On 14th May 2025, a European appeals court issued a ruling that will have immediate and widespread effects on how online advertising works across the EU.
According to the Irish Council for Civil Liberties (ICCL), this decision states the advertising industry’s standard approach to collecting consent for personalised ads, known as the Transparency and Consent Framework (TCF), is technically illegal under GDPR.
If your business relies on digital advertising, whether directly or through agencies, you need to understand exactly what has changed, why it matters and what steps you should take next.
How did we get to the court ruling?
In the digital advertising world, personal data is valuable. Companies track what websites people visit, what they search for and even where they go in real life to build detailed profiles. These profiles are then used to target ads more precisely, hoping to improve results and reduce wasted ad spend.
However, the introduction of the General Data Protection Regulation (GDPR) in 2018 changed the rules. GDPR requires that companies collect informed, clear, and freely given consent before processing personal data. In response, the advertising industry created a system to manage this consent:
- This system is called the Transparency and Consent Framework (TCF).
- It was developed by IAB Europe, the leading industry body for digital advertising.
- The TCF powers the ‘cookie consent’ banners you see on websites, giving people the option to accept or reject tracking.
In theory, this allowed companies to continue using personal data for advertising while staying compliant with GDPR. In practice, however, this system has been criticised for being confusing and manipulative, and failing to provide meaningful choices to users.
What did the court decide?
The case against IAB Europe’s TCF has been building for several years. Privacy groups argued that the system was designed to appear compliant while allowing companies to continue gathering and sharing personal data without genuine consent.
The Belgian Market Court, which handles appeals, agreed with these criticisms. It found that the TCF violates several GDPR principles, including:
- Lack of transparency – People often don’t understand what they’re agreeing to. Consent banners are filled with complex language and make rejecting tracking difficult.
- No real consent – Many sites assume consent unless a user actively opts out, which goes against GDPR’s standard of explicit, opt-in consent.
- Invalid ‘Legitimate Interest’ claims – Companies claimed they had a legitimate interest in processing personal data even without consent. The court rejected this reasoning.
- Poor data security – The system allowed personal data to be shared widely in real-time auctions (used for programmatic advertising) without proper security or control over who received the data.
The court ruled that the TCF is unlawful and that any personal data gathered using this framework should be considered illegally collected.
Why the ruling matters
This ruling doesn’t just apply to IAB Europe. It affects any company operating in the EU that relies on behavioural advertising, meaning ads based on tracking people across websites and apps.
- The decision applies immediately across all EU countries.
- National regulators can start issuing fines and demanding that non-compliant tracking is removed (i.e. the ICO).
- Any personal data collected under the TCF is now considered risky and should be deleted.
Who is affected by this ruling?
1. Ad platforms and tech giants
Companies like Google, Meta (Facebook and Instagram), Amazon and Microsoft have all relied heavily on behavioural tracking to fuel their ad platforms. These platforms use personal data to build detailed user profiles, which power highly targeted advertising.
With this ruling, unless these companies can collect fresh, explicit, and informed consent from EU users, they cannot continue to process or use this data for advertising.
2. Publishers and website owners
Around 80% of websites in the EU have implemented the TCF (a cookie banner). This includes major publishers like news organisations, blogs and e-commerce platforms.
If these websites continue using the current version of the TCF or similar systems, they risk enforcement action. Publishers may also see a decline in advertising revenue as behavioural targeting becomes more restricted.
3. Advertisers using third-party data and retargeting
Any business running campaigns that rely on third-party data, e.g. audience segments purchased from data brokers, or behavioural retargeting strategies will be directly impacted. Here are some industry-specific examples:
- Retailer example:
- Before: The Meta Pixel or Google Tag tracked who visited product pages but didn’t buy. These people were automatically added to a retargeting pool for future ads.
- Now: Without clear consent, that tracking isn’t allowed. Fewer users will appear in retargeting pools and those audiences will shrink or become unavailable entirely.
- Travel company example:
- Before: The company ran a Google Display campaign targeting people who were ‘in-market’ for a holiday, based on browsing behaviours across multiple sites.
- Now: Google will need to find new ways to legally collect this data. The immediate impact will be that these audiences become smaller, less reliable, and slower to refresh.
What hasn’t changed?
It’s important to understand that advertising itself isn’t banned. The ruling targets how personal data is collected and used, not the practice of advertising itself.
Here’s what remains perfectly legal:
- First-party data – Data collected directly from your customers, with clear consent (e.g. newsletter sign-ups and account registrations).
- Contextual advertising – Ads based on the content of the page someone is reading, not their personal data (e.g. showing hiking boots on an outdoor gear blog).
- Personalised ads with genuine consent – You can still run targeted ads if you gather proper consent at the right time and store that data securely.
What should you be doing now?
If you’re a marketing manager or business leader, we recommend that you:
1. Audit your website’s consent mechanism
- Is it compliant with GDPR and this new ruling?
- Are users genuinely given a choice to opt-in, or are you assuming consent by default?
- If you’re unsure, ask your agency or web team for a compliance review.
2. Review how your ad campaigns use data
- Are you relying heavily on behavioural targeting, or retargeting of your website visitors?
- If so, start building alternative strategies focused on first-party data (see below).
3. Consider shifting budgets towards contextual advertising
- Platforms like Google’s Display Network and some programmatic platforms offer contextual ad targeting options.
- Ads can be placed based on page content rather than personal profiles, which remains unaffected by these changes.
4. Strengthen your creative and offers
- Without hyper-targeted ads, creative quality becomes even more important.
- Ensure your ads have strong messaging and compelling offers that can convert broader audiences.
5. Talk to your agency about their compliance plans
- Are they proactively adjusting campaigns and strategies?
- What steps are they taking to keep your campaigns performing under these new conditions?
How to shift from behavioural targeting to first-party data without killing campaign performance
1. Build data collection into every customer touchpoint
- Add clear, value-driven lead capture to your website (guides, checklists, discounts, loyalty programs).
- Use website pop-ups, exit intent offers, and embedded forms to capture emails and preferences.
2. Run lead generation campaigns on Meta and Google
- Instead of targeting people ‘in-market’, run campaigns purely focused on collecting emails and qualifying interest.
- Offer something in return – Discounts, early access to offers, or helpful content. Or as a travel example – ‘Sign up for our city break deals before they go public.’
3. Upload and activate this data in Google and Meta
- Use Google Customer Match and Meta Custom Audiences to target these people directly.
- Build lookalike audiences based on this clean, consented data (this is much safer legally and often more accurate).
4. Focus on on-platform engagement signals
- Run campaigns that build warm audiences based on video views, post engagement, and clicks, especially on Meta.
- These engagement signals remain fully available and are unaffected by the EU ruling.
5. Improve your CRM integration and data hygiene
- Ensure collected emails and customer data are stored securely and tagged for marketing use.
- Regularly clean and update your lists. Old data isn’t useful if people have disengaged.
6. Shift to contextual and placement-based targeting where needed
- On Google Display and YouTube, focus more on content-based placements rather than audience signals.
- Example – Run ads on top travel blogs, YouTube travel influencers’ channels, or financial planning websites (for people saving for big holidays).
Final thoughts
This is a major turning point for online advertising in the EU, but it’s not the end of digital marketing. It simply means that the industry must move away from over-reliance on invasive tracking methods and put greater emphasis on transparency, genuine customer relationships and creative advertising strategies.
At AB, behavioural retargeting has always delivered strong results for our clients, especially in sectors like travel and retail. We recognise this ruling may temporarily reduce the size of data pools for some campaigns, but this is exactly why clients choose to work with agencies – we stay ahead of these changes, so they don’t have to. We’ll adapt, evolve, and who knows, these new strategies might deliver even better results than the old ways!
This article was written by Justin Elliott, using AI tools to assist with research and content structuring.