The issue here is larger than using the right language. I'm browsing through the full ruling [0], but C.1. Breaches, pages 115-117 is a good summary.
- "First, the consent
of the data subjects is currently not given in a sufficiently specific, informed and granular
manner"
- "Second, the legitimate interest of the organisations participating in the TCF is
outweighed by the interests of the data subjects, in view of the large-scale processing
of the users’ preferences (collected under the TCF) in the context of the OpenRTB
protocol and the impact this can have on them."
- "In the absence of systematic and automated monitoring
systems of the participating CMPs and adtech vendors by the defendant, the integrity
of the TC String is not sufficiently ensured, since it is possible for the CMPs to falsify the
signal in order to generate an euconsent-v2 cookie and thus reproduce a "false
consent" of the users for all purposes and for all types of partners. As indicated above248,
this hypothesis is also specifically foreseen in the terms and conditions of the TCF" - no way to verify consent
- "The Litigation Chamber also finds that the current version of the TCF does not facilitate
the exercise of the data subject rights, especially taking into consideration the joint-
controllership relation between the publisher, the implemented CMP and the
defendant. " - no way to revoke consent, or request your data
As to why the system ran for so long: yes, enforcement is (too) slow.
- Many complaints were made to several European DPAs in 2019.
- Litigation commenced 13 October 2020
- Interim Decision 8 January 2021, amended 23 February 2021
It looks like IAB made a lot of procedural complaints when it became clear their arguments were rejected
- "First, the consent of the data subjects is currently not given in a sufficiently specific, informed and granular manner"
- "Second, the legitimate interest of the organisations participating in the TCF is outweighed by the interests of the data subjects, in view of the large-scale processing of the users’ preferences (collected under the TCF) in the context of the OpenRTB protocol and the impact this can have on them."
- "In the absence of systematic and automated monitoring systems of the participating CMPs and adtech vendors by the defendant, the integrity of the TC String is not sufficiently ensured, since it is possible for the CMPs to falsify the signal in order to generate an euconsent-v2 cookie and thus reproduce a "false consent" of the users for all purposes and for all types of partners. As indicated above248, this hypothesis is also specifically foreseen in the terms and conditions of the TCF" - no way to verify consent
- "The Litigation Chamber also finds that the current version of the TCF does not facilitate the exercise of the data subject rights, especially taking into consideration the joint- controllership relation between the publisher, the implemented CMP and the defendant. " - no way to revoke consent, or request your data
As to why the system ran for so long: yes, enforcement is (too) slow.
- Many complaints were made to several European DPAs in 2019.
- Litigation commenced 13 October 2020
- Interim Decision 8 January 2021, amended 23 February 2021
It looks like IAB made a lot of procedural complaints when it became clear their arguments were rejected
[0] https://www.gegevensbeschermingsautoriteit.be/publications/b...