EU Court of Justice · 7 March 2024
IAB Europe
In plain English
The 'TC String' that records a user's cookie and advertising choices is personal data when it can reasonably be linked to an identifier such as an IP address. IAB Europe, which wrote the rules, can be a joint controller even without access to the data.
What the court ruled
a string composed of a combination of letters and characters, such as the TC String (Transparency and Consent String), … constitutes personal data within the meaning of that provision in so far as, where those data may, by reasonable means, be associated with an identifier, such as, inter alia, the IP address of that user's device, they allow the data subject to be identified.
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the court’s own records is authoritative. The plain-English line is Fino’s own summary, not legal advice.