ECJ strengthens data protection: What does that mean for personalized advertising?

ECJ strengthens data protection: What does that mean for personalized advertising?

On May 5, 2025, the European Court of Justice (ECJ) made a groundbreaking judgment that concerns the processing of personal data in the context of personalized advertising. According to LTO , clarity about the definition of "personal data" and the area of ​​responsibility according to the data protection fundamental regulation (GDPR) specified.

The judgment is the result of a preliminary ruling procedure of a Belgian court in which the Interactive Advertising Bureau Europe (IAB), which represents advertising companies at the European level, occurred as a plaintiff. Previously, the Belgian data protection authority had taken measures against IAB for repeated violations of the GDPR.

meaning of the judgment

The ECJ decided that the consent of the users: inside for data processing must be obtained before the display of personalized advertising. It is essential that the data collected can only be used with the express consent of those affected. According to Art. 4 No. 1 GDPR, personal data is defined as information that relates to identified or identifiable people.

The Court also found that the TC-String, a technical means of storing user preferences and consent, is to be regarded as a personal date within the meaning of the GDPR. The TC-String is used by IAB Europe and is part of the so-called "Transparency and Consent Framework" (TCF), which should ensure compliance with the GDPR for personalized advertising.

responsibility and liability

After the decision of the ECJ, IAB Europe is considered a joint person, since it has an impact on the processing of personal data. This means that the company can only be held responsible if there is a demonstrable influence on the storage and further processing of the data. Now it is due to the Belgian courts to check whether IAB Europe is actually responsible for the complaints.

The importance of this decision is far-reaching and could have a significant impact in the way in which Internet user data is recorded and processed. The judgment confirms the strict requirements of the GDPR and sets a clear framework for the industry of personalized advertising.