PRESS RELEASE - 02.02.2022

The Belgian Data Protection Authority (DPA) has decided that the IAB Europe data collection system [1] behind more than 80% of websites and apps in Europe is unlawful [2].

IAB Europe’s consent management mechanism is used to track and profile internet users for online personalised advertising. It allows thousands of companies active in the ad-tech environment to gain access to consumers’ data to target them with ads based on their interests, activities and behaviour. According to the Belgian DPA, this mechanism breaches the EU Data Protection Rules in multiple ways. It is not transparent, does not protect users’ personal data, nor does it allow them to exercise their rights.

Ursula Pachl, Deputy Director General of the European Consumer Organisation (BEUC), said:

“This decision could change the way the entire tracking ads industry operates, which is long overdue. We see systematic breaches of the GDPR by online advertising companies, which unlawfully collect vast amounts of personal data. They often rely on consent mechanisms which are untransparent, manipulative and do not give consumers a real choice to say ‘no’. Moreover, these mechanisms enable the broadcasting of consumers’ data to thousands of other companies that consumers have never heard of, without them knowing it and without giving them any control.

“The fine imposed by the Belgian DPA is paltry however, considering this is a consent system which is used on a vast majority of European websites and the seriousness of the infringements identified. Surveillance advertising goes against the very core principles and rights that the GDPR is there to protect. This must be a wakeup call for the whole ad-tech industry, which illegally trades in personal data, to comply with the law, while data protection authorities must take decisive action against entities that continue to breach the General Data Protection Regulation.”

ENDS

[1] IAB Europe is the European-level association for the digital marketing and advertising ecosystem and includes Google among its members.
[2] According to the Irish Council for Civil Liberties, this IAB consent system features on 80% of European websites and apps.