Skip to Content

Is the TCF Framework Failing GDPR? Major Blow for Big Tech and Online Advertising

Could the Belgian Court’s Negative Ruling on Cookie Consent Transform Digital Marketing in Europe?

On May 15, 2025, the Belgian Court of Appeal ruled that the Transparency & Consent Framework (TCF)-used by major tech companies like Google, Microsoft, Amazon, and X-violates the General Data Protection Regulation (GDPR).

The TCF is the backbone for obtaining user consent for tracking and personalized advertising on about 80% of websites in Europe.

The court confirmed that the “Transparency and Consent String” (TC String), which records user preferences, is personal data under GDPR and that IAB Europe, the creator of the TCF, is responsible for processing these preferences.

Key Points from the Court’s Decision

The TCF’s consent mechanism does not provide users with clear, sufficient information about how their data is processed, making true informed consent impossible.

Real-Time Bidding (RTB), which relies on TCF, shares user data with numerous companies, creating transparency and security issues.

The ruling follows years of complaints and litigation led by privacy advocates, notably Dr. Johnny Ryan of the Irish Council for Civil Liberties.

The decision has immediate effect across Europe and confirms the Belgian Data Protection Authority’s 2022 findings of multiple GDPR infringements.

Industry and Regulatory Responses

Privacy advocates see this as a significant win, highlighting that current consent pop-ups mislead users and turn GDPR into a nuisance rather than a protective tool.

IAB Europe, while relieved that it is not solely responsible for all data processing under TCF, is required to revise the framework. The organization has already introduced TCF version 2.2, which limits the use of “legitimate interest” for profiling.

Advertisers and publishers face uncertainty as regulators are expected to closely monitor any revisions to the TCF. Consent pop-ups are unlikely to disappear immediately, but the ruling signals major changes ahead.

Alternative Solutions: Contentpass

Contentpass offers a “pay or consent” model, allowing users to choose between accepting advertising/tracking or paying a small fee for an ad-free, tracking-free experience.

This model is gaining traction, especially as regulatory scrutiny increases. Contentpass is easy to integrate, supports cross-website subscriptions, and provides transparent pricing based on lost ad revenue.

For publishers, Contentpass can cover a portion of lost ad revenue (often around 10%), though it may not fully replace traditional advertising income.

The model aligns with user privacy expectations and regulatory standards, offering a genuine choice and enhancing trust in digital content delivery.

Implications for the Online Advertising Industry

The ruling forces the industry to innovate and move away from intrusive, tracking-based advertising models.

RTB systems must adapt to operate without personal data, prioritizing privacy and compliance.

Publishers are encouraged to explore privacy-first alternatives, such as subscription models or contextual advertising, to maintain revenue streams while respecting user rights.

Takeaways

  • The Belgian court’s decision marks a turning point for digital privacy and advertising in Europe, with broad implications for tech giants, advertisers, and publishers.
  • Companies must act swiftly to align with GDPR standards, prioritizing transparency, user choice, and data security in all consent and advertising practices.

Key Facts at a Glance

  • TCF ruled non-compliant with GDPR by Belgian court
  • RTB and consent pop-ups under scrutiny for misleading users and data misuse
  • Contentpass and similar solutions offer privacy-friendly, compliant alternatives