---
title: "IAB Europe fined EUR 250,000 (Belgium, 2022)"
canonical: "https://dposchool.com/gdpr/fine/apd-iab-europe-2022-02"
source: "https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr"
source_note: "Only the authority's decision is authoritative."
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Fine · Belgium

# IAB Europe: EUR 250,000

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

- **Authority:** Autorité de protection des données / Gegevensbeschermingsautoriteit (Belgium)
- **Country:** Belgium
- **Date:** Decision of 2 February 2022
- **Amount:** EUR 250,000, as imposed (not converted)
- **Appeal status:** Upheld ([source](https://www.dataprotectionauthority.be/citizen/the-market-court-rules-in-the-iab-europe-case))
- **Provisions cited:** [Article 5(1)(a)](https://dposchool.com/gdpr/article/5#1-a), [Article 5(1)(f)](https://dposchool.com/gdpr/article/5#1-f), [Article 6](https://dposchool.com/gdpr/article/6), [Article 12](https://dposchool.com/gdpr/article/12), [Article 13](https://dposchool.com/gdpr/article/13), [Article 14](https://dposchool.com/gdpr/article/14), [Article 24](https://dposchool.com/gdpr/article/24), [Article 25](https://dposchool.com/gdpr/article/25), [Article 30](https://dposchool.com/gdpr/article/30), [Article 32](https://dposchool.com/gdpr/article/32), [Article 35](https://dposchool.com/gdpr/article/35), [Article 37](https://dposchool.com/gdpr/article/37)

## What the fine was for (summary, not the official text)

The ad-industry Transparency and Consent Framework processed users' preference strings without a legal basis, with vague information, weak safeguards, no records, no DPIA and no DPO.

## Official source

- [Decision or announcement of the authority](https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr)

Checked against the official source on 28 October 2026.

Only the authority's decision is authoritative. This is reference material, not legal advice.

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Fines](https://dposchool.com/gdpr/fines) / IAB Europe

[All fines](https://dposchool.com/gdpr/fines)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents