IAB Europe files challenge to APD validation of action plan

Julie Rubash, Chief Privacy Counsel
February 13, 2023

Want to receive these weekly privacy recaps in your inbox? Sign up for our privacy newsletter, A Little Privacy, Please.


Biden Calls for Limits on Targeted Ads; IAB Issues Cautionary Response

In his State of the Union Address, U.S. President Biden called for bipartisan support to ban targeted advertising online for children and young people, to enact strong protections for childrens’ privacy, health and safety online, and to impose strong limits on targeted advertising and the personal data that companies collect on all Americans.

In response, the Interactive Advertising Bureau (IAB) Executive Vice President for Public Policy Lartease Tiffith issued a statement supporting data privacy, protecting kids online, and punishing bad actors, but warning that “blaming data and technology for complex problems, and restricting or eliminating digital advertising, could severely diminish the benefits of the internet for everyone.”


Tiffith issued a similar statement in July 2022 in response to the House Energy and Commerce Committee’s passage of the American Data Privacy and Protection Act (ADPPA), which would have prohibited the collection or processing of “information identifying an individual’s online activities over time and across third party websites or online services” except for certain permitted purposes that did not include targeted advertising.

Tiffith stated that the IAB could not support the bill, emphasizing that “the average internet user enjoying speed and convenience would encounter a less friendly online environment” if such heavy regulations on targeted advertising were imposed. 

3 More States Introduce Comprehensive Privacy Bills, While Indiana Advances

TexasMinnesota and Maryland introduced comprehensive privacy legislation last week, bringing the total number of states with active comprehensive privacy legislation to 16 (with one, Mississippi, dropping off). All three new bills largely resemble existing privacy laws, although both the Minnesota and Maryland bills include a private right of action.

Maryland also saw introduction of a Children’s data bill, following a growing trend of states following in the footsteps of California’s Age Appropriate Design Code. Meanwhile, the Indiana Senate unanimously passed comprehensive privacy bill SB 5.


Indiana SB 5, which resembles Virgnia’s VCDPA, was the early leader last year (as SB 358) as well.

Indiana was the first state in 2022 to advance a comprehensive privacy bill both past committee and through one chamber.

Ultimately though, the bill never reached a vote on the House floor and saw no activity after mid February.     


IAB Europe Seeks Action Plan Enforcement Stay, Pending CJEU Decision

IAB Europe announced that it has made a formal request to the Belgian Market Court to prevent the Belgian Data Protection Authority (APD) from enforcing changes to the IAB Europe’s Transparency and Consent Framework (TCF), pending a ruling from the Court of Justice of the European Union (CJEU).

This request comes in response to a January 2023 announcement from the APD approving IAB Europe’s action plan, triggering a 6-month timeline to implement changes to the TCF, despite that two questions fundamental to the underlying merits of the case are still pending with the CJEU.

IAB Europe argues that, if the CJEU finds that IAB Europe is not a controller or that the TCF’s Transparency and Consent String is not personal data (the two questions pending before the CJEU), the steps in the action plan premised on those findings would have to be rolled back, which would result in wasted resources and misled consumers. 


If IAB Europe’s request is granted, the July 11, 2023 deadline to implement the action plan will cease to apply, pending the CJEU decision, which is not expected until late 2023 or 2024.

In the meantime, IAB Europe has said that it will move ahead with positive changes to the TCF that are less impacted by the referral to the CJEU. 

Follow our updates on the Belgian DPA and the TCF

EU Parliament Stresses Importance of Regulating Political Ad Targeting

The European Parliament issued a statement warning of the potential harms from political advertising, including the processing of sensitive personal data for political micro-targeting, and supporting EU rules on political advertising.

The Statement noted that political micro-targeting has been found to affect people’s rights, including freedom of opinion, access to objective, transparent and pluralistic information, and their ability to make political decisions. 


The EU Parliament says it aims to reach an agreement on complementary rules to prevent abusive political advertising in time for the 2024 European elections. 


Meta Fined in South Korea for Blocking Users Who Don’t Consent

The South Korea Personal Information Protection Commission (PIPC) reportedly imposed a 6.6 million won penalty on Meta based on allegations that Meta was blocking people from using Facebook and Instragram services if they refused consent to the collection of behavioral information and activities across unaffiliated websites.

The PIPC found this practice to violate South Korea’s Personal Information Protection Act, because the information was not necessary to provide Facebook and Instagram services, the purpose for which, PIPC found, “is for users to know news about and communicate with friends, not to view customized advertisements.”


This fine comes on the heels of a previous 30.8 billion won fine against Meta issued in late 2022, based on Meta’s failure to obtain user consent to collect personal information for online targeted ads.   

Want more of the privacy highlights that matter to adtech and martech? Sign up for our privacy newsletter, A Little Privacy, Please.

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.

Latest Blog Posts

Vermont Data Privacy Bill Is Vetoed

June 17, 2024

Vermont Governor announced his veto of a bill that...

You Are Who You Work With: Cookie Consent and Data Privacy

June 11, 2024

Who you work with for consent management and data...

Texas AG Prepares for “Aggressive Enforcement” of Privacy Laws

June 10, 2024

Texas Attorney General announced a data privacy and security...

Latest White Papers

Benchmark Report: US Privacy Compliance

August 19, 2022

The current state of publisher compliance with CCPA, and...

Ebook: A Publisher’s Guide to Vendor List Curation

December 16, 2021

How to review your vendor list to mitigate compliance...

Keep in touch

Sign up for our newsletter to keep up with privacy news for adtech and martech,
plus occasional company news.

Let's explore what we can do together.

We'll be in touch within 48 hours

[contact-form-7 id="593" title="Schedule a Demo"]