Cookie banners could soon be declared illegal

“This website uses cookies” – the so-called cookie banners could soon disappear from the scene for good. The industry association IAB Europe is taking legal action against the decision of the Belgian data protection authorities, who want to declare cookie banners illegal.

IAB Europe sues against data protection decision

Online advertising is a billion-dollar business in Europe. One that now threatens to collapse. That’s because after data protectors in Belgium, in the form of the local data protection authority APD, declared a central standard for online advertising illegal, the industry association IAB Europe has now filed a lawsuit.

The Belgian data protectors believe that cookie banners are not compatible with the General Data Protection Regulation (GDPR) – the ruling has implications for the entire EU. In the process, APD has declared the Transparency & Consent Framework standard, which is central to online advertising, illegal and is demanding a fine of 250,000 euros from IAB Europe.

IAB Europe acts as the central body for data processing and transmission from cookie banners to advertising marketplaces. The association then admitted that as a small industry association, it would hardly be possible to take over the entire data processing for all recipients of this data.

Currently, a full 794 companies are listed as recipients of the data on the so-called Vendor List TCF v2.0. They may, in turn, share the collected advertising data with an unknown, much larger number of other companies that work with it. These companies could participate in the daily advertising auctions to simply siphon off data from Internet users, the complainants criticize.

Billions of dollars in risk

End users can claim damages for illegal data processing for advertising purposes, which represents an incalculable cost risk in the billions for the IAB Europe. As statistics from the online advertising industry now show, more than two-thirds of online advertising is now played out using personalized advertising profiles.

In 2019, spending in this area amounted to €23 billion, according to IAB Europe, and is expected to continue to rise sharply in subsequent years, given the growth of online advertising.

While Belgium’s Autorité de protection des données (APD) gave IAB Europe two months to come up with possible plans to improve the situation, for others this transition is not fast enough.

The Irish Council for Civil Liberties and the Electronic Privacy Information Center (EPIC) are already trying to powerfully implement the decision. Together, they have sent a letter to some of the largest advertisers calling for the immediate deletion of all personal data collected using European cookie banners. If the deletion does not take place promptly, they demand compensation.

On a global level, the letter also calls on companies to stop using cookie banners in the US. The letter was sent to several major companies such as Unilever, IBM, General Motors and Ford.

IAB appeals to data protection authorities

IAB Europe, on the other hand, appealed to European data protection authorities for help in a statement. In doing so, it calls on the data protection authorities to publicly support the represented position and to declare that it does not intend to take further steps against users of the TCF system.

However, the appeal is unlikely to be crowned with success, because the Belgian data protectors have already received support from the Netherlands. There, they demanded that user tracking be stopped and that alternative ways of playing out advertising be sought. Authorities in Germany also participated in the Belgian decision.