IAB Europe case: Market Court narrows enforcement scope

IAB Europe & TCF case: Belgian Market Court confirms Belgian DPA went too far in seeking enforcement of full range of measures against IAB Europe. Pleased to see the judgment of the Market Court/MC of Wednesday 7 January 2026, which set aside the BDPA’s decision of January 2023 (through which it had validated IAB Europe’s action plan further to the BDPA’s February 2022 initial decision) and referred the case back to the BDPA for a new assessment of a more limited scope of measures.

The MC reaffirmed that (like I had said, and contrary to what some had claimed) it had actually *annulled* the Feb 2022 decision by way of its May 2025 judgment [§16], because two flaws – one procedural (lack of investigation by the BDPA as to whether TC Strings constitute personal data) and one on the merits (incorrectly holding that IAB Europe’s joint controllership went beyond the processing of TC Strings as such, to also cover further processing) – made it unlawful [§17].

The MC held that by adopting the Jan 2023 decision, despite the MC finding already in an interim judgment of September 2022 that a procedural flaw affected the Feb 2022 decision, the BDPA had continued enforcement of an unlawful decision (that of Feb 2022) – and had in doing so breached the principle of legality and the hierarchy of norms [§17]. In addition, the BDPA violated IAB Europe’s right to be heard by taking its Jan 2023 decision without allowing IAB Europe to share its view on the impact of that Sept 2022 judgment [§19].

The conclusion? Annulment of the Jan 2023 decision, referral back to the BDPA with the order for the BDPA to (i) limit the scope of this assessment to what was actually admitted by the MC in its May 2025 decision (= joint controllership re TC Strings, not the rest) and to (ii) give IAB Europe the opportunity to take a position on this (= right to be heard).

In addition, the complainants at the origin of the case before the BDPA had also challenged the January 2023 decision, claiming that they should have had a say in the validation itself and in assessing the action plan submitted by IAB Europe. The MC *rejected* those claims, finding that the complainants should have challenged the Feb 2022 decision themselves (which they did not) and that there was no evidence that the complainants had a right to be heard in this context, based on case law of the Belgian Council of State. (While the judgment might seem to leave the door open, the case law it quotes keeps the door firmly shut.) [§§22-23]

In summary: obligation for the BDPA to re-assess a more limited scope of the action plan for validation, obligation to consult with IAB Europe, and no right for complainants to be involved in assessing the action plan.

Redacted EN machine translation attached.
IAB Europe press release: https://lnkd.in/efSJVF8v

Data protection GDPR privacy adtech