implications for various actors in the digital ecosystem:<\/p>\n\n\n\n Is the TCF (cookie banner system) now declared legal?<\/strong> Does the procedure at the DPA now have to start all over again?<\/strong> Why were complainants (privacy organizations) not allowed to have a say in the action plan?<\/strong> The January 7, 2026 ruling is a clear signal to the regulator: speed and decisiveness must not come at the expense of diligence and correct legal qualification. For the Belgian market, this means that the TCF framework remains intact, but that the battle over the precise interpretation of the GDPR obligations is not yet over. It is now up to the DPA to make a new, legally tenable judgment on the action plan.<\/p>\n\n\n\n\n
Market Court decision<\/h2>\n\n\n\n
1. Breach of due diligence and legality.<\/h3>\n\n\n\n
2. Violation of hearing requirement<\/h3>\n\n\n\n
3. No participation rights for complainants in implementation<\/h3>\n\n\n\n
Legal analysis and interpretation<\/h2>\n\n\n\n
Specifically, what does this mean?<\/h2>\n\n\n\n
\n
FAQ: Frequently Asked Questions<\/h2>\n\n\n\n
Not by definition. The Court held that the way the DPA enforced the recovery plan was illegal. The TCF should still be modified, but the modifications should be limited to the specific responsibilities of IAB Europe (the TC Strings) and not the entire ad ecosystem.<\/p>\n\n\n\n
Not complete. The case has been referred back to the DPA. It must reassess the action plan, but this time taking into account the limited scope as determined by the Market Court in May 2025, AND it must give IAB Europe a chance to be heard.<\/p>\n\n\n\n
The Court held that the phase of validating an action plan is an implementation matter between the regulator and the company. Unless there are specific circumstances, complainants have no general right to \u201chave a seat at the table\u201d in the technical implementation of a sanction decision.<\/p>\n\n\n\nConclusion<\/h2>\n\n\n\n
\n\n\n\n